SecBoard
Zurück zur CVE-Übersicht

CVE-2026-50191

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk Signal Score22/100 — NIEDRIG
  • CVSS 8.8 — Hoch

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 3.3.8

Threat-Hunting-Queries

Die Schwachstelle betrifft die Registrierung und Authentifizierung. Es wird nach ungewöhnlichen Registrierungen und nachfolgenden Anmeldeversuchen mit unbestätigten Konten gesucht, insbesondere wenn SSO-Anbieter involviert sind. Die Queries sind verhaltensbasiert und müssen an die spezifische Protokollierung des 4gaBoards-Systems angepasst werden.

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4624 // Successful logon
| extend AccountName = tostring(TargetUserName)
| extend SourceIp = tostring(IpAddress)
| join kind=inner (
    AppServiceHTTPLogs
    | where UriPath == "/api/register"
    | extend RegisteredEmail = tostring(parse_json(RequestBody).email)
    | summarize count() by RegisteredEmail, bin(TimeGenerated, 1h)
    | where count_ > 1 // Look for multiple registrations from the same email in a short period, or other suspicious patterns
) on $left.AccountName == $right.RegisteredEmail
| where isVerified == false // Placeholder for actual 'isVerified' status if logged
| project TimeGenerated, AccountName, SourceIp, RegisteredEmail, UriPath

Splunk SPL

index=your_4gaboards_index (uri_path="/api/register" OR uri_path="/api/access-tokens")
| eval email=json_extract(request_body, "$.email")
| stats count by email, uri_path, client_ip
| where count > 1 // Look for multiple registrations/logins from the same email/IP in a short period
| search isVerified=false // Placeholder for actual 'isVerified' status if logged
| table _time, email, uri_path, client_ip, count

Sigma

title: 4gaBoards Pre-Account Takeover Attempt
author: SecBoard
date: 2024/07/30
logsource:
  product: web
  service: 4gaboards
detection:
  selection_register:
    url|endswith: '/api/register'
    method: 'POST'
  selection_access_tokens:
    url|endswith: '/api/access-tokens'
    method: 'POST'
  condition: selection_register or selection_access_tokens
  filter_unverified_account:
    # This field needs to be adapted to actual log data if 'isVerified' status is logged
    # For example, if a specific error code or message indicates unverified status
    # For now, it's a placeholder for behavioral detection.
    # isVerified: false
  timeframe: 1h
  group_by: user_email, source_ip
  count: 2 # Adjust threshold based on normal activity
falsepositives:
  - Legitimate rapid registrations/logins (unlikely for this specific flaw)
level: high

Elastic ES|QL

FROM logs-4gaboards-*
| WHERE url.path == "/api/register" OR url.path == "/api/access-tokens"
| WHERE http.request.method == "POST"
| EVAL email = json_extract(http.request.body.content, "$.email")
| GROUP BY email, url.path, source.ip
| AGG count = count()
| WHERE count > 1
// Add a condition here if 'isVerified' status is logged directly
// For example: | WHERE user.is_verified == false
| SORT BY @timestamp DESC

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 484c92d583cfbc6815f96364071bb531ec594bf8

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen