Horizon Alert
Summary of the vulnerability and why it matters
The U.S. Government Accountability Office and Civilian Board of Contract Appeals systems have a security flaw that allows anyone on the internet to change any user's password without needing to know the current password. This vulnerability affects the systems used for managing electronic dockets and profiles.
- Unauthenticated users can change any profile password.
- Confirms relevance and exposure of public-facing systems.
- Verify impact on user accounts and data access.
Attack Path
How an attacker could exploit the issue
An attacker can target the GAO Electronic Protest Docketing System and the CBCA Electronic Docketing System by interacting with a specific API endpoint without needing any prior access or authentication. This vulnerability allows for unauthorized password changes for any user within the system.
- Unauthenticated, remote access required.
- Password change API endpoint is vulnerable.
- Allows arbitrary user password modification.
Live Threat
Current exploitation, exposure, and threat context
An attacker could change any user's password on the Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) by exploiting a lack of authentication for password change requests to the '/update-profile/N' API endpoint. This could occur when the systems are operational and accessible via the internet.
- User account credentials
- Attacker sends unauthenticated requests
- Unauthorized account access
Operational Fix
Recommended remediation, mitigation, and detection steps
The U.S. Government Accountability Office (GAO) and Civilian Board of Contract Appeals (CBCA) systems are likely managed by their respective IT and security teams. The first practical step is to identify all instances of these systems, confirm their accessibility and criticality, and locate the accountable owner to plan remediation based on risk.
- Identify system owners and affected assets.
- Verify system reachability and business criticality.
- Plan remediation based on identified risks.
