Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in OpsTree REMS software. An authentication bypass flaw allows unauthorized individuals to gain administrative access by exploiting a specific setting during the login process. The main concern is confirming relevance and exposure due to the potential for elevated access.
- Bypass grants administrative access.
- Critical flaw affects user logins.
- Confirm relevance and assess exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending a specially crafted request to the user login API. This bypasses normal authentication by manipulating the `is_local_auth` field, allowing the attacker to gain administrative access.
- No special access is required.
- Login API request manipulation.
- Gains administrative access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to bypass authentication and gain SuperUser administrative access to the OpsTree REMS system. This is possible by manipulating the `is_local_auth` field during the login process, enabling unauthorized access to sensitive system functions and data.
- Administrative access to the system.
- Via API login request with modified field.
- Unauthorized system control and data access.
Operational Fix
Recommended remediation, mitigation, and detection steps
The OpsTree REMS application, specifically versions up to 1.0.0, has a critical authentication bypass vulnerability. This flaw allows unauthenticated attackers to gain SuperUser administrative access by manipulating the `is_local_auth` field during a login request. Identifying the deployment of REMS, its reachability, business criticality, and accountable owner is the immediate first step.
- Own the discovery and risk assessment.
- Verify REMS deployment and reachability.
- Plan remediation based on risk.
