Unanet provides end-to-end services automation, its web-based software enables the management of people and projects from a single database. According to the company, it offers\u00a0\u201cone look and feel, and one connected set of applications.\u201d<\/p>\n
The issue, Trustwave security researchers say<\/b>, resides in a code branch within the Unanet product that maintains a hardcoded user, unlisted in the users table of the database. This user, they explain, was initially identified via a user enumeration vulnerability.<\/p>\n
The user cannot login directly but, because session cookies within Unanet function in a vulnerable manner, with zero entropy and no session timeouts, anyone can bypass the need to authenticate with this user. The construction of a Unanet session cookie, the researchers explain, includes UserID, username in uppercase, roles concatenated together with ‘^’, static cookie value, and digest.<\/p>\n
<\/p>\n
http:\/\/www.securityweek.com\/unanet-backdoor-allows-unauthenticated-access<\/p>\n","protected":false},"excerpt":{"rendered":"
Unanet provides end-to-end services automation, its web-based software enables the management of people and projects from a single database. According to the company, it offers\u00a0\u201cone look and feel, and one connected set of applications.\u201d The issue, Trustwave security researchers say, resides in a code branch within the Unanet product that maintains a hardcoded user, unlisted […]<\/p>\n","protected":false},"author":14254,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[715345],"tags":[],"class_list":{"0":"post-3182","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-week-04-enterprise-architecture","7":"entry"},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8j0Bl-Pk","_links":{"self":[{"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/posts\/3182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/users\/14254"}],"replies":[{"embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/comments?post=3182"}],"version-history":[{"count":1,"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/posts\/3182\/revisions"}],"predecessor-version":[{"id":3183,"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/posts\/3182\/revisions\/3183"}],"wp:attachment":[{"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/media?parent=3182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/categories?post=3182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5212sec001sp2017\/wp-json\/wp\/v2\/tags?post=3182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}