An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer server and therefore all sensitive monitoring data. This includes monitored screenshots and keystrokes of all users. The WorkExaminer Professional console is used for administrative access to the server. Before access to the console is granted administrators must login. Internally, a custom protocol is used to call a respective stored procedure on the MSSQL database. The return value of the call is not validated on the server-side. Instead it is only validated client-side which allows to bypass authentication.
WorkExaminer Professional console communicates with the server using a proprietary protocol that invokes appropriate stored procedures in the MSSQL database. The result of this call — determining whether authentication was successful — is verified only on the client side, not on the server side. An attacker can modify the communication or client response to bypass authentication logic without knowledge of any credentials. As a result, they gain unrestricted administrative access to the server via TCP port 12306.
Attacker gains full administrative access to the WorkExaminer server, allowing them to read all collected monitoring data, including screenshots and recorded keystrokes of all monitored users. This constitutes a serious breach of data confidentiality and integrity.
Apply patches available from the vendor according to references. Additionally, until the patch is applied, consider restricting access to TCP port 12306 of the WorkExaminer server exclusively to trusted administrative hosts using a firewall or network rules.
WorkExaminer Professional — versions indicated in vendor references (details available at https://r.sec-consult.com/workexaminer)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H