Bonita Web Authorization Bypass Vulnerability
漏洞信息
漏洞名称： Bonita Web Authorization Bypass Vulnerability
漏洞编号：
- CVE： CVE-2022-25237
漏洞类型： 权限绕过
漏洞等级： 严重
漏洞描述： Bonita Web是由Bonitasoft开发的一款业务流程管理(BPM)软件，广泛应用于企业级服务中，用于设计、部署和管理业务流程。该软件支持通过Web界面进行交互，是企业数字化转型中的重要工具。CVE-2022-25237漏洞存在于Bonita Web 2021.2版本中，由于RestAPIAuthorizationFilter中的排除模式过于宽泛，导致未认证的用户可以通过在URL后附加;i18ntranslation或/../i18ntranslation/来绕过认证/授权机制，访问特权API端点。这一漏洞的技术根源在于输入验证不严格，未能正确限制对敏感API的访问。攻击者利用此漏洞可以在未认证的情况下执行特权操作，可能导致数据泄露、服务中断或其他恶意活动。由于漏洞允许未授权访问且易于利用，其安全风险被评估为严重级别。
产品厂商： Bonitasoft
产品名称： Bonita Web
影响版本： 2021.2
来源： https://github.com/projectdiscovery/nuclei-templates/issues/12656
类型： projectdiscovery/nuclei-templates:github issues
来源概述
Description:
Bonita Web 2021.2 contains an authentication/authorization bypass caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, letting unauthenticated users access privileged API endpoints, exploit requires appending ;i18ntranslation or /../i18ntranslation/ to URL.
Severity: Critical
POC:
KEV: True
Shodan Query: NA
Acceptance Criteria: The template must include a complete POC and should not rely solely on version-based detection. Contributors are required to provide debug data(
-debug) along with the template to help the triage team with validation or can also share a vulnerable environment like docker file.
Rewards will only be given once the template is fully validated by the team. Templates that are incomplete or invalid will not be accepted. Avoid adding code templates for CVEs that can be achieved using HTTP, TCP, or JavaScript. Such templates are blocked by default and won’t produce results, so we prioritize creating templates with other protocols unless exceptions are made.
You can check the FAQ for the Nuclei Templates Community Rewards Program here.