Loading vulnerability…
Cross-Form Administrative Authentication Bypass in JQueryForm.com Forms
Forms generated by JQueryForm.com before 2022-02-05 contain an access-control flaw when multiple forms are hosted on the same web server. The application validates session authentication status for only one form rather than binding authorization checks to the specific form and its administrative area. Consequently, an authenticated user can bypass authentication controls and access the administrative section of another form on the same server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker can obtain unauthorized administrative access to other co-hosted forms. This bypasses intended per-form access boundaries and can expose or enable modification of administrative form resources, subject to the functions available in the affected administrative interface.
If you can’t patch tonight, do this now.
Where immediate replacement is not possible, avoid hosting multiple affected forms on the same web server. Restrict administrative access to trusted users and networks until affected forms can be replaced.
Patch, then assume compromise.
Replace or regenerate affected forms using a JQueryForm.com version generated on or after 2022-02-05, which is not identified as affected. Ensure administrative-session validation and authorization are scoped to the specific form being accessed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.