[Bug ] Authentication Bypass Vulnerability

[us3r]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	any
OS version (client)	any
Cortex version / git hash	3.1.1-1 +
Package Type	any
Browser type & version	any

Problem Description

It has been observed that Cortex Version: 3.1.1-1 application is vulnerable to Authentication Bypass. An attacker with an account in the application is able to log into the account of any other application user (including the administrator) which in consequence may lead to a compromise of the application and each of its users.

Steps to Reproduce

1. Prepare a POST request to /api/login with EMPTY password of existing user
2. send the request

Possible Solutions

It is the same issue as on thehive 2391

Complementary information

tested on cortex integrated with AD

[To-om]

Fixed in 3.1.5