CNVD-2021-14536 Scanner

Ruijie RG-UAC Unified Internet Behavior Management Audit System is employed by various organizations for monitoring and controlling internet activities within a network. It plays a vital role in ensuring network security by auditing internet behavior to prevent misuse. This software is used extensively in business environments, educational institutions, and government bodies. Its main purpose is to provide comprehensive audit capabilities for identifying unauthorized internet access and ensuring compliance with network policies. The system facilitates the management of user activities, thereby maintaining the integrity and performance of organizational networks. Ruijie's solution is vital in safeguarding sensitive information while permitting legitimate usage of network resources.

Information disclosure vulnerabilities occur when an application unintentionally exposes sensitive data. In the Ruijie RG-UAC Unified Internet Behavior Management Audit System, attackers can exploit such vulnerabilities by examining the web pages' source code. This exposure permits unauthorized individuals to gain access to critical administrative credentials. Such a breach of confidentiality can lead to unauthorized access to the system, enabling subsequent malicious actions. The disclosure of sensitive information might include user account details and passwords, which compromises the overall security framework. Preventing information disclosure is crucial to protecting user data and system integrity from adversaries.

The Ruijie RG-UAC system has a vulnerability in the endpoint accessible via the "/get_dkey.php?user=admin" path. This endpoint, when accessed, might return sensitive information if it is not adequately protected. The vulnerability lies in the exposure of the "pre_define", "auth_method", "name", and "password" fields, among others, in the HTTP response. An attacker could execute a GET request to this endpoint and analyze the response body for confidential fields. The presence of these sensitive fields in a 200 HTTP status response indicates the system's susceptibility. The extractor uses regular expressions to identify data patterns typically associated with administrative roles, making the system vulnerable to unauthorized data extraction.

Exploiting this information disclosure vulnerability can lead to severe consequences. Malicious actors gaining access to administrator credentials can compromise the management audit system entirely. This level of access allows them to manipulate audit logs, disable security controls, and impersonate authorized users. Such actions could remain unnoticed until significant damage has occurred, including data breaches, unauthorized network access, or denial-of-service attacks. The trust in the network security infrastructure might be diminished as users become aware of the potential for unauthorized surveillance. Ultimately, these consequences underscore the vital importance of promptly addressing such vulnerabilities.

REFERENCES

• https://www.adminxe.com/2163.html