Versa Networks has announced patches for a vulnerability in its Versa Directorthat exposes authentication tokens.
See also: Critical vulnerability in Microchip ASF puts IoT devices at risk
Authentication tokens are a secure way to verify a user's identity in digital systems. They are unique sets of data that act as an electronic key, granting access to specific resources without requiring a password each time. When a user connects to a service, the server generates a token, which is then sent to the user and stored on device . This token is then used for subsequent authentication requests, optimizing user access while maintaining security.
Known as CVE-2024-45229 (CVSS score 6.6), the vulnerability relates to the REST API in Versa Networks' Versa Director, which is used for orchestration and management, and could lead to the exposure of authentication tokens.
Some of these APIs, including those used for the login screen, banner display, and device registration, do not require authentication by default.
“However, it was discovered that for Directors that are directly connected to the Internet, one of these APIs can be exploited by inserting invalid arguments into a GET request, potentially exposing the authentication tokens of other connected users,” Versa explains in an advisory.
See also: New MacOS HZ RAT allows remote device control
An attacker who can obtain other users' tokens could then use them to call additional APIs on port 9183, the network management company explains.
Versa Networks notes that the vulnerability cannot be used to expose usernames and passwords, and that, if Versa Director is deployed behind a firewall or API gateway, the security solution "can be used to block access to vulnerable API URLs."
Versa has released hotfixes for Director versions 22.1.4, 22.1.3, 22.1.2 , and 21.2.3 and recommends that all users update to the latest versions as soon as possible. Those using Director versions 22.1.1 and 21.2.2 should upgrade to the patched 22.1.3 and 21.2.3, respectively.
«Versa Networks is not aware of this exploit on any production systems.
See also: Unexplained "Noise Storms" are sweeping the Internet
On Friday, the US cybersecurity agency CISA drew attention to Versa Networks' security advisory, urging organizations to apply necessary updates for the vulnerability and look for any malicious activity in their environment.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
