CVE-2021-27858 Scanner

FatPipe WARP/IPVPN/MPVPN is widely used in enterprise environments for secure and efficient WAN traffic management. These products are primarily employed by businesses requiring enhanced bandwidth management and secure Internet connectivity. With features like dynamic and static load balancing and route plans, they optimize VPN performance across multiple links. IT departments across various sectors utilize them due to their scalability and reliability, crucial for maintaining operational continuity. As such, any vulnerability in these products can pose significant risks to enterprise network security and operations.

The Missing Authorization vulnerability in FatPipe WARP/IPVPN/MPVPN allows unauthorized access to sensitive URLs via the web management interface. This lack of proper access control can be exploited by remote attackers to access or manipulate sensitive information. Its ease of exploitation without needing prior authentication makes it particularly dangerous. This vulnerability highlights the critical need for rigorous authorization validation within web management systems of network appliances. Organizations using affected versions might unknowingly expose sensitive network configurations to malicious actors.

The technical specifics of this vulnerability involve missing access controls within the FatPipe WARP/IPVPN/MPVPN's web management interface. Remote attackers can leverage this flaw to request URLs that should be protected, leading to potential exposure of sensitive data or network settings. The exploitation of this vulnerability requires no authentication, allowing attackers easy entry. This is particularly concerning in enterprise environments where such access could compromise overall network security. Examination of requests to '/fpui/jsp/index.jsp' can reveal this authorization lapse.

Exploiting this vulnerability could lead to unauthorized disclosure of network configurations impacting the organization's security posture. Attackers may gain insights or make unauthorized changes to the routing setup, affecting traffic flow or enabling further exploits. The confidentiality of strategic business data could be at risk, given the potential access to sensitive management interfaces. Additionally, system integrity may be compromised, impacting organizational operations.

REFERENCES

• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php
• https://www.fatpipeinc.com/support/advisories.php
• https://www.fatpipeinc.com/support/cve-list.php
• https://www.zeroscience.mk/codes/fatpipe_auth.txt