Horizon Alert
Summary of the vulnerability and why it matters
This issue in ChurchCRM allows attackers to bypass security controls like account lockouts and two-factor authentication by exploiting a flaw in the user login API. This means an attacker with a user's password could gain unauthorized access to sensitive data and system functions.
- Compromised user credentials can bypass 2FA.
- Direct access to protected API endpoints is possible.
- Bypasses account lockout security.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by directly calling the login API endpoint without proper authentication checks. If the attacker knows a valid username and password, they can bypass account lockouts and two-factor authentication to retrieve an API key. This grants them access to all protected API functions as that user.
- Target API login endpoint.
- Bypass normal authentication flow.
- Obtain user API key.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could be attractive to attackers looking to bypass security controls on a church management system. The ability to directly obtain an API key bypasses account lockout and two-factor authentication, offering a direct path to user privileges. While this is a critical flaw, the specific nature of the software may limit widespread attacker interest compared to more general-purpose applications.
- Exploitation requires prior knowledge of a username and password.
- No public exploit or KEV signals observed.
- Vulnerability fixed in version 7.2.0.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching ChurchCRM to version 7.2.0 immediately due to the critical bypass of authentication controls, which could allow unauthorized API access. If immediate patching is not feasible, implement strict network segmentation and heightened monitoring around the affected application to detect and block suspicious API access attempts.
- Apply patch to version 7.2.0.
- Isolate affected services from network.
- Monitor for API key abuse.
