Description
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
HoshinoSuzumi chronoframe
Default version status: unaffected
0 to ≤ 1.0.0affected
pkg:github/HoshinoSuzumi/chronoframeReferences
- https://hackmd.io/@hieuPenguinnn/chronoframe-unauthenticated-wizard-config-takeover ↗
- https://github.com/HoshinoSuzumi/chronoframe/blob/v1.0.0/server/api/wizard/storage.post.ts#L1-L26 ↗
- https://github.com/HoshinoSuzumi/chronoframe ↗
- https://www.vulncheck.com/advisories/chronoframe-through-1.0.0-missing-authentication-via-setup-wizard-api ↗