Bastillion
Monthly
Authentication bypass in Bastillion (bastillion-io/bastillion, all versions prior to the fix commit) lets unauthenticated remote attackers reach administrative controllers by prefixing request URIs with arbitrary path segments that the AuthFilter fails to normalize. Because the servlet-based access-management console governs SSH access to an entire managed fleet, an attacker can enumerate users, create manager accounts, and register systems, effectively seizing control of privileged SSH access. VulnCheck reported the issue and a vendor fix commit exists; no public exploit has been identified at time of analysis.
Authentication bypass in Bastillion (bastillion-io/bastillion, all versions prior to the fix commit) lets unauthenticated remote attackers reach administrative controllers by prefixing request URIs with arbitrary path segments that the AuthFilter fails to normalize. Because the servlet-based access-management console governs SSH access to an entire managed fleet, an attacker can enumerate users, create manager accounts, and register systems, effectively seizing control of privileged SSH access. VulnCheck reported the issue and a vendor fix commit exists; no public exploit has been identified at time of analysis.