CVE-2024-6425

The '/account/Register/' endpoint does not require authentication or any form of permission verification. An attacker can send a network request with 'UserName', 'Password' and 'ConfirmPassword' parameters, which results in creating a new account in the system. The registration mechanism was implemented incorrectly — there is a missing access control that should restrict this function only to authorized administrators.

An attacker can register any number of user accounts in the system, which may lead to unauthorized access to production data and modification of MES system configuration. Combined with other vulnerabilities, this may enable complete takeover of the environment.

Apply patches available from the vendor according to references. As a temporary measure, it is recommended to block access to the '/account/Register/' endpoint at the firewall or reverse proxy level and restrict network access to the MESbook system only from trusted internal networks.

MESbook version 20221021.03