Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Unraid OS 6.8.0 Authentication Bypass Vulnerability

Information

Severity

Severity

Critical

Family

Family

Web application abuses

CVSSv2 Base

CVSSv2 Base

10.0

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Solution Type

Solution Type

Vendor Patch

Created

Created

4 years ago

Modified

Modified

4 years ago

Summary

The Web UI of Unraid OS is prone to an authentication bypass vulnerability.

Insight

Insight

In order to check if a web page requires authentication, unraid uses a auth_request.php file that contains a whitelist which uses the strpos function for comparing strings. The whitelist can therefore be bypassed by appending additional characters to an entry in the whitelist.

Affected Software

Affected Software

Unraid OS version 6.8.0.

Detection Method

Detection Method

Sends a crafted HTTP GET request and checks the response.

Solution

Solution

Update to version 6.8.1 or later.

Common Vulnerabilities and Exposures (CVE)