Threat Intelligence Database

CentreStack versions before 17.3 have an unauthenticated deserialization vulnerability in GSNamespace.dll. This flaw allows unauthenticated attackers to create arbitrary local OS user accounts by sending a crafted base64-encoded XML string to specific API endpoints. The vulnerability is triggered via the StorageConfigure parameter to jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints, leading to invocation of the NetUserAdd Windows API with attacker-controlled credentials. This can also result in creation of arbitrary directories on the server filesystem.

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.

CentreStack versions before 17.5 contain a critical vulnerability due to a hardcoded cryptographic key. This flaw allows unauthenticated attackers to forge encrypted tokens by exploiting a static entropy value used in encryption and decryption functions. Exploitation enables attackers to craft valid authentication headers and access privileged API endpoints, potentially obtaining domain administrator credentials and achieving unauthenticated remote code execution.