CVE-2022-25508: Improper Authentication in FreeTAKServer
Summary
CVE-2022-25508: Improper Authentication in FreeTAKServer. Affects freetakserver versions < 1.9.8.5. Fixed in 1.9.8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeTAKServer is an open source, lightweight Server for connect TAK clients. It provides a platform for users to connect and communicate with TAK clients. FreeTAKServer version 1.9.8 is vulnerable to an access control issue in the component /ManageRoute/postRoute. This vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) by creating an unusually large amount of routes or creating unsafe or false routes for legitimate users.
Vulnerability Detail
The vulnerability in FreeTAKServer version 1.9.8 allows unauthenticated attackers to exploit the /ManageRoute/postRoute component, leading to a Denial of Service (DoS) attack. Attackers can create a large number of routes or create unsafe or false routes, impacting the availability and integrity of the server. This can disrupt legitimate users' access to the server and potentially compromise the accuracy of the routes. The issue was fixed in version 1.9.8.5.
How To Fix
Minimum fixed version
1.9.8.5
This is the first release that contains the fix.
pip install --upgrade "freetakserver==1.9.8.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of a Denial of Service (DoS) attack or the creation of unsafe or false routes.
Conclusion
The vulnerability in FreeTAKServer version 1.9.8 can be exploited by unauthenticated attackers to cause a Denial of Service (DoS) attack or create unsafe or false routes. To mitigate this risk, it is crucial to upgrade to version 1.9.8.5 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for freetakserver →
FAQ
FreeTAKServer is an open source, lightweight Server for connect TAK clients. It provides a platform for users to connect and communicate with TAK clients.
The vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) attack by creating a large number of routes or creating unsafe or false routes for legitimate users. This can disrupt the availability and integrity of the server.
To fix this vulnerability, it is recommended to upgrade FreeTAKServer to version 1.9.8.5 or later. This version includes the necessary fixes to address the access control issue.
There is currently no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of a Denial of Service (DoS) attack or the creation of unsafe or false routes.
For more information about this vulnerability, you can refer to the GitHub advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-hggv-mcp4-vxc5/GHSA-hggv-mcp4-vxc5.json
Related vulnerabilities
Recent vulnerabilities recorded for freetakserver.
