Description
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | REMS | ≤ 1.0.0 | — |
References
- https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46 technical-description exploit
- REMS by OpsTree Product Page product
- VulnCheck Advisory: OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag third-party-advisory