CVE-2013-7379

Name of the Vulnerable Software and Affected Versions tomato versions prior to 0.0.6

Description The admin API in the tomato module does not properly check the access key when it is set to a string, allowing remote attackers to bypass authentication via a string in the access-key header that partially matches config.master.api.access key. This vulnerability enables an attacker to guess the password for the admin service in less than 200 requests, regardless of the password's complexity. The issue arises from the tomato API's verification of the access key by checking if the server access key incorporates the user-provided value at any location.

Recommendations For versions prior to 0.0.6, update to version 0.0.6 or later. As a temporary workaround, consider restricting access to the admin service or modifying the access key verification to prevent partial matches. Avoid using short or simple access key values until the issue is resolved.