CVE-2020-29667
📋 TL;DR
CVE-2020-29667 allows remote attackers to bypass authentication and gain control over Lan ATMService M3 ATM Monitoring System by using a default session cookie value. This affects all systems running the vulnerable software with default configurations. Attackers can achieve full system compromise without valid credentials.
💻 Affected Systems
- Lan ATMService M3 ATM Monitoring System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover allowing attackers to manipulate ATM monitoring, potentially enabling ATM fraud, data theft, or service disruption.
Likely Case
Unauthorized administrative access leading to ATM monitoring manipulation, configuration changes, and potential data exfiltration.
If Mitigated
Limited impact with proper session management and network segmentation in place.
🎯 Exploit Status
Exploit requires only sending default cookie value; GitHub repository contains proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://lanatmservice.ru/
Restart Required: No
Instructions:
No official patch available. Contact vendor for updated version or implement workarounds.
🔧 Temporary Workarounds
Change Default Session Cookie
allModify the default PHPSESSID cookie value to a strong, random value unique to each installation.
Edit PHP configuration to set session.cookie_httponly = 1
Set session.use_strict_mode = 1
Configure custom session name and secure cookie parameters
Implement Session Expiration
allAdd proper session timeout and expiration mechanisms to invalidate sessions after inactivity.
Set session.gc_maxlifetime to appropriate value (e.g., 1800)
Implement session regeneration on privilege changes
🧯 If You Can't Patch
- Network segmentation: Isolate ATM monitoring system from internet and restrict internal access.
- Implement WAF rules to block requests with default cookie values and monitor for session hijacking attempts.
🔍 How to Verify
Check if Vulnerable:
Send HTTP request with cookie 'PHPSESSID=LANIT-IMANAGER' to system and check if authenticated access is granted.Check Version:
Check system interface or configuration files for version information (typically 6.1.0).Verify Fix Applied:
Attempt same exploit with default cookie; should receive authentication error or redirect to login.📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins with same session ID
- Administrative actions from unexpected IP addresses
- Session fixation attempts
Network Indicators:
- HTTP requests containing 'PHPSESSID=LANIT-IMANAGER' cookie
- Unauthenticated requests accessing privileged endpoints
SIEM Query:
source="web_logs" AND (cookie="*PHPSESSID=LANIT-IMANAGER*" OR uri="/admin/*") AND response_code=200