Critical RCE, account takeover flaws patched in Rock RMS church management platform

guest · Jan 4, 2021

Critical RCE, account takeover flaws patched in Rock RMS church management platform
Open source CRM software is used by at least 500 churches globally
January 4, 2021
https://portswigger.net/daily-swig/...atched-in-rock-rms-church-management-platform

Rock RMS, a ‘relationship management system’ for churches, was affected by a pair of critical vulnerabilities that could lead to account takeover and remote code execution (RCE).

Security researchers who unearthed these and several other less serious flaws in the open source application have urged users to update their systems as soon as possible.
The application’s ongoing development is funded through voluntary donations, although the security researchers claimed that “in some cases, early access to patches require a paid subscription”.
Click to expand...

The researchers, from the ‘Cyber Security Research Group’, found a critical logic flaw in how a block list function validates file extensions (CVE-2019-18643) that meant attackers could upload malicious files to any system directory via fileUpload.ashx and achieve RCE.
The other critical bug in Rock RMS (CVE-2019-18642) could see attackers tamper with user IDs after they are sent to the server following profile updates made by low privileged users, and then “make changes to any other user”.

Both flaws were assigned a near-maximum CVSS score of 9.8.
Click to expand...

A third, medium severity flaw (CVSS 5.3) in the GetVCard functionality “allowed any unauthenticated user to loop through all sequential user ID’s and exfiltrate user’s personal information”, such as “first name, last name, phone numbers, email address, [and] physical address.” (CVE-2019-18641).

Security researchers also found several unsecured API calls, a reflected cross-site scripting (XSS) flaw, and information leakage arising from a problem with private calendar access.
Click to expand...

Multiple vulnerabilities found in Rock RMS including RCE and account takeover

Log in or Sign up

Critical RCE, account takeover flaws patched in Rock RMS church management platform

guest Guest

Log in or Sign up

Critical RCE, account takeover flaws patched in Rock RMS church management platform

guest Guest

Useful Searches