CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to bypass authorization controls in ScadaLTS 2.8.1 by exploiting the DWR framework's method dispatching mechanism, which relies on POST body parameters rather than URL path patterns. This flaw can lead to unauthorized access to restricted methods, potentially enabling low-privilege users to execute sensitive operations. Organizations using this version of ScadaLTS should prioritize remediation to mitigate the risk of unauthorized actions within their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body. This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.