Multiple vulnerabilities in Apache Guacamole



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-43999
CVE-2021-41767
CWE-ID CWE-285
CWE-200
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Guacamole
Server applications / Remote management servers, RDP, SSH

Vendor Apache Foundation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper Authorization

EUVDB-ID: #VU59553

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-43999

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to bypass authorization process.

The vulnerability exist  due to improper validation responses, received from a SAML identity provider. A remote user can assume identity of another Guacamole user, is SAML support is enabled.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Guacamole: 1.2.0 - 1.3.0

CPE2.3 External links

https://lists.apache.org/thread/4dt9h5mo4o9rxlgxm3rp8wfqdtdjn2z9
https://www.openwall.com/lists/oss-security/2022/01/11/7


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU59552

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-41767

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to the application includes a private tunnel identifier in the non-private details of some REST responses. A remote user can obtain the private tunnel identifier and use it to interact with another user's active use of that same connection.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Guacamole: 0.8.3 - 1.3.0

CPE2.3 External links

https://lists.apache.org/thread/5l31k4jmzdsfz0xt8osrbl878gb3b7ro
https://www.openwall.com/lists/oss-security/2022/01/11/6


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###