Squiz Matrix CMS squashes admin account takeover bug

guest · Sep 5, 2022

IDOR issue meant user account privileges and contact details could be altered
By Adam Bannister @Ad_Nauseum74 - September 5, 2022

An indirect object reference (IDOR) vulnerability in the Squiz Matrix web content management system (CMS) could have enabled attackers to seize admin rights on targeted installations.

Squiz Matrix is a browser-based website-building tool reportedly used by more than 280 organizations, including governments, businesses, and half of Australian and New Zealand universities, as well as several UK higher education institutions.
Click to expand...

Discovered during a pen-test engagement by Trustwave SpiderLabs, the privilege escalation flaw meant a low privileged user could change the contact details of any user – including administrators.

By changing an administrator’s email to an attacker-controlled address they could then initiate a password reset and take control of their account.
Click to expand...

And, “as user account numbers are in a sequential order, an attacker could run through user account numbers and change the details of every user registered to the vulnerable Squiz Matrix instance”, according to a blog post disclosing the flaw.

Squiz Matrix patched the vulnerability for all customers as of June 14, 2022, well before Trustwave disclosed details of the problem on August 31.
Click to expand...

SpiderLabs: Squiz Matrix CMS Authenticated Privilege Escalation through IDOR

By Zak Willsallen - August 31, 2022
During a recent engagement, Trustwave SpiderLabs discovered an Indirect Object Reference (IDOR) vulnerability within Squiz Matrix CMS which would allow any low privileged user to change the contact details of any other user on a Squiz Matrix instance (including administrators).

An attacker exploiting the vulnerability could change an administrator’s email address to an attacker-controlled email address after which the attacker could reset the administrator’s password. This would allow a low privileged user or attacker to take over any Squiz Matrix user’s account.
Click to expand...

Log in or Sign up

Squiz Matrix CMS squashes admin account takeover bug

guest Guest

Log in or Sign up

Squiz Matrix CMS squashes admin account takeover bug

guest Guest

Useful Searches