Executive brief
Tryton is an open-source business management framework used for enterprise resource planning. The vulnerability allows attackers on the network to intercept user session credentials sent in cleartext over unencrypted bus connections. An attacker could steal an active user's session and impersonate them without requiring authentication.
Technical details
The vulnerability is a session fixation issue (CWE-384) in Tryton 5.0.0 where the client attempts to establish bus connections without proper SSL/TLS encryption under certain circumstances. The root cause is in bus.py and jsonrpc.py where the SSL property is evaluated before the connection is fully established, causing it to default to false and attempt cleartext connections. An attacker positioned for man-in-the-middle network interception can capture the session token from the unencrypted connection headers. The attack requires network access to the bus communication channel but no authentication or user interaction. This was fixed in version 5.0.1.
Affected products
- Tryton Tryton 5.0.0
Timeline
- 2018-11-29: disclosed
- 2018-11-29: patched: Fixed in version 5.0.1