CVE-2020-5206 Authentication Bypass For Endpoints With Anonymous Access in OpenCast

What is CVE-2020-5206?

CVE-2020-5206 is a high-severity authentication bypass vulnerability in opencast, published on 30 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1

Weakness: CWE-287, CWE-285

Which versions are affected by CVE-2020-5206?

4 open source packages ship an affected version, including org.opencastproject:opencast-kernel. It affects 1 product.

Products include Apereo Opencast.

How do I fix CVE-2020-5206?

Upgrade org.opencastproject:opencast-kernel to a fixed version for your release line: 7.6 or 8.1.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-5206 being exploited?

There is no known exploitation of CVE-2020-5206 in the wild and no public exploit code.

Other vulnerabilities in opencast

• CVE-2021-43821 Files Accessible to External Parties in Opencast Critical 9.9
• CVE-2021-32623 Opencast vulnerable to billion laughs attack (XML bomb) High 8.1
• CVE-2020-5229 Opencast stores passwords using outdated MD5 hash algorithm High 7.7
• CVE-2020-5230 Opencast uses unsafe identifiers High 7.7
• CVE-2020-5228 Opencast allows unauthorized public access via OAI-PMH High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vmm6-w4cf-7f3x.