Full Report
We discovered an information disclosure vulnerability in survey software designed for MSPs. We detail how we worked with the Crewhu team to responsibly disclose and remedy the vulnerability.
Analysis Summary
# Vulnerability: Information Disclosure in Crewhu Survey Software
## CVE Details
- **CVE ID**: Not explicitly assigned (Discovered and remediated as a zero-day disclosure).
- **CVSS Score**: N/A (Estimated **High** due to clear-text credential exposure).
- **CWE**: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
## Affected Systems
- **Products**: Crewhu Customer Satisfaction and Employee Recognition Platform.
- **Versions**: All versions prior to the October 2021 remediation.
- **Configurations**: Instances integrated with Professional Services Automation (PSA) tools or integration servers.
## Vulnerability Description
The flaw was an information disclosure vulnerability within the survey response page. When a user accessed a survey (e.g., via a QR code), the application included sensitive JSON data in the HTTP response that was not intended for the end-user. This metadata contained configuration details for the survey’s backend integrations.
The leaked data included:
* PSA or integration server domain names and URLs.
* **Clear-text usernames** for integration accounts.
* **Clear-text passwords** for integration accounts.
* Clear-text **public and private keys**.
## Exploitation
- **Status**: PoC available (Discovered by Huntress researchers during a live event; no evidence of active exploitation in the wild was reported).
- **Complexity**: Low (Requires only viewing the HTTP response source code/JSON data on a public survey page).
- **Attack Vector**: Network (Remote).
## Impact
- **Confidentiality**: **High** (Exposure of administrative credentials and private keys for critical MSP business tools).
- **Integrity**: **High** (Leaked credentials could allow unauthorized access to PSA tools to modify tickets, client data, or billing).
- **Availability**: **Medium** (Potential for service disruption if integrated accounts are locked or modified).
## Remediation
### Patches
- Crewhu implemented a server-side fix within two hours of notification to obscure and redact sensitive fields with asterisks.
- A permanent fix was deployed to ensure sensitive configuration data is no longer transmitted in the HTTP response to the client.
### Workarounds
- **Credential Rotation**: Following the patch, Crewhu and Huntress recommended that all affected partners **rotate passwords and API keys** for any PSA or integration server that was connected to the platform, as the previous credentials should be considered compromised.
## Detection
- **Indicators of Compromise**: Unrecognized API calls or logins to PSA tools (e.g., ConnectWise, Autotask) originating from unexpected IP addresses.
- **Detection Methods**: Review HTTP response traffic for survey pages to ensure JSON objects do not contain sensitive `password`, `username`, or `private_key` fields.
## References
- Huntress Blog: hxxps[://]www[.]huntress[.]com/blog/vulnerabilities-and-information-disclosure-in-msp-survey-software
- Crewhu Official Site: hxxps[://]www[.]crewhu[.]com/