SecBoard
Zurück zur CVE-Übersicht

CVE-2026-63207

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 7.1.2

Threat-Hunting-Queries

Detects attempts by an authenticated administrator to access sensitive integration credentials via the Zammad API. This requires logging of API requests and responses, specifically looking for unmasked sensitive fields in responses from the integration administration API.

Sentinel/Defender KQL

let sensitiveFields = dynamic(["password", "secret"]);
AuditLogs
| where OperationName == "Integration Administration API Access"
| where Result == "Success"
| extend ResponseBody = parse_json(tostring(Properties.ResponseBody))
| where isnotempty(ResponseBody)
| where ResponseBody has_any (sensitiveFields)
| project TimeGenerated, InitiatingUser, OperationName, ResponseBody, SourceIP

Splunk SPL

sourcetype=zammad_api_logs "Integration Administration API Access" result=success
| spath output=responseBody path=properties.responseBody
| eval is_sensitive_field_exposed = if(match(responseBody, "password|secret"), "true", "false")
| where is_sensitive_field_exposed = "true"
| table _time, user, operation, responseBody, client_ip

Sigma

title: Zammad Integration API Sensitive Data Exposure
status: experimental
description: Detects attempts by an authenticated administrator to access sensitive integration credentials via the Zammad API.
logsource:
  product: zammad
  service: api
detection:
  selection:
    operation: "Integration Administration API Access"
    result: "Success"
    response_body|contains:
      - "password"
      - "secret"
  condition: selection
level: high

Elastic ES|QL

FROM auditlogs
WHERE operation_name == "Integration Administration API Access"
AND result == "Success"
AND CONTAINS(response_body, "password") OR CONTAINS(response_body, "secret")
| SELECT @timestamp, initiating_user, operation_name, response_body, source_ip

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen