CVE-2021-33484
📋 TL;DR
This vulnerability in OnyakTech Comments Pro 3.8 allows attackers to spoof user identities in comment systems. By decompiling the installer to discover hardcoded encryption values, attackers can encrypt arbitrary user IDs and usernames to impersonate other users when posting comments. All installations of Comments Pro 3.8 are affected.
💻 Affected Systems
- OnyakTech Comments Pro
📦 What is this software?
Onyaktech Comments Pro by Onyaktech Comments Pro Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers can impersonate any user, including administrators, to post malicious content, spread misinformation, or conduct social engineering attacks through the comment system.
Likely Case
Attackers impersonate regular users to post spam, phishing links, or inappropriate content while appearing as legitimate users.
If Mitigated
With proper monitoring and content moderation, malicious posts can be detected and removed, though identity spoofing remains possible.
🎯 Exploit Status
Exploitation requires downloading and decompiling the installer, then using discovered values to craft requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://twitter.com/onyaktech
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Implement server-side user validation
allAdd server-side checks that validate user sessions independently of encrypted parameters
Disable comment functionality
allTemporarily disable the Comments Pro module until a fix is available
🧯 If You Can't Patch
- Implement strict content moderation and review all comments before publication
- Monitor for unusual comment patterns or multiple posts from the same IP with different user identities
🔍 How to Verify
Check if Vulnerable:
Check if running OnyakTech Comments Pro version 3.8 by examining the application files or configurationCheck Version:
Check the application directory for version information or consult the web interfaceVerify Fix Applied:
Test if user impersonation is possible by attempting to post comments with encrypted parameters from other user accounts📡 Detection & Monitoring
Log Indicators:
- Multiple comment posts with different user IDs from same IP
- Comments with mismatched user information
Network Indicators:
- HTTP POST requests to CommentsService.ashx with manipulated encrypted parameters
SIEM Query:
source="web_server" AND uri="*CommentsService.ashx*" AND method="POST" | stats count by src_ip, user_agent