CVE-2021-36804: Akaunting Password Reset Spoofing Vulnerability
Summary
CVE-2021-36804: Malicious password-reset in Akaunting. Affects akaunting/akaunting versions < 2.1.13. Fixed in 2.1.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Akaunting is an open-source accounting software designed for small businesses and freelancers. It provides features for managing invoices, expenses, and financial reports. The vulnerability affects Akaunting versions 2.1.12 and earlier. Akaunting utilizes the Laravel framework, which is commonly used for developing web applications. This vulnerability is caused by the default configuration in Laravel regarding proxy headers in multi-tenant implementations.
Vulnerability Detail
The Akaunting password reset spoofing vulnerability allows an attacker to proxy password reset requests through a running Akaunting instance if they know the target's email address. By exploiting this vulnerability, an attacker can impersonate the target user and gain unauthorized access to their account. This issue was addressed in version 2.1.13 of Akaunting. It is important to note that while this vulnerability is specific to Akaunting, similar vulnerabilities may exist in Laravel projects that implement multi-tenant applications.
How To Fix
Minimum fixed version
2.1.13
This is the first release that contains the fix.
composer require akaunting/akaunting:2.1.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to Akaunting version 2.1.13 or later.
Conclusion
The Akaunting password reset spoofing vulnerability can lead to unauthorized access to user accounts and potential misuse of sensitive financial information. Users should upgrade to Akaunting version 2.1.13 or later to mitigate this vulnerability. Regularly updating Akaunting and its dependencies is recommended to ensure the latest security patches are applied. For additional support, contact DevNack.com.
See every vulnerability recorded for akaunting/akaunting →
FAQ
The vulnerability allows an attacker to impersonate a user and gain unauthorized access to their Akaunting account. This can lead to unauthorized access to sensitive financial information and potential misuse of the account.
You can use the Vulert Playground at Vulert Scanner to check if your Akaunting installation is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any known vulnerabilities.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the fix promptly to mitigate the risk of exploitation.
No, the only way to mitigate the risk is by upgrading to Akaunting version 2.1.13 or later. Applying the official fix is necessary to prevent password reset spoofing.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing the vulnerability in your Akaunting installation.
