CyberRota Analysis
AI-GeneratedNetwork-AI versions prior to 5.13.4 are vulnerable due to an improper cryptographic signature verification in the APSAdapter, allowing unauthenticated attackers to exploit this flaw. By submitting forged APS delegation payloads, attackers can bypass signature verification and gain unauthorized access to sensitive resources, including the ability to execute shell commands. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain signed permission-grant tokens for sensitive resources including SHELL_EXEC.