Johannes Greil

**Name of the Vulnerable Software and Affected Versions** Kiuwan Cloud (versões afetadas não especificadas) Kiuwan SAST on-premise (KOP) versões anteriores a 2.8.2509.4 **Description** O Kiuwan SAST autoriza inadequadamente logins de SSO para contas de usuários mapeadas que foram desativadas localmente. Isso permite que usuários cujas contas foram desativadas nas configurações de administração de usuários mantenham o acesso à aplicação. **Recommendations** Atualize o Kiuwan SAST on-premise (KOP) para a versão 2.8.2509.4 ou posterior. No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade no Kiuwan Cloud.

**Nome do software vulnerável e versões afetadas** Kiuwan SAST versão master.1808.p685.q13371 **Descrição** O problema ocorre quando o Kiuwan Local Analyzer envia resultados de varredura para o aplicativo web Kiuwan SAST, que processa arquivos XML contendo entidades externas. Isso leva a um ataque de injeção de entidade externa XML. Um invasor com privilégios para varrer código-fonte pode extrair arquivos do sistema operacional com os direitos do usuário do servidor de aplicativos, potencialmente obtendo acesso a arquivos confidenciais, como configurações e senhas. O invasor também pode iniciar conexões com sistemas internos para varreduras de porta ou acessar outras funções e aplicativos internos. **Recomendações** Para a versão master.1808.p685.q13371, considere desativar o recurso de resolução de entidades XML no aplicativo web Kiuwan SAST até que um patch esteja disponível. Restrinja o acesso ao módulo “Code Security” para minimizar o risco de exploração. Evite usar o Kiuwan Local Analyzer para enviar resultados de varredura para o aplicativo web Kiuwan SAST até que o problema seja resolvido.

**Nome do software vulnerável e versões afetadas** Kiuwan SAST versão <master.1808.p685.q13371> **Descrição** O problema diz respeito a um endpoint da API “/saas/rest/v1/info/application” que permite o acesso a informações sobre qualquer aplicativo, utilizando o parâmetro `application`. Esse endpoint carece de controle de acesso adequado, permitindo que outros usuários autenticados leiam informações do aplicativo sem os direitos necessários. **Recomendações** Para a versão do Kiuwan SAST <master.1808.p685.q13371>, considere restringir o acesso ao endpoint da API “/saas/rest/v1/info/application” até que uma correção adequada esteja disponível. Como solução alternativa temporária, limite o uso do parâmetro `application` neste endpoint para minimizar o risco de acesso não autorizado.

**Nome do software vulnerável e versões afetadas** Kiuwan SAST: versões anteriores à versão corrigida Kiuwan Local Analyzer (KLA) (versões afetadas não especificadas) **Descrição** O aplicativo de varredura Java Kiuwan Local Analyzer (KLA) contém vários segredos codificados de forma rígida em formato de texto simples, o que pode comprometer a confidencialidade dos resultados da varredura. Foram encontradas credenciais nos arquivos JAR, incluindo `insight.github.user` e `insight.github.password` no arquivo “InsightServicesConfig.properties”, e uma chave de criptografia no arquivo “es/als/security/Encryptor.properties”. Pelo menos um nome de usuário especificado corresponde a uma conta válida do GitHub. **Recomendações** Para o Kiuwan SAST, atualize para uma versão que inclua a correção para este problema. Para o Kiuwan Local Analyzer (KLA), considere remover ou armazenar com segurança os segredos codificados, como `insight.github.user` e `insight.github.password`, e a chave de criptografia no arquivo “es/als/security/Encryptor.properties”, até que um patch esteja disponível. Como solução alternativa temporária, restrinja o acesso ao arquivo “lib.engine/insight/optimyth-insight.jar” e seu conteúdo para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Kiuwan SAST versão <master.1808.p685.q13371> **Descrição** A vulnerabilidade permite um ataque de cross-site scripting refletido sem autenticação na página de login “login.html” quando o SSO (single sign-on) está habilitado. Isso ocorre porque os valores do parâmetro de solicitação `message` são incluídos diretamente em um bloco de JavaScript na resposta. Isso é particularmente crítico em ambientes corporativos que utilizam autenticação AD SSO, onde invasores poderiam potencialmente roubar senhas do AD. **Recomendações** Para a versão <master.1808.p685.q13371> do Kiuwan SAST, como solução temporária, considere restringir o acesso à página “login.html” ou desativar o recurso SSO até que um patch esteja disponível. Evite usar o parâmetro `message` na página de login até que a vulnerabilidade seja resolvida. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** ADB broadband gateways / routers based on the Epicentro platform (affected versions not specified) **Description** A privilege escalation issue affects the devices, allowing attackers to access the command line interface (CLI) if it was previously disabled by the ISP, escalate privileges, and conduct further attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ADB broadband gateways / routers based on the Epicentro platform (affected versions not specified) **Description** The issue allows attackers to gain root access on the device and extract sensitive configuration data, such as VoIP credentials, or attack the internal network of the ISP. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ADB broadband gateways / routers based on the Epicentro platform (affected versions not specified) **Description** The issue allows attackers to bypass authorization and access settings within the web interface that are normally restricted to end users, such as those controlled by the ISP. This could enable an attacker to modify settings, for example, by enabling the TELNET server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Harman AMX devices (affected versions not specified) **Description** The issue is related to the `setUpSubtleUserAccount` function in `/bin/bw`, which has a hardcoded password for the `1MB@tMaN` account. This makes it easier for remote attackers to obtain access via SSH or HTTP sessions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Harman AMX devices (affected versions not specified) **Description** The issue is related to the `setUpSubtleUserAccount` function in `/bin/bw`, which has a hardcoded password for the BlackWidow account. This makes it easier for remote attackers to obtain access via SSH or HTTP sessions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shopizer versions 1.1.5 and earlier **Description** The issue allows remote attackers to modify the account settings of arbitrary users. This is achieved via the `customer.customerId` parameter to the "shop/profile/register.action" endpoint. **Recommendations** For Shopizer versions 1.1.5 and earlier, avoid using the `customer.customerId` parameter in the "shop/profile/register.action" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "shop/profile/register.action" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue allows remote authenticated users to execute arbitrary commands. This is possible through vectors involving file editing in the System File Overview feature of the NeDi component. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, consider restricting access to the System File Overview feature in the NeDi component until a patch is available. As a temporary workaround, limit the ability to edit files in this feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue concerns the Foundation webapp admin interface in GroundWork Monitor Enterprise, where it uses the nagios account as the owner of writable files under /usr/local/groundwork. This setup allows attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, consider changing the ownership of writable files under /usr/local/groundwork to a more restrictive account to prevent unauthorized access. Additionally, restrict access to GroundWork scripts to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to vectors involving the foundation-webapp/admin/ directory, the NeDi component, or the Noma component. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, update to a version that addresses these XSS vulnerabilities. As a temporary workaround, consider restricting access to the foundation-webapp/admin/ directory, as well as the NeDi and Noma components, to minimize the risk of exploitation. Avoid using these components until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue allows remote authenticated users to execute arbitrary commands and obtain sensitive information by leveraging a JOSSO SSO cookie. This is related to the monarch scan.cgi in the MONARCH component. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, consider restricting access to the monarch scan.cgi until a patch is available. As a temporary workaround, limit the use of JOSSO SSO cookies to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue is related to an XML External Entity (XXE) problem, allowing remote authenticated users to read arbitrary files. This is possible through the Profile Importer feature in monarch.cgi in the MONARCH component, when an XML document containing an external entity declaration is used in conjunction with an entity reference. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, consider disabling the Profile Importer feature in monarch.cgi until a patch is available to prevent exploitation of the XXE issue. Restrict access to the MONARCH component to minimize the risk of unauthorized file reading.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue allows remote authenticated users to bypass intended access restrictions. This can be achieved via a direct request for a log file or a configuration file. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, consider restricting direct access to log and configuration files as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue allows remote authenticated users to obtain sensitive information via a direct request for certain files or contexts, including (1) a configuration file, (2) a database dump, or (3) the Tomcat status context. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, restrict access to sensitive files and contexts, such as configuration files, database dumps, and the Tomcat status context, to prevent unauthorized access. Consider disabling direct requests for these sensitive resources until a fix is available.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu, specifically in the html/System-NeDi.php file of the NeDi component. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, consider restricting access to the NeDi component or the System / NeDi menu to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the scan functionality in the System / NeDi menu.

**Name of the Vulnerable Software and Affected Versions** GroundWork Monitor Enterprise version 6.7.0 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. **Recommendations** For GroundWork Monitor Enterprise version 6.7.0, at the moment, there is no information about a newer version that contains a fix for this issue.