CVE-2021-33484 Hardcoded credentials in n/a
Hardcoded encryption IV allows attackers to decrypt keys and spoof user identities in Comments Pro, enabling unauthorized comment posting as other users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33484?
CVE-2021-33484 is a high-severity vulnerability in n/a, published on 7 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.
Weakness: CWE-798
Which versions are affected by CVE-2021-33484?
It affects 1 product.
Products include Onyaktech Comments Pro Project Onyaktech Comments Pro.
How do I fix CVE-2021-33484?
No fix has been published for CVE-2021-33484 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-33484 being exploited?
There is no known exploitation of CVE-2021-33484 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-76j4-qr57-p9fg.