Full Report
Two vulnerabilities (CVE-2026-66723 and CVE-2026-66724) were found in CERT.PL MWDB Core software.
Analysis Summary
# Vulnerability: Unauthorized Data Upload in CERT.PL MWDB Core
## CVE Details
- **CVE ID:** CVE-2026-66723 and CVE-2026-66724
- **CVSS Score:** Not explicitly provided in report (Estimated: Medium)
- **CWE:** CWE-862: Missing Authorization
## Affected Systems
- **Products:** CERT.PL MWDB Core (Malware Database)
- **Versions:**
- **CVE-2026-66723:** Version 2.2.0 up to (but not including) 2.19.0.
- **CVE-2026-66724:** Version 2.0.0 up to (but not including) 2.19.0.
- **Configurations:** Systems utilizing default authentication where users lack specific upload "capabilities."
## Vulnerability Description
MWDB Core contains flaws in its authorization logic regarding deprecated endpoints for comments, configs, and blob uploads.
- **CVE-2026-66723:** Relates to a deprecated comment endpoint.
- **CVE-2026-66724:** Relates to deprecated config and blob upload endpoints.
Both vulnerabilities stem from the software accepting undocumented **POST** methods on these endpoints. While the documented **PUT** methods correctly enforce capability checks (ensuring only authorized users can upload), the **POST** method bypasses these checks entirely. This allows any authenticated user—regardless of their assigned permissions—to submit data to the system.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; discovered via internal research by CERT Polska.
- **Complexity:** Low (requires only basic authenticated access and knowledge of the undocumented method).
- **Attack Vector:** Network (Authenticated).
## Impact
- **Confidentiality:** None (the flaw does not allow for data retrieval).
- **Integrity:** Medium (allows unauthorized users to inject new configs, text blobs, and comments into the database).
- **Availability:** Low (potential for database clutter or misinformation, though no direct service disruption is noted).
## Remediation
### Patches
- Users should upgrade to **MWDB Core version 2.19.0** or later, where these deprecated endpoints have been secured or the method bypass fixed.
### Workarounds
- No specific workarounds were provided; however, restricting network access to the API to trusted users and reviewing user roles can reduce the attack surface until patches are applied.
## Detection
- **Indicators of compromise:** Audit logs showing successful `POST` requests to deprecated `/config` or `/blob` upload endpoints from users who do not possess the `adding_configs` or `adding_blobs` capabilities.
- **Detection methods:** Monitor API traffic for unusual use of POST methods on legacy endpoints that traditionally expect PUT.
## References
- **CERT Polska Advisory:** [https://cert.pl/en/posts/2026/07/vulnerabilities-in-mwdb-core/](https://cert.pl/en/posts/2026/07/vulnerabilities-in-mwdb-core/)
- **CVE-2026-66723:** [https://www.cve.org/CVERecord?id=CVE-2026-66723](https://www.cve.org/CVERecord?id=CVE-2026-66723)
- **CVE-2026-66724:** [https://www.cve.org/CVERecord?id=CVE-2026-66724](https://www.cve.org/CVERecord?id=CVE-2026-66724)