Description
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pig-mesh | pig | < 4.1.0 | 4.1.0 |
References
- Researcher write-up third-party-advisory exploit
- GitHub Issue #1249 (content redacted by the maintainer) issue-tracking
- Fix commit ce958668 patch
- SysUserServiceImpl.java at v4.0.0 technical-description
- SysRegisterController.java at v4.0.0 technical-description
- https://github.com/pig-mesh/pig product
- VulnCheck Advisory: pig before 4.1.0 Unverified Password Change via /register/password third-party-advisory