Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in DrangSoft's GCB/FCB Audit Software, which is used for government financial cybersecurity configuration. This flaw allows unauthorized remote access to specific APIs, enabling the creation of new administrative accounts. The main concern is to confirm if this specialized audit software is in use within the organization and, if so, to what extent it might be exposed.
- Unauthenticated access to audit software APIs.
- Critical flaw allows new admin account creation.
- Confirm relevance and exposure for audit tools.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can remotely access specific APIs in the GCB/FCB Audit Software. This allows them to create a new administrative account without needing any prior access or credentials.
- Network access required.
- Direct API access triggers vulnerability.
- New admin account creation.
Live Threat
Current exploitation, exposure, and threat context
Unauthenticated remote attackers could exploit this vulnerability to create a new administrative account for the GCB/FCB Audit Software. This could allow unauthorized individuals to gain administrative control over the audit software's functionalities and data.
- Audit software administrative access.
- Direct API access to create accounts.
- Unauthorized control of audit functions.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
The GCB/FCB Audit Software, used for government financial cybersecurity configuration, has an unauthenticated API vulnerability. This flaw allows remote attackers to create new administrative accounts, posing a critical risk. Ownership will likely fall to the application or platform team responsible for the DrangSoft software, with initial steps focusing on asset identification and reachability assessment.
- Own the GCB/FCB Audit Software.
- Verify external reachability and business criticality.
- Plan risk-based remediation and vendor coordination.
