A critical security vulnerability has been discovered in Zendesk’s Android SDK implementation that allows attackers to perform mass account takeovers without any user interaction. 

The flaw, which earned a $3,000 bug bounty payout, stems from predictable token generation mechanisms that enable unauthorized access to all Zendesk support tickets across affected organizations.

Key Takeaways
1. Predictable JWT tokens in Zendesk’s Android SDK allow zero-click account takeovers.
2. Attackers can mass-generate tokens without rate limits to access all tickets and data.
3. Fix by using high-entropy secrets, enforcing rate limits, and auditing mobile auth.

The vulnerability exploits a fundamental weakness in how the Zendesk Android SDK generates authentication tokens, combining hardcoded secrets with sequential account IDs to create predictable JWT tokens. 

This design flaw allows malicious actors to systematically generate valid authentication tokens for any user account without requiring any form of user interaction or social engineering.

Account Takeover Vulnerability

Voorivex’s Team reports that the vulnerability lies within the ZendeskHelper.g() method, which implements a flawed token generation algorithm. The method creates authentication tokens using a predictable formula:

The token generation process follows these steps:

• Base String Construction: REDACTED-{AccountID}-{HardcodedSecret}
• SHA-1 Hash Generation: The base string is processed through SHA-1 hashing
• Final Token Format: {AccountID}_{SHA1Hash}

The critical flaw emerges from two key weaknesses: the use of a static hardcoded secret (987sdasdlkjlakdjf) that remains constant across all installations, and sequential account IDs (getRemoteId()) that can be easily enumerated. 

This combination creates a scenario where attackers can generate valid authentication tokens for any user by simply iterating through account ID ranges.

The authentication flow sends POST requests to /access/sdk/jwt endpoints:

The server responds with a valid access_token that grants full access to the victim’s Zendesk support environment, including the ability to read all tickets, submit new requests, and perform any action available through the support interface.

The vulnerability enables zero-click mass account takeover attacks through systematic token generation and validation. 

Attackers can implement automated scripts to iterate through account ID ranges, generate corresponding tokens, and validate them against Zendesk endpoints without triggering rate limiting or account lockout mechanisms.

Successful exploitation grants attackers access to:

• Complete ticket histories containing sensitive customer communications
• Personal identifiable information (PII) within support conversations
• Internal company communications and support procedures
• Customer complaint patterns and business intelligence data
• Ability to impersonate legitimate users in support interactions

The vulnerability affects any organization using Zendesk’s Android SDK for mobile support integration, potentially impacting thousands of companies worldwide. 

This critical flaw demonstrates the severe security risks associated with predictable authentication mechanisms and highlights the importance of implementing robust token generation systems and comprehensive security testing throughout the mobile application development lifecycle.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

The post 0-Click Zendesk Account Takeover Vulnerability Enables Access to all Zendesk Tickets appeared first on Cyber Security News.

A comprehensive security analysis of vtenext CRM version 25.02 has revealed multiple critical vulnerabilities that allow unauthenticated attackers to bypass authentication mechanisms through three distinct attack vectors, ultimately leading to remote code execution on target systems. 

The Italian CRM solution, utilized by numerous small and medium enterprises across Italy, faces significant security exposure despite attempted vendor notifications.

Key Takeaways
1. Three authentication bypasses let attackers impersonate any user.
2. Post‐login, LFI and module‐upload flaws enable remote code execution.
3. Only the password‐reset issue was silently patched; others still need fixes.

XSS and Session Hijacking

Sicuranext reports that the first attack vector exploits a vulnerability chain combining reflected Cross-Site Scripting (XSS), CSRF token bypass, and session cookie disclosure. 

A critical flaw in modules/Home/HomeWidgetBlockList.php where the widgetId parameter undergoes insufficient sanitization before reflection in server responses.

The vulnerability manifests when JSON responses containing malicious payloads are delivered with Content-Type: text/html headers instead of the secure application/json format, enabling browser execution of embedded JavaScript code. 

Attackers can inject malicious scripts using crafted requests:

The exploitation becomes particularly dangerous when combined with a CSRF token validation bypass achieved through HTTP method tampering. 

The application’s reliance on the $_REQUEST superglobal allows attackers to convert POST requests to GET requests, completely circumventing CSRF protection mechanisms in include/utils/VteCsrf.php.

This design flaw enables attackers to exploit XSS vulnerabilities without requiring valid CSRF tokens, significantly lowering the attack complexity.

SQL Injection Vulnerability

The second authentication bypass vector leverages SQL injection vulnerabilities in modules/Fax/EditView.php to extract sensitive user credentials and authentication tokens. 

The vulnerable code constructs database queries by directly concatenating user-controlled input:

Although prepared statements are utilized, the $fieldname parameter remains unsanitized, allowing attackers to specify arbitrary database columns for extraction. 

More critically, attackers can leverage subquery injection to extract password reset tokens.

These extracted tokens enable immediate password reset operations without user interaction, providing complete account takeover capabilities.

Direct Password Reset Vulnerability

The most severe vulnerability, designated as the third attack vector, involves an arbitrary password reset flaw in hub/rpwd.php. 

This endpoint exposes a change_password action that lacks adequate security validation, permitting password modification for any user account using only the target username.

The vulnerable code path in modules/Users/RecoverPwd.php processes password change requests without proper authentication verification:

The skipOldPwdCheck parameter set to true completely bypasses password verification, enabling attackers to reset any user’s credentials through a single HTTP request. This vulnerability was patched in version 25.02.1 following the research disclosure.

Remote Code Execution Flaw

Once authentication bypass is achieved, attackers can escalate to remote code execution through various techniques. 

The application contains multiple Local File Inclusion (LFI) vulnerabilities that accept user input in file inclusion functions without proper sanitization.

Critical LFI vulnerabilities exist in:

• modules/Settings/LayoutBlockListUtils.php
• modules/Calendar/ActivityAjax.php
• modules/Calendar/wdCalendar.php

Path traversal sequences (../) enable arbitrary file inclusion, with the limitation that target files must possess .php extensions. 

While upload restrictions prevent direct PHP file uploads, researchers demonstrated RCE exploitation through pearcmd.php gadgets when the PEAR framework is present on target systems.

Additionally, vtenext administrators can upload custom modules through the ModuleManager interface, providing a direct pathway to RCE. 

Organizations utilizing vtenext CRM should immediately upgrade to version 25.02.1 or later and implement additional security measures to mitigate these critical vulnerabilities. 

The vendor’s delayed response to responsible disclosure attempts highlights the importance of proactive security monitoring and rapid patch deployment in enterprise environments.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

The post Multiple vtenext Vulnerabilities Let Attackers Bypass Authentication and Execute Remote Codes appeared first on Cyber Security News.