Constantin Schwarz

**Name of the Vulnerable Software and Affected Versions** Kiuwan SAST: versions prior to the fixed version Kiuwan Local Analyzer (KLA) (affected versions not specified) **Description** The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format, potentially compromising the confidentiality of scan results. Credentials were found in the JAR files, including `insight.github.user` and `insight.github.password` in the "InsightServicesConfig.properties" file, and an encryption key in the "es/als/security/Encryptor.properties" file. At least one specified username corresponds to a valid GitHub account. **Recommendations** For Kiuwan SAST, update to a version that includes the fix for this issue. For Kiuwan Local Analyzer (KLA), consider removing or securely storing the hard-coded secrets, such as `insight.github.user` and `insight.github.password`, and the encryption key in the "es/als/security/Encryptor.properties" file, until a patch is available. As a temporary workaround, restrict access to the "lib.engine/insight/optimyth-insight.jar" file and its contents to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kiuwan SAST version master.1808.p685.q13371 **Description** The issue arises when the Kiuwan Local Analyzer uploads scan results to the Kiuwan SAST web application, which processes XML files containing external entities. This leads to an XML external entity injection attack. An attacker with privileges to scan source code can extract files from the operating system with the application server user's rights, potentially gaining access to sensitive files like configuration and passwords. The attacker can also initiate connections to internal systems for port scans or access other internal functions and applications. **Recommendations** For version master.1808.p685.q13371, consider disabling the XML entity resolution feature in the Kiuwan SAST web application until a patch is available. Restrict access to the "Code Security" module to minimize the risk of exploitation. Avoid using the Kiuwan Local Analyzer to upload scan results to the Kiuwan SAST web application until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kiuwan SAST version <master.1808.p685.q13371> **Description** The issue allows for an unauthenticated reflected cross-site scripting attack on the login page "login.html" when SSO (single sign-on) is enabled. This is due to the `message` request parameter values being directly included in a JavaScript block in the response. This is particularly critical in business environments using AD SSO authentication, where attackers could potentially steal AD passwords. **Recommendations** For Kiuwan SAST version <master.1808.p685.q13371>, as a temporary workaround, consider restricting access to the "login.html" page or disabling the SSO feature until a patch is available. Avoid using the `message` parameter in the login page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kiuwan SAST version <master.1808.p685.q13371> **Description** The issue concerns an API endpoint "/saas/rest/v1/info/application" that allows access to information about any application, using the `application` parameter. This endpoint lacks proper access control, enabling other authenticated users to read application information without the necessary rights. **Recommendations** For Kiuwan SAST version <master.1808.p685.q13371>, consider restricting access to the "/saas/rest/v1/info/application" API endpoint until a proper fix is available. As a temporary workaround, limit the use of the `application` parameter in this endpoint to minimize the risk of unauthorized access.

**Name of the Vulnerable Software and Affected Versions** ILIAS versions prior to 7.16 **Description** The issue allows for OS Command Injection. **Recommendations** For versions prior to 7.16, update to version 7.16 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ILIAS versions prior to 7.16 **Description** The issue allows for cross-site scripting (XSS), which is a type of attack where an attacker can inject malicious scripts into a website. **Recommendations** For versions prior to 7.16, update to version 7.16 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ILIAS versions prior to 7.16 **Description** The issue allows for external control of file name or path. **Recommendations** For versions prior to 7.16, update to version 7.16 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ILIAS versions prior to 7.16 **Description** The issue is related to an open redirect in the `shib logout.php` script, specifically with the handling of the `return` parameter. This could allow a remote attacker to redirect users to an arbitrary URL. **Recommendations** For versions prior to 7.16, update to version 7.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the `shib logout.php` script to minimize the risk of exploitation. Avoid using the `return` parameter in the affected script until the issue is resolved.