CVE-2020-5222: Hard-Coded Key Used For Remember-me Token in Opencast
Summary
CVE-2020-5222: Hard-Coded Key Used For Remember-me Token in Opencast. Affects org.opencastproject:opencast-kernel across 2 version ranges.
< 7.6
>= 8.0, < 8.1
Fixed in 7.6 or 8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Opencast is an open-source system for automated video capture and distribution. It provides a scalable and reliable solution for managing and publishing audiovisual content. The Opencast kernel is a core component of the Opencast system, responsible for handling authentication and security. This vulnerability affects versions 0 to 7.5 of the Opencast kernel, and versions 8.0 to 8.1 are also impacted.
Vulnerability Detail
The security configuration in Opencast enables a remember-me cookie based on a hash created from the username, password, and a system key. However, Opencast has hard-coded this system key in the configuration file, making it the same for all installations. This means that if an attacker obtains a remember-me token from one server, they can use it to gain access to all servers that use the same credentials, without needing to know the actual login credentials. This vulnerability allows unauthorized access to Opencast instances and can lead to unauthorized data access and potential system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.67.6 -
>= 8.0, < 8.18.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For older versions of Opencast, a workaround is available. In the security configuration file (etc/security/mh_default_org.xml), set a custom key for each server by replacing 'CUSTOM_RANDOM_KEY' with a unique and random value:
<sec:remember-me key="CUSTOM_RANDOM_KEY" user-service-ref="userDetailsService" />
Conclusion
The hard-coded key vulnerability in Opencast can lead to unauthorized access and potential system compromise. It is crucial to update to the patched versions of Opencast (7.6 or 8.1) or apply the workaround for older versions. Regularly updating and maintaining the security of Opencast instances is essential to protect against potential attacks.
See every vulnerability recorded for org.opencastproject:opencast-kernel →
FAQ
The vulnerability allows an attacker to gain unauthorized access to Opencast instances without knowing the login credentials. This can lead to unauthorized data access and potential system compromise.
Versions 0 to 7.5 of the Opencast kernel and versions 8.0 to 8.1 are affected by this vulnerability.
To fix this vulnerability, update to the patched versions of Opencast: 7.6 or 8.1. It is important to update all instances of Opencast to ensure the security of the system.
Yes, a workaround is available. In the security configuration file, set a custom key for each server by replacing 'CUSTOM_RANDOM_KEY' with a unique and random value.
For more information, you can refer to the Opencast GitHub repository and the Spring Security Remember-Me Authentication documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-kernel.
