Publicly Known Cryptographic Machine Key In Procura Portal Application

The Procura Portal application uses a public cryptographic key that attackers can access, allowing them to create fake login cookies and gain unauthorized access to user accounts without needing real credentials.

The application employs a hardcoded or publicly disclosed machine key for cryptographic operations (CWE-1394). An unauthenticated attacker can leverage this known key to forge valid authentication tokens, bypassing authentication controls and gaining unauthorized access to protected resources. The vulnerability affects versions prior to 9.0.1.2.