SecBoard
Zurück zur CVE-Übersicht

CVE-2026-105131

MEDIUM(5.4)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Risk Signal Score14/100 — NIEDRIG
  • CVSS 5.4 — Mittel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.4

Technische Schwere

Beschreibung

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API tokens for 30-day normal session tokens that bypass API token expiry and allowlists.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 2.0.1

Threat-Hunting-Queries

Detects attempts to refresh API tokens, which could indicate privilege escalation if the token type is not properly checked.

Sentinel/Defender KQL

let RefreshAttempts = SecurityEvent
| where EventID == 4624 // Example for successful logon, adjust based on actual logging of API calls
| where TargetProcessName has "ezbookkeeping"
| where CommandLine has "/api/v1/tokens/refresh.json";
RefreshAttempts
| project TimeGenerated, Computer, TargetProcessName, CommandLine, InitiatingProcessCommandLine
| extend Account = TargetUserName
| where isnotempty(Account)

Splunk SPL

index=* sourcetype=ezbookkeeping_logs "/api/v1/tokens/refresh.json" | stats count by host, source, _time

Sigma

title: ezBookkeeping Privilege Escalation Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to refresh API tokens in ezBookkeeping, which could indicate a privilege escalation attempt.
author: SecBoard
date: 2026/10/03
logsource:
  product: webserver
  service: ezbookkeeping
detection:
  selection:
    url|contains: '/api/v1/tokens/refresh.json'
  condition: selection
fields:
  - user
  - source_ip
  - url
tags:
  - attack.privilege_escalation
  - cve.2026.105131

Elastic ES|QL

FROM logs-ezbookkeeping-*
| WHERE url.path == "/api/v1/tokens/refresh.json"
| SELECT @timestamp, host.name, user.name, source.ip, url.path

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 9a92b07be8a7034665abfdb35b036210a1d57bf9

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen