Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access.
Unresponsive targets could also occupy a server worker until the operating-system timeout.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
esaqa gmbh:psono
References 5
https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE…
fdf66990-8419-4c8c-8848-ec15d75773b4
https://gitlab.com/esaqa/psono/psono-server
fdf66990-8419-4c8c-8848-ec15d75773b4
https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/seriali…
fdf66990-8419-4c8c-8848-ec15d75773b4
https://gitlab.com/esaqa/psono/psono-server/-/commit/4059830475744791f3d3a1daa4…
fdf66990-8419-4c8c-8848-ec15d75773b4
https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4
fdf66990-8419-4c8c-8848-ec15d75773b4