ExactMetrics handed its one-time onboarding key to any user allowed to view reports, and that key was the only check guarding the route that issues the token accepted by the unauthenticated exactmetrics_connect_process upgrade handler. An Editor granted report access could therefore install and activate an arbitrary plugin from a URL of their choosing, leading to remote code execution. Affects 8.6.0 through 9.1.2 and 10.1.0 through 10.1.2.
This vulnerability affects the following application versions:
- ExactMetrics 8.6.0
- ExactMetrics 8.6.1
- ExactMetrics 8.6.2
- ExactMetrics 8.7.0
- ExactMetrics 8.7.1
- ExactMetrics 8.7.2
- ExactMetrics 8.7.3
- ExactMetrics 8.7.4
- ExactMetrics 8.8.0
- ExactMetrics 8.9.0
- ExactMetrics 8.10.0
- ExactMetrics 8.10.1
- ExactMetrics 8.10.2
- ExactMetrics 8.11.0
- ExactMetrics 8.11.1
- ExactMetrics 9.0.0
- ExactMetrics 9.0.1
- ExactMetrics 9.0.2
- ExactMetrics 9.0.3
- ExactMetrics 9.1.0
- ExactMetrics 9.1.1
- ExactMetrics 9.1.2
- ExactMetrics 9.1.3
- ExactMetrics 10.1.0
- ExactMetrics 10.1.1
- ExactMetrics 10.1.2