CVE-2023-6578: Software AG webMethods Auth Bypass Flaw

CVE-2023-6578 Overview

A critical improper access control vulnerability has been discovered in Software AG WebMethods versions 10.11.x and 10.15.x. The vulnerability affects the wm.server/connect/ endpoint and allows remote attackers to bypass authentication mechanisms through manipulation of HTTP referrer header data. This flaw enables unauthorized access to sensitive server information including internal IP addresses, port configurations, and version details.

Critical Impact
Remote attackers can bypass authentication controls to access sensitive server configuration data and internal network information without valid credentials.

Affected Products

Software AG WebMethods 10.11.x
Software AG WebMethods 10.15.x

Discovery Timeline

2023-12-07 - CVE-2023-6578 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-6578

Vulnerability Analysis

This vulnerability stems from improper access control implementation in the Software AG WebMethods Integration Server. The authentication mechanism can be bypassed through several methods, exposing sensitive server configuration data to unauthenticated attackers.

When accessing protected resources like /assets/, users are presented with a username and password prompt. However, clicking the "CANCEL" button redirects users directly to the protected directory, effectively bypassing the authentication requirement. Additionally, accessing /invoke/wm.server/connect without proper credentials reveals internal server details including IP addresses, ports, and version information.

A secondary bypass technique exists where access to /assets/ may initially be refused, but entering an invalid path such as /assets/x and then returning to /assets/ will display the protected data. This behavior indicates that the access control mechanism relies on insufficient referrer header validation rather than proper session-based authentication.

Root Cause

The root cause of this vulnerability is the reliance on HTTP referrer header data for access control decisions (CWE-284: Improper Access Control). The authentication mechanism fails to properly validate user credentials before granting access to protected resources. Instead of implementing proper session management and authentication checks, the system uses referrer-based validation which can be easily manipulated or bypassed by attackers.

Attack Vector

The attack can be performed remotely over the network without requiring any authentication or user interaction. An attacker can exploit this vulnerability by:

Navigating to protected endpoints like /assets/ or /invoke/wm.server/connect
When presented with authentication prompts, clicking "CANCEL" to bypass the check
Alternatively, accessing an invalid path first, then navigating to the protected resource
Manipulating or omitting the HTTP referrer header to bypass access controls

The vulnerability allows information disclosure of internal server configurations, which could be leveraged for further attacks against the infrastructure.

Detection Methods for CVE-2023-6578

Indicators of Compromise

Unusual access patterns to /invoke/wm.server/connect endpoints without valid authentication
HTTP requests to /assets/ directory with missing or manipulated referrer headers
Authentication cancellation events followed by successful resource access
Requests containing patterns like /assets/x followed by /assets/ in rapid succession

Detection Strategies

Monitor web server logs for access to sensitive endpoints (/invoke/wm.server/connect, /assets/) without corresponding successful authentication events
Implement anomaly detection for requests with unusual referrer header patterns or missing authentication tokens
Alert on multiple failed authentication attempts followed by successful resource access from the same source IP
Deploy web application firewall (WAF) rules to detect and block referrer manipulation attempts

Monitoring Recommendations

Enable detailed access logging for all WebMethods Integration Server endpoints
Configure alerts for access to administrative and configuration endpoints from unexpected sources
Implement real-time monitoring of authentication bypass patterns in web server logs
Review access logs regularly for evidence of reconnaissance activity targeting server configuration endpoints

How to Mitigate CVE-2023-6578

Immediate Actions Required

Restrict network access to WebMethods administrative interfaces using firewall rules
Implement IP-based access controls to limit who can reach sensitive endpoints
Place WebMethods servers behind a reverse proxy with proper authentication enforcement
Review and audit current access to sensitive endpoints for any unauthorized access

Patch Information

The vendor (Software AG) was contacted regarding this vulnerability but did not respond. No official patch information is currently available. Organizations should implement the workarounds and mitigations described below until an official fix is released. Monitor the VulDB entry for updates regarding vendor response and patch availability.

Workarounds

Configure web application firewall rules to enforce authentication on all protected endpoints
Implement network segmentation to restrict access to WebMethods servers from trusted networks only
Add additional authentication layers such as VPN or application-layer authentication in front of WebMethods
Disable or restrict access to /invoke/wm.server/connect and /assets/ endpoints if not required for operations
Configure referrer policy headers and implement proper session-based authentication at the reverse proxy level

bash

# Example nginx reverse proxy configuration to enforce authentication
location /invoke/wm.server/ {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://webmethods-backend;
}

location /assets/ {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://webmethods-backend;
}