CVE-2023-36035

What it actually does

This is a spoofing/authentication-bypass class vulnerability with high confidentiality, integrity, and availability impact. Based on the supplied scoring, exploitation requires adjacency to the target network and some level of existing privilege, but does not require user interaction. A successful attacker can cause the affected application to accept forged or misleading identity/context information, allowing actions to be attributed incorrectly or authorization decisions to be made on untrusted input. The supplied product metadata identifies alfio-event/alf.io source builds as affected, with the fix available at commit d510c22f613bee0a2b7db51eab0f4d520826d8c0; the vulnerability title/description references Microsoft Exchange Server, so asset owners should validate product mapping before closure.

Why it matters to the business

Successful exploitation could let an attacker impersonate trusted users or services, access sensitive data, alter application state, disrupt operations, and undermine audit trails. Because the EPSS score is high, exploitation is statistically more likely than for most vulnerabilities even though it is not currently listed in CISA KEV and no ransomware use is indicated. The issue has been public for a long time, so unpatched systems should be treated as exposed to mature reconnaissance and opportunistic exploitation attempts.

How an attack unfolds

An attacker first gains a foothold that satisfies the preconditions implied by the score, such as access from an adjacent network segment and a low-privileged account or session. They then interact directly with the affected service and submit crafted requests that manipulate identity, routing, authentication, or trust-related fields. If the vulnerable code accepts the spoofed context, the attacker can perform actions as another user or trusted component, retrieve protected information, modify application data, or interfere with service behavior. Because spoofing flaws often degrade the reliability of audit data, post-exploitation activity may appear to originate from legitimate users, proxies, or internal systems rather than the attacker.

How to fix it

Upgrade affected alfio-event/alf.io source deployments to a version that includes commit d510c22f613bee0a2b7db51eab0f4d520826d8c0 or later. If this advisory is being tracked for Microsoft Exchange Server because of the CVE description, apply the relevant Microsoft security update for the affected Exchange Server version and confirm that the installed build includes the vendor fix. Until patching is complete, restrict network access to the affected service, require strong authentication, limit low-privileged account access, enforce trusted proxy/header handling, disable unnecessary externally reachable interfaces, and monitor for unusual authenticated activity. Remove duplicate or stale vulnerability records after confirming the correct product mapping.

How to confirm the fix worked

Confirm the running application build or source revision includes commit d510c22f613bee0a2b7db51eab0f4d520826d8c0 or a later fixed revision. For packaged deployments, verify the vendor-reported fixed version rather than relying only on file timestamps. Re-run authenticated and unauthenticated vulnerability scans from network locations that match realistic attacker reachability, including adjacent network segments. Review configuration to ensure identity-bearing headers, proxy headers, and authentication context are only trusted from approved components. Validate that crafted spoofing attempts are rejected, logged, and do not grant access or change authorization decisions.

Typical attack path

1. Identify exposed or reachable instances of the affected service from an adjacent network position.
2. Obtain or use low-privileged access where required by the vulnerability conditions.
3. Probe authentication, session, header, redirect, or identity-handling behavior to determine whether the instance is vulnerable.
4. Send crafted requests that spoof trusted identity or context values accepted by the vulnerable component.
5. Use the accepted spoofed context to access restricted data, perform unauthorized actions, or modify application state.
6. Blend activity into normal traffic by relying on legitimate-looking identities, sessions, or internal network paths.

How to detect it

Investigate whether the affected service accepted inconsistent or spoofed identity context before patching. Useful sources include application access logs, authentication logs, reverse-proxy logs, web server logs, operating-system security events, administrative audit logs, and, where applicable, Exchange IIS, ECP/OWA, message-tracking, and admin audit logs. Look for authenticated requests where the asserted user, session owner, source address, forwarded-for chain, client certificate, or proxy identity does not match expected patterns. Pay particular attention to low-privileged accounts performing high-impact actions, requests arriving from adjacent/internal network ranges that are not normal clients, repeated authorization failures followed by success, abnormal use of identity-bearing HTTP headers, and administrative or data-access operations attributed to service accounts or users that do not normally perform them. Because no public exploit artifact or stable payload string is provided in the input, detection should be behavior-based rather than relying on a single signature.

What your security team should do

• Prioritize remediation for reachable production systems because the CVSS impact is high and EPSS is elevated despite the absence of KEV listing.
• Validate asset mapping immediately because the supplied affected-product metadata and vulnerability description point to different ecosystems; do not close remediation until the actual affected product is confirmed.
• Upgrade alfio-event/alf.io deployments to a revision containing d510c22f613bee0a2b7db51eab0f4d520826d8c0 or later, or apply the relevant vendor security update if tracking this against Microsoft Exchange Server.
• Restrict access to administrative, authentication, and application endpoints to trusted networks while remediation is in progress.
• Hunt for unusual authenticated actions, identity mismatches, suspicious proxy/header values, and activity where the apparent user or source does not align with normal behavior.
• Review audit-log integrity and incident response assumptions because spoofing may cause malicious actions to appear attributable to legitimate users or trusted infrastructure.