iBSG 3.5 SQLi/OSI/Default Credential Vulnerabilities and POCs

Vulnerability Overview The webpage screenshot mentions three vulnerabilities in iBSG 3.5: 1. CVE-2023-39807: Unauthenticated blind SQL Injection (SQLi) in , allowing a remote attacker to read administrator usernames and unhashed passwords via the POST parameter. 2. CVE-2023-39809: Authenticated blind Command Injection (OSI) in , allowing a remote attacker to execute commands as the root user, escalating from the iBSG administrator account to the operating system administrator. 3. CVE-2023-39808: Hardcoded root password and SSH misconfiguration, allowing an attacker to take over all iBSG 3.5 installations. Impact Scope CVE-2023-39807: CVSS v2 score of 10.0; enables the retrieval of administrator credentials, leading to lateral movement within the network. CVE-2023-39809: CVSS v2 score of 8.5; enables command execution as the root user, escalating from the iBSG administrator account to the OS administrator. CVE-2023-39808: Publicly available and identical password hashes pose a risk of brute-forcing, potentially resulting in the takeover of all iBSG 3.5 installations. Remediation CVE-2023-39807: - If possible, use a Web Application Firewall (WAF) to filter user input. - Ensure administrator usernames and passwords are not reused across other services and systems. - Update current credentials. - Install updates provided by NVK. CVE-2023-39809: - Ensure the current installation has not been tampered with; perform a clean reinstallation. - Install updates provided by NVK. CVE-2023-39808: - Ensure the current installation has not been tampered with; perform a clean reinstallation. - Install updates provided by NVK. Proof of Concept (POC) Code CVE-2023-39807 CVE-2023-39809 Other Observations SNMP (161/UDP) is open, exposing a significant amount of system information. Attempts to use SNMP RCE techniques were unsuccessful. Conclusion These vulnerabilities were discovered through reverse engineering. Although direct access to the source code was not available, valuable lessons were learned. Thank you for reading!

Goal Reached Thanks to every supporter — we hit 100%!

iBSG 3.5 SQLi/OSI/Default Credential Vulnerabilities and POCs