HGiga MailSherlock - Broken Authentication

Vulnerability

HGiga MailSherlock, specifically the iSherlock MSR45/SSR45 system, contains a weak authentication flaw in its login page. The authentication mechanism uses a default password generation algorithm that allows any account to be accessed. Affected packages are iSherlock-base-4.5 prior to version 243, iSherlock-user-4.5 prior to 114, iSherlock-useradmin-4.5 prior to 122, iSherlock-audit-4.5 prior to 143, and iSherlock-antispam-4.5 prior to 130 [1].

Exploitation

An unauthenticated attacker can remotely exploit this vulnerability by sending crafted requests to the login page. By leveraging the predictable default password generation mechanism, the attacker can authenticate as any user, including administrative accounts, without needing any prior credentials or user interaction [1].

Impact

Successful exploitation grants the attacker full privileges on the affected MailSherlock system. This leads to complete compromise of confidentiality, integrity, and availability, as the attacker can read, modify, or delete all data and execute arbitrary commands with administrative rights [1].

Mitigation

The vulnerability is fixed in the following package versions: iSherlock-base-4.5-243, iSherlock-user-4.5-114, iSherlock-useradmin-4.5-122, iSherlock-audit-4.5-143, and iSherlock-antispam-4.5-130. Users should update to these versions or later. No workaround is available [1].