CVE-2020-37228 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2020-37228 requires immediate attention.

· 7 min read

Executive Summary

CVE-2020-37228 is a critical authentication-bypass vulnerability in iDS6 DSSPro Digital Signage System 6.2 with a CVSS score of 9.8. The flaw lets an attacker request the autoLoginVerifyCode object, retrieve valid CAPTCHA codes through the login endpoint, and then use those codes to bypass login protections and brute-force user accounts.

For solo developers and small teams, the practical risk is simple: if this product is exposed to the internet or reachable from a shared network, an attacker may be able to get in without normal authentication controls. Even though KEV = No and there is no confirmed wild exploitation, this should be treated as an urgent fix because the impact is severe and the attack path is straightforward.

Immediate Action

  • Isolate the service now if it is internet-facing: restrict access to trusted VPN/IPs, or place it behind a firewall/reverse proxy with allowlisting.
  • Disable or remove iDS6 DSSPro 6.2 from production if you cannot confirm a patched release. If a patch exists, upgrade immediately to the vendor-fixed version. TODO: insert vendor advisory and fixed version link here.
  • Rotate credentials for all accounts that can access the signage system, including admin, API, and service accounts.
  • Review logs for login endpoint abuse, especially repeated requests for CAPTCHA-related objects and unusual authentication attempts.
  • Rollback guidance: if you recently upgraded and behavior changed, roll back only to a known-safe build that is not affected, or isolate the system until a patched build is validated.
  • Block direct access to the login endpoint at the edge if possible, and add rate limiting and MFA where supported.

Affected Versions

  • iDS6 DSSPro Digital Signage System 6.2 vulnerable
  • iDS6 DSSPro <= 6.2 vulnerable if running the affected CAPTCHA/login flow
  • iDS6 DSSPro >= TODO-fixed-version safe; TODO: confirm exact patched release from vendor advisory

Resolution Guide

This issue is product-specific, so common package managers will not apply unless your deployment wraps the vendor software in containers or automation. Use the commands below only where they match your environment.

# Docker: stop exposing the service publicly until patched
docker ps
docker stop <container_id>
docker update --restart=no <container_id>

# Docker: switch to a patched image tag once vendor confirms one
docker pull <vendor/ids6-dsspro:TODO-fixed-tag>
docker run -d --name signage --restart unless-stopped \
  -p 127.0.0.1:8080:8080 \
  <vendor/ids6-dsspro:TODO-fixed-tag>

# apt/yum: if the product is installed from a system package, verify and update
apt list --installed | grep -i ids6
sudo apt-get update
sudo apt-get install --only-upgrade <package-name>

yum list installed | grep -i ids6
sudo yum update <package-name>

# Java app packaging: if bundled in a WAR/JAR, replace with vendor-fixed build
mvn -q -DskipTests package
./gradlew clean build

Config hardening examples:

# Reverse proxy example: restrict access to trusted networks
location /login {
  allow 10.0.0.0/8;
  allow 192.168.0.0/16;
  deny all;
}

# If the product supports feature flags or config toggles:
CAPTCHA_ENABLED=true
LOGIN_RATE_LIMIT=5/min
MFA_REQUIRED=true
# TODO: disable vulnerable autoLoginVerifyCode path if vendor provides a switch

Minimal code fix example if you maintain a wrapper or custom auth layer:

// Pseudocode: do not trust autoLoginVerifyCode without server-side validation
if (request.path === "/login" && request.query.autoLoginVerifyCode) {
  return res.status(403).send("CAPTCHA retrieval disabled");
}

if (!validateCaptchaServerSide(request.body.captchaToken)) {
  return res.status(401).send("Invalid CAPTCHA");
}

JavaScript dependency ecosystems are unlikely to contain this vendor product directly, but if you have an internal wrapper package, update it like this:

npm i <your-wrapper-package>@<TODO-fixed-version>
yarn add <your-wrapper-package>@<TODO-fixed-version>
pnpm add <your-wrapper-package>@<TODO-fixed-version>

Detection & Verification

Check whether you are vulnerable:

# Search deployment artifacts and configs for the product name
grep -RIn "DSSPro\|iDS6\|autoLoginVerifyCode" /opt /srv /etc 2>/dev/null

# Check running containers and images
docker ps --format '{{.Image}} {{.Names}}' | grep -iE 'ids6|dsspro|signage'

# Check package inventory on the host
dpkg -l | grep -iE 'ids6|dsspro|signage'
rpm -qa | grep -iE 'ids6|dsspro|signage'

Look for suspicious login behavior: repeated requests to the login endpoint, CAPTCHA object retrieval, and many failed logins from the same IP or user agent. If you have a WAF or reverse proxy, query for requests containing autoLoginVerifyCode or unusually high login frequency.

Verify the fix:

# Confirm the version after upgrade
docker inspect --format='{{.Config.Image}}' <container_name>
strings /path/to/app | grep -iE '6\.2|TODO-fixed-version'

# Confirm the vulnerable path no longer returns CAPTCHA data
curl -i https://your-host/login?autoLoginVerifyCode=1

# Expected result after fix: 401/403, no CAPTCHA code disclosure

If the product exposes an admin UI, log in with a test account and confirm that CAPTCHA values are not retrievable through the login endpoint and that repeated attempts are rate-limited or blocked.

Risk and Impact

This vulnerability can let an attacker bypass normal authentication checks and use valid CAPTCHA codes to automate password guessing. The likely outcome is account takeover, unauthorized access to signage management, and possible tampering with displayed content.

For small teams, the blast radius can be bigger than it looks: a compromised signage system may provide a foothold into internal networks, shared credentials, or linked admin consoles. Treat any exposed instance as high priority until patched or isolated.

Keep reading