Bridge Technologies VBC Server and Element Manager Broken Access Control Vulnerability Allowing Unauthorized Account Management

A broken access control vulnerability has been identified in Bridge Technologies VBC Server and Element Manager, specifically in firmware versions 6.5.0-10 and 6.5.0-9. This vulnerability allows unauthorized attackers to create and delete arbitrary user accounts. The issue arises from improper authorization, enabling exploitation through simple HTTP requests without the need for authentication.

Impact

Exploitation of this vulnerability could lead to unauthorized account creation and deletion, allowing attackers to manipulate user access and potentially disrupt service or gain unauthorized privileges within the application.

Reproduction

To exploit this vulnerability, send a GET request to the '/vbc/core/userSetupDoc/userSetupDoc' endpoint. Include parameters to delete a user or to add a new user, such as 'DelUser' for deletion or 'UpdateFromDlg' for adding a user, along with the required user details and password. This can be done using any HTTP client or tool that allows for custom request manipulation.