Florian Stuhlmann

Name of the Vulnerable Software and Affected Versions: Shibboleth Service Provider versions through 3.5.0 Description: An SQL injection vulnerability exists in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage. An unauthenticated attacker can exploit this issue via blind SQL injection, potentially extracting arbitrary data from the database if the database connection uses the ODBC plugin. The vulnerability stems from inadequate escaping of single quotes within the `SQLString` class (file `odbc-store.cpp`, lines 253-271). Recommendations: For versions through 3.5.0, ensure proper escaping of single quotes in the `SQLString` class within the `odbc-store.cpp` file. As a temporary workaround, consider disabling the replay cache feature or switching to a different storage mechanism that is not susceptible to SQL injection attacks.

Name of the Vulnerable Software and Affected Versions: Elefant (affected versions not specified) Description: Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITYSYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITYSYSTEM”. Both service binaries are user writable, allowing a local attacker to rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITYSYSTEM". The vulnerable service binaries are located at "C:Elefant1Firebird 2binfbserver.exe" and "C:Elefant1Firebird 2binfbguard.exe". Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Elefant Software Updater (ESU) (affected versions not specified) Description: An attacker with local access to a medical office computer can escalate their Windows user privileges to "NT AUTHORITYSYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The vulnerability can be exploited by communicating with the Elefant Update Service, which is running as "SYSTEM" via Windows Named Pipes. The Elefant Software Updater (ESU) consists of two components: an ESU service that runs as "NT AUTHORITYSYSTEM" and an ESU tray client that communicates with the service to update or repair the installation and is running with user permissions. The communication is implemented using named pipes. A crafted message of type `MessageType.SupportServiceInfos` can be sent to the local ESU service to inject commands, which are then executed as "NT AUTHORITYSYSTEM". Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Elefant versions prior to 1.4.2.1811 Description: An attacker with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITYSYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and their hashes, and instructions to execute binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITYSYSTEM" after they are copied over to the user-writable installation folder. This means that a user can overwrite either `PostESUUpdate.exe` or `Update OpenJava.exe` in the time frame after the copy and before the execution of the final repair step, allowing the overwritten executable to be executed as "NT AUTHORITYSYSTEM". Recommendations: For Elefant versions prior to 1.4.2.1811, upgrade to version 1.4.2.1811 or later to mitigate the risk of local privilege escalation. As a temporary workaround, consider restricting access to the Elefant Update Service or disabling the execution of `PostESUUpdate.exe` and `Update OpenJava.exe` until a patch is applied. Avoid using the repair function until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Elefant Service tool (affected versions not specified) Description: An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded `Hotline` password in the Elefant service binary, which is shipped with the software. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Elefant Firebird database versions prior to 24.03.03 Description: An unauthenticated attacker with access to the local network of a medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. This access allows the attacker to view sensitive data, including patient data and login credentials. Additionally, the attacker can create and overwrite arbitrary files on the server filesystem with the rights of the Firebird database ("NT AUTHORITYSYSTEM"). Recommendations: For versions prior to 24.03.03, upgrade the affected component immediately to mitigate the risk of unauthorized access. As a temporary workaround, consider changing the default login credentials to prevent unauthorized access to the Elefant Firebird database. Restrict access to the database to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Hasomed Elefant version 1.4.2.1811/24.03.03 Description: An unauthenticated attacker with access to the local network of a medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) API to get access to sensitive electronic health records (EHR). This allows for potential data exposure and tampering. Recommendations: For Hasomed Elefant version 1.4.2.1811/24.03.03, patch the software to mitigate the issue and ensure proper authentication is in place for the FHIR API. As a temporary workaround, consider restricting access to the FHIR API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned. **Description** The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser, for example via XSS, and prompt the victim to log in, resulting in the victim's account being taken over. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue concerns an application's up- and downvote function, which modifies a value in a JSON file. Due to improper filtering of POST parameters, an arbitrary file can be overwritten. An authenticated attacker can control the file but not its content. The vulnerability allows overwriting files that the webserver has write access to, requiring a relative path (path traversal) to be supplied. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Software (affected versions not specified) **Description** The issue allows for reflected XSS execution when LDAP authentication is activated in the configuration. This can be achieved by creating a custom URL that, when opened by the victim, executes arbitrary JavaScript code in the victim's browser. The fault lies in the file login.php, where the content of `$ SERVER['PHP SELF']` is reflected into the website's HTML, enabling exploitation without the need for a valid account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.