CVE-2020-13658
📋 TL;DR
This CSRF vulnerability in Lansweeper allows low-level authenticated users to escalate their privileges by tricking administrators into performing unintended actions. It affects Lansweeper web console users who have access to the application interface. Attackers can exploit this to gain administrative control over the Lansweeper system.
💻 Affected Systems
- Lansweeper
📦 What is this software?
Lansweeper by Lansweeper
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Lansweeper system with attacker gaining administrative privileges, allowing them to modify configurations, access sensitive asset data, and potentially pivot to other systems.
Likely Case
Privilege escalation within Lansweeper allowing unauthorized access to sensitive asset information and system configuration.
If Mitigated
Limited impact with proper CSRF protections and user awareness training in place.
🎯 Exploit Status
Exploit requires authenticated low-level user and ability to trick administrator into clicking malicious link. Technical advisory provides detailed exploitation methodology.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.130.18 or later
Vendor Advisory: https://www.lansweeper.com/knowledgebase/security-update-for-lansweeper-8-0/
Restart Required: Yes
Instructions:
1. Download latest Lansweeper version from vendor portal. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart Lansweeper services. 5. Verify version shows 8.0.130.18 or higher.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all state-changing requests in Lansweeper web interface
Requires custom development - implement unique tokens per session for all POST/PUT/DELETE requests
Restrict User Permissions
allMinimize number of low-level users and implement strict role-based access control
Review and reduce user permissions in Lansweeper administration console
🧯 If You Can't Patch
- Implement network segmentation to isolate Lansweeper server from general user access
- Enable detailed logging and monitoring for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Lansweeper version in web console admin panel or via Help > About. Version 8.0.130.17 or earlier is vulnerable.Check Version:
In Lansweeper web console: Navigate to Help > About or check server installation directory properties.Verify Fix Applied:
Verify version shows 8.0.130.18 or later. Test CSRF protection by attempting to modify user privileges without proper tokens.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege changes in Lansweeper audit logs
- Multiple failed login attempts followed by successful privilege modification
Network Indicators:
- HTTP requests to Lansweeper admin endpoints without referrer headers or CSRF tokens
- Unusual outbound connections from Lansweeper server
SIEM Query:
source="lansweeper" AND (event_type="privilege_change" OR event_type="user_modification") AND user_role="low_level"🔗 References
- https://research.nccgroup.com/2020/09/25/technical-advisory-lansweeper-privilege-escalation-via-csrf-using-http-method-interchange/
- https://www.nccgroup.com/us/our-research/?research=Technical+advisories
- https://research.nccgroup.com/2020/09/25/technical-advisory-lansweeper-privilege-escalation-via-csrf-using-http-method-interchange/
- https://www.nccgroup.com/us/our-research/?research=Technical+advisories
