Description

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-14T02:17:14.080Z",
  "pubdate": "2026-09-14T02:17:14.080Z",
  "executiveSummary": "A critical information disclosure vulnerability exists within the Suprema BioStar 2 and BioStar X platforms. The vulnerability is located in the /api/v2/setting/adserversetting endpoint, which improperly exposes Active Directory service account credentials in cleartext.\nThis vulnerability allows an unauthorized actor to retrieve sensitive authentication data by submitting a specially crafted GET request to the vulnerable API endpoint.\nThe scope of impact includes potential unauthorized access to the underlying Active Directory infrastructure, facilitating privilege escalation, lateral movement within the enterprise network, and unauthorized administrative control over integrated domain resources.\nAffected products include Suprema BioStar 2 versions prior to 2.9.12 and BioStar X versions prior to 1.0.2. The risk level is considered high due to the sensitivity of the exposed credentials and the relative simplicity of the exploitation method, which does not appear to require complex obfuscation or sophisticated payload injection techniques. Organizations utilizing these products are at significant risk of credential harvesting if the API is reachable by an attacker.",
  "technicalDetails": "The vulnerability manifests as an improper access control and sensitive data exposure flaw within the application programming interface (API) layer of the BioStar platform. Specifically, the /api/v2/setting/adserversetting endpoint, which is intended to manage Active Directory (AD) integration settings, fails to sanitize or mask sensitive configuration parameters when processing incoming GET requests.\nDuring normal operation, this endpoint retrieves configuration data for the AD server. A flaw in the backend logic leads to the inclusion of the service account's plaintext credentials in the HTTP response body. Because the API does not verify the requester's identity or authorization level appropriately, any entity capable of communicating with this endpoint can trigger the disclosure.\nThe attack flow proceeds as follows: 1) The attacker identifies the target network environment running a vulnerable instance of BioStar 2 or BioStar X. 2) The attacker sends a standard, unauthenticated or authenticated GET request to the /api/v2/setting/adserversetting URI. 3) The backend server processes the request and executes the database or configuration file query to retrieve the AD server settings. 4) The application serializes the configuration object—which contains the service account username and cleartext password—into a JSON response and transmits it back to the client. 5) The attacker captures the response, parses the JSON payload, and extracts the AD service account credentials.\nThe root cause is the lack of server-side data filtering and inadequate identity verification on the management API endpoint. By exposing sensitive authentication material, the application violates the principle of least privilege, as administrative-level credentials are provided to any caller of the API. This vulnerability is particularly severe because service accounts often hold elevated permissions within an Active Directory environment to allow for user synchronization and authentication management. Consequently, successful exploitation grants the attacker persistent access to the AD forest, allowing for the compromise of other systems integrated with the same directory service, data exfiltration, or the creation of backdoors."
}