CVE-2020-28856
📋 TL;DR
This vulnerability allows attackers to bypass IP-based access controls in OpenAsset Digital Asset Management by spoofing the X-Forwarded-For HTTP header with localhost addresses like 127.0.0.1. This affects all OpenAsset DAM users up to version 12.0.19 who rely on IP address restrictions for security.
💻 Affected Systems
- OpenAsset Digital Asset Management
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of all IP-based access controls allowing unauthorized access to protected digital assets, potentially leading to data theft, modification, or deletion.
Likely Case
Unauthorized users gain access to restricted areas of the DAM system, potentially accessing sensitive digital assets they shouldn't have permission to view.
If Mitigated
Limited impact if additional authentication layers or network segmentation are in place beyond IP-based controls.
🎯 Exploit Status
Exploitation requires only HTTP header manipulation; no authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.0.20 or later
Vendor Advisory: http://openasset.com
Restart Required: Yes
Instructions:
1. Backup your OpenAsset DAM installation and database. 2. Download and install OpenAsset DAM version 12.0.20 or later from the vendor portal. 3. Follow the vendor's upgrade documentation. 4. Restart the OpenAsset service. 5. Verify the fix by testing IP access controls.
🔧 Temporary Workarounds
Web Server Header Filtering
allConfigure your web server (Apache/Nginx/IIS) to strip or validate X-Forwarded-For headers before they reach OpenAsset.
# Apache: mod_headers
Header unset X-Forwarded-For
# Nginx:
proxy_set_header X-Forwarded-For $remote_addr;
# IIS: URL Rewrite rule to remove header
Network ACL Enhancement
allImplement additional network-level access controls at firewall/load balancer to complement application-level controls.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OpenAsset DAM from untrusted networks.
- Deploy a Web Application Firewall (WAF) with rules to detect and block X-Forwarded-For header manipulation.
🔍 How to Verify
Check if Vulnerable:
Send an HTTP request to OpenAsset with X-Forwarded-For: 127.0.0.1 header from an unauthorized IP address. If access is granted, the system is vulnerable.Check Version:
Check OpenAsset admin interface or consult vendor documentation for version information.Verify Fix Applied:
Repeat the vulnerable test after patching; access should be denied when using spoofed X-Forwarded-For headers.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with X-Forwarded-For: 127.0.0.1 or similar localhost addresses from external IPs
- Successful authentication/access from unexpected IP addresses
Network Indicators:
- HTTP traffic with manipulated X-Forwarded-For headers
- Unusual access patterns bypassing normal IP restrictions
SIEM Query:
source="openasset" AND (http_header="X-Forwarded-For: 127.0.0.1" OR http_header="X-Forwarded-For: localhost")🔗 References
- http://openasset.com
- http://packetstormsecurity.com/files/160453/OpenAsset-Digital-Asset-Management-IP-Access-Control-Bypass.html
- http://seclists.org/fulldisclosure/2020/Dec/17
- https://www.themissinglink.com.au/security-advisories-cve-2020-28856
- http://openasset.com
- http://packetstormsecurity.com/files/160453/OpenAsset-Digital-Asset-Management-IP-Access-Control-Bypass.html
- http://seclists.org/fulldisclosure/2020/Dec/17
- https://www.themissinglink.com.au/security-advisories-cve-2020-28856
