CVE-2021-42545
📋 TL;DR
This vulnerability allows attackers to reuse, spoof, or steal user and admin sessions in TopEase Platform due to insufficient session expiration. It affects all TopEase Platform users and administrators running versions 7.1.27 or earlier. Attackers can maintain access to compromised sessions beyond intended time limits.
💻 Affected Systems
- Business-DNA Solutions GmbH TopEase Platform
📦 What is this software?
Topease by Business Dnasolutions
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent administrative access, leading to complete system compromise, data theft, privilege escalation, and unauthorized administrative actions.
Likely Case
Attackers hijack user sessions to access sensitive business data, perform unauthorized actions, or maintain foothold in the system.
If Mitigated
Limited impact with proper session management controls, but still presents authentication bypass risk.
🎯 Exploit Status
Exploitation requires initial session access but session reuse/spoofing is straightforward once obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version > 7.1.27
Vendor Advisory: https://confluence.topease.ch/confluence/display/DOC/Release+Notes
Restart Required: Yes
Instructions:
1. Download latest TopEase Platform version from vendor portal. 2. Backup current installation and data. 3. Apply patch/upgrade following vendor documentation. 4. Restart TopEase services. 5. Verify session expiration is working correctly.
🔧 Temporary Workarounds
Enforce Session Timeout
allConfigure application/web server to enforce strict session timeout policies
Network Segmentation
allRestrict access to TopEase Platform to trusted networks only
🧯 If You Can't Patch
- Implement strict network access controls and monitor for unusual session activity
- Enforce multi-factor authentication and regularly rotate administrative credentials
🔍 How to Verify
Check if Vulnerable:
Check TopEase Platform version in administration interface or configuration filesCheck Version:
Check TopEase web interface or consult platform documentation for version commandVerify Fix Applied:
Verify version is >7.1.27 and test session expiration functionality📡 Detection & Monitoring
Log Indicators:
- Multiple sessions from same user with unusual timing
- Session IDs being reused after logout
- Administrative actions from non-admin IPs
Network Indicators:
- Unusual session duration patterns
- Multiple authentication requests without logout events
SIEM Query:
source="topease" AND (event_type="session" AND duration>3600) OR (user="admin" AND source_ip NOT IN trusted_ips)