CVE-2020-28856

Vulnerability

OpenAsset Digital Asset Management incorrectly uses the X-Forwarded-For HTTP header to determine the originating IP address of a request. This allows an attacker to supply a localhost address such as 127.0.0.1 in the header, effectively spoofing their IP. The vulnerability affects Cloud version 12.0.19 and On-Premise version 11.2.1, as discovered in [2].

Exploitation

An attacker with network access to the OpenAsset application can craft an HTTP request containing an X-Forwarded-For header set to a localhost address (e.g., 127.0.0.1). No authentication or special privileges are required beyond the ability to send requests to the target server. The application then treats the request as originating from localhost, bypassing any configured IP-based restrictions [2].

Impact

Successful exploitation allows the attacker to bypass all IP address-based access controls configured in OpenAsset. This could lead to unauthorized access to restricted areas, functions, or data within the Digital Asset Management system, potentially compromising confidentiality and integrity depending on the applied controls [2].

Mitigation

OpenAsset has released fixes: Cloud version 12.0.20 and On-Premise version 11.4.10. Users should upgrade to these patched versions as soon as possible [2]. If immediate upgrade is not feasible, consider implementing network-level filtering to strip or validate X-Forwarded-For headers until the application can be updated.