9
Critical Findings
3
High Severity
1
Medium Severity
7
Assets Tested
5 instances exposed in pre-setup state allowing unauthenticated admin takeover
MitigatedManagement UI accessible over plaintext HTTP enabling credential interception
OpenREST API exposes user information enabling targeted attacks
OpenUnauthenticated setup exposed enables full admin takeover on multiple instances
Attack Vector
Network
Complexity
Low
Privileges
None Required
User Interaction
None
Port 3000
v0.49.8
Port 3000
v0.49.8
Port 3000
v0.49.8
Port 3000
v0.49.8
Port 3000
v0.49.8
Administrative Takeover
Create first admin account without authentication
Data Exfiltration
Access to connected databases and business intelligence
Lateral Movement
Harvest credentials and pivot to internal networks
Persistence
Create backdoor accounts and API keys
GET /api/session/properties HTTP/1.1 Host: blog.brnz.ai:3000 # Response: { "version": {"tag": "v0.49.8"}, "setup-token": "737de9...7d17" ← Exposed }
Management interface accessible without TLS on picklezone.brnz.ai:15672
Attack Vector
Network
Complexity
Low
Privileges
None Required
Impact
High
Man-in-the-Middle (MITM)
HTTP Basic auth credentials transmitted in cleartext
Credential Brute-Force
Public interface enables online password attacks
Service Fingerprinting
Version disclosure aids targeted exploitation
Unauthenticated access to user information via public REST API
• Bern Miller (admin3)
• Paul Johnson (admin)
• admin (admin)
// Add to functions.php
add_filter('rest_endpoints', function($endpoints) {
if (!is_user_logged_in()) {
unset($endpoints['/wp/v2/users']);
unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
}
return $endpoints;
});
24-48 hours
1-2 weeks
1-3 months
UFW Firewall Configuration:
sudo ufw deny 3000/tcp sudo ufw allow from <ADMIN_IP> to any port 3000 proto tcp sudo ufw reload
Environment Configuration:
MB_JETTY_HOST=127.0.0.1 MB_SETUP_ENABLED=false
Nginx Configuration:
server {
listen 443 ssl http2;
server_name metabase.brnz.ai;
location /setup {
deny all;
return 403;
}
location / {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://127.0.0.1:3000;
}
}
[{rabbitmq_management, [
{listener, [
{port, 15672},
{ssl, true},
{ssl_opts, [{certfile, "cert.pem"}]}
]}
]}].
Enable TLS for all management connections
rabbitmqctl add_user admin 'STRONG_PWD' rabbitmqctl set_user_tags admin administrator rabbitmqctl delete_user guest
Disable default accounts and use strong passwords
| Remediation Action | Effort (Hours) | Timeline | Cost Estimate |
|---|---|---|---|
| Firewall Configuration | 2 hours | Immediate | $200 |
| Reverse Proxy Setup | 8 hours | 1 week | $800 |
| SSL/TLS Certificates | 1 hour | 1 day | $50/year |
| SSO/SAML Integration | 16 hours | 2 weeks | $1,600 |
| Network Segmentation | 40 hours | 1 month | $4,000 |
| Security Monitoring Setup | 16 hours | 2 weeks | $2,000 |
| Total Phase 1 Investment | ~83 hours | 1 month | $8,650 |
Note: Costs calculated at $100/hour standard security engineering rate. Ongoing monitoring and maintenance costs not included.
General Data Protection Regulation
• Article 32: Security of Processing
⚠ Potential fine: Up to €10M or 2% of global turnover
Payment Card Industry Data Security Standard
✓ Requirement 2.2.4: Security Parameters
✓ Requirement 8: Access Control
Health Insurance Portability and Accountability Act
✓ §164.308: Administrative Safeguards
✓ §164.312: Technical Safeguards