CVE-2020-14944
📋 TL;DR
This CVE describes a critical authorization bypass vulnerability in Global RADAR BSA Radar software versions 1.6.7234.24750 and earlier. Attackers can manipulate user accounts through vulnerable functions like ChangePassword, SaveUserProfile, and GetUser without proper authentication. Organizations using affected versions are at risk of account takeover and data manipulation.
💻 Affected Systems
- Global RADAR BSA Radar
📦 What is this software?
Bsa Radar by Globalradar
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts, allowing attackers to change passwords, modify profiles, and potentially gain administrative access to the entire system.
Likely Case
Targeted account takeover of specific users, leading to unauthorized access to sensitive data and potential privilege escalation.
If Mitigated
Unauthorized access attempts are logged and blocked, with no successful account manipulation.
🎯 Exploit Status
Exploitation requires user interaction via CSRF attacks or direct API calls. Public proof-of-concept code is available in GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.6.7234.24750
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Contact Global RADAR for patched version. 2. Backup current installation. 3. Apply vendor-provided patch or upgrade to fixed version. 4. Restart the BSA Radar service.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to all forms and API endpoints to prevent cross-site request forgery attacks.
Network Segmentation
allRestrict access to BSA Radar application to trusted networks only.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block unauthorized access to vulnerable endpoints
- Monitor and alert on suspicious account modification activities
🔍 How to Verify
Check if Vulnerable:
Check BSA Radar version in application interface or configuration files. If version is 1.6.7234.24750 or earlier, system is vulnerable.Check Version:
Check application interface or configuration files for version information (no standard CLI command available)Verify Fix Applied:
Verify version is updated beyond 1.6.7234.24750 and test authorization controls on ChangePassword, SaveUserProfile, and GetUser functions.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to user management functions
- Multiple failed authentication attempts followed by successful account modifications
- Unusual patterns in user profile changes
Network Indicators:
- HTTP requests to ChangePassword, SaveUserProfile, or GetUser endpoints without proper authentication headers
- CSRF attack patterns in web traffic
SIEM Query:
source="bsa_radar_logs" AND (event="ChangePassword" OR event="SaveUserProfile" OR event="GetUser") AND user="*" AND auth_status="failed"🔗 References
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md
- http://packetstormsecurity.com/files/158372/BSA-Radar-1.6.7234.24750-Cross-Site-Request-Forgery.html
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities
- https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14944%20-%20Access%20Control%20Vulnerabilities.md
