CVE-2017-6199
📋 TL;DR
CVE-2017-6199 is an authentication bypass vulnerability in Sandstorm.io where attackers could circumvent organization restrictions by using commas in email address fields. This affects Sandstorm installations before build 0.203 that use organization restrictions. Attackers could gain unauthorized access to restricted organizational resources.
💻 Affected Systems
- Sandstorm.io
📦 What is this software?
Sandstorm by Sandstorm
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of organizational boundaries, allowing attackers to access all restricted organizational data and functionality as if they were legitimate organization members.
Likely Case
Unauthorized access to organizational resources, potentially exposing sensitive data and functionality meant only for organization members.
If Mitigated
Limited impact with proper network segmentation and monitoring, though authentication bypass still presents significant risk.
🎯 Exploit Status
Exploitation requires valid user credentials but bypasses organization restrictions. The vulnerability is well-documented in public security reviews.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Build 0.203 and later
Vendor Advisory: https://sandstorm.io/news/2017-03-02-security-review
Restart Required: Yes
Instructions:
1. Update Sandstorm to build 0.203 or later. 2. Restart Sandstorm services. 3. Verify the fix by checking version and testing organization restrictions.
🔧 Temporary Workarounds
Disable Organization Restrictions
linuxTemporarily disable organization restrictions feature until patching is possible
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Sandstorm instances
- Enable detailed logging and monitoring for authentication attempts with unusual email formats
🔍 How to Verify
Check if Vulnerable:
Check Sandstorm version: if version is earlier than 0.203 and organization restrictions are enabled, the system is vulnerable.Check Version:
sandstorm versionVerify Fix Applied:
After updating to 0.203+, test organization restrictions with comma-containing email addresses to ensure they are properly rejected.📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with email addresses containing commas
- Successful logins that bypass organization restrictions
Network Indicators:
- Unusual authentication patterns from external sources
SIEM Query:
source="sandstorm" AND (email CONTAINS "," OR "organization bypass")🔗 References
- https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/
- https://github.com/sandstorm-io/sandstorm/blob/v0.202/shell/packages/sandstorm-db/db.js#L1112
- https://github.com/sandstorm-io/sandstorm/commit/37bd9a7f4eb776cdc2d3615f0bfea1254b66f59d
- https://sandstorm.io/news/2017-03-02-security-review
- https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/
- https://github.com/sandstorm-io/sandstorm/blob/v0.202/shell/packages/sandstorm-db/db.js#L1112
- https://github.com/sandstorm-io/sandstorm/commit/37bd9a7f4eb776cdc2d3615f0bfea1254b66f59d
- https://sandstorm.io/news/2017-03-02-security-review
