BullWall Server Intrusion Protection Initialization Race Condition Vulnerability Allowing MFA Bypass

A vulnerability exists in BullWall Server Intrusion Protection (SIP) due to a race condition in the initialization process. The SIP services are started after the login services, allowing an authenticated attacker with administrative rights to log in after the system has booted and bypass multi-factor authentication (MFA). The SIP service fails to retroactively apply the authentication challenge or terminate unauthenticated sessions. This issue has been confirmed in BullWall Server Intrusion Protection versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4, with the possibility that other versions may also be affected.

Impact

Exploitation of this vulnerability allows for unauthorized access by bypassing multi-factor authentication, potentially leading to unauthorized actions within the application.