#VU52976 Insecure configuration in Reticulum - CVE-2021-29954

Vulnerability identifier: #VU52976

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-29954

CWE-ID: CWE-16

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Reticulum
Web applications / Modules and components for CMS

Vendor: Mozilla

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insecure proxy configuration built into our Reticulum software package, which allowed access to internal URLs, including the metadata service, which could allow access to credentials specific to a Hubs Cloud Instance. A remote non-authenticated attacker can obtain sensitive information and use it to compromise the Hubs Cloud Instance.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Reticulum: 1.0.1/20200817225751 - 1.0.20201012230301

---

External links
https://www.mozilla.org/en-US/security/advisories/mfsa2021-21/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.