Horizon Alert
Summary of the vulnerability and why it matters
A security issue has been identified in OTRS, a system used for managing tickets and customer service. This vulnerability allows previously obtained authentication tokens to remain valid even after an account is deactivated or a password is changed, potentially enabling continued access by an attacker for up to 16 hours. The impact depends on the privileges associated with the compromised token, which could range from customer account access to broader administrative functions.
- Expired tokens can grant continued system access.
- Matters if your organization uses OTRS for service management.
- Assess OTRS use; confirm if any expired tokens persist.
Attack Path
How an attacker could exploit the issue
An attacker who has previously obtained a valid authentication token can exploit this vulnerability to access OTRS with the privileges of a deactivated user account or a user whose password has been changed. The token remains valid for approximately 16 hours, allowing continued access until its regular expiration. The risk associated with this vulnerability depends on the privileges of the compromised token, potentially granting access to sensitive ticket, customer, or administrative information.
- Attacker must have a previously issued, valid token.
- Deactivating an account or changing password does not invalidate tokens.
- Unauthorized access to user or admin functions.
Live Threat
Current exploitation, exposure, and threat context
Previously issued authentication tokens may remain valid for up to 16 hours after an OTRS agent or customer user account is deactivated or their password is changed. This could allow an attacker who previously obtained a valid token to maintain access to the system with the compromised user's privileges until the token naturally expires. The impact depends on the specific permissions granted to the token's associated account.
- Ticket and customer data at risk.
- Previously obtained token is reused.
- Unauthorized access to system functions.
Operational Fix
Recommended remediation, mitigation, and detection steps
To address this vulnerability, application owners and platform teams should be the first point of contact. The immediate priority is to identify all instances of the affected OTRS system, confirm their exposure and business criticality, and then determine the specific accountable owner for each instance. Remediation efforts should then be planned and executed based on this risk assessment.
- Application owners and platform teams.
- Verify system exposure and business criticality.
- Plan and coordinate remediation actions.
