Description
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
yincongcyincong MuseBot
Default version status: unaffected
0 to < 2.0.0affected
References
- https://github.com/yincongcyincong/MuseBot/issues/61 ↗
- https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae ↗
- https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681 ↗
- https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28 ↗
- https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88 ↗
- https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass ↗
- https://github.com/yincongcyincong/MuseBot ↗
- https://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key ↗