Executive brief
MeshCentral is a web-based remote monitoring and management platform that allows administrators to deploy agents and manage devices across networks. This vulnerability fails to properly validate SSL certificates during connections, allowing attackers to intercept and manipulate encrypted communications with managed devices and systems without detection. An attacker on the network can intercept sensitive management traffic and potentially gain unauthorized access to monitored systems.
Technical details
The vulnerability (CWE-295) is a missing SSL certificate validation flaw in MeshCentral version 1.1.16 and earlier, where the application fails to properly verify SSL/TLS certificates when establishing encrypted connections. The vulnerable code is in mpsserver.js and affects certificate validation logic across the platform. An attacker with network access can perform man-in-the-middle (MITM) attacks without authentication or user interaction to intercept, modify, or inject malicious content into management communications. This allows complete compromise of the remote management channel—attackers can gain full control over monitored devices or extract sensitive data. Patches addressing this validation flaw are available in newer versions.
Affected products
- Ylianst MeshCentral up to 1.1.16
Timeline
- 2024-01-30: disclosed: GHSA-8xw6-9h78-c89j published
- 2023: other: CVE-2023-51837 assigned