Xorux XorMon-NG’s Accidental Hide-and-Seek: Sensitive Data Exposed!
Xorux XorMon-NG vulnerability alert! Read-only users can suddenly feel like VIPs, gaining access to sensitive configuration data thanks to an exposed API endpoint. But don’t worry, Xorux has released version 1.9.38 to patch this surprise party. Secure your secrets before they RSVP!
Hot Take:
Ah, the joy of unintended open-door policies! It seems Xorux’s XorMon-NG decided to play Santa and hand out sensitive information as if it were Christmas candy—straight from the ‘Read Only’ user’s stocking. Ho ho ho! Merry Security Breach!
Key Points:
- XorMon-NG version 1.8 and prior is vulnerable, affecting Debian platforms.
- The vulnerability allows read-only users to access sensitive configuration data via an API endpoint.
- GPG decryption defaults to “undefined”, exposing password hashes and cloud credentials in plain text.
- Xorux released version 1.9.38 to resolve this issue.
- Discovered and reported by Jim Becher of KoreLogic, Inc.
Already a member? Log in here