CVE-2016-10532 Authentication Bypass in console-io
Attackers can bypass authentication in console-io to execute arbitrary commands via WebSocket, potentially gaining full system access if run as root.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10532?
CVE-2016-10532 is a critical authentication bypass vulnerability in HackerOne console-io node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.
Weakness: CWE-287
Which versions are affected by CVE-2016-10532?
2 open source packages ship an affected version, including console-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
console-io npm | All versions | 2.3.0 |
console-io npm | All versions | 2.3.0 |
Products include Console-Io Project Console-Io.
How do I fix CVE-2016-10532?
Upgrade console-io to 2.3.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-10532 being exploited?
There is no known exploitation of CVE-2016-10532 in the wild and no public exploit code.
Sources
Also known as GHSA-q52j-4q2q-hcj6.