bugtraq - Remote Code Execution Vulnerability in ELBA5 Electronic Banking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4239E582-51B5-4919-ACAA-91DD81F79F49@bee-itsecurity.at>
Date: Fri, 16 Nov 2018 07:09:29 +0000
From: Florian Bogner <florian@...-itsecurity.at>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
  "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Remote Code Execution Vulnerability in ELBA5 Electronic Banking 

Remote Code Execution Vulnerability in ELBA5 Electronic Banking

Metadata
===================================================
Affected product: ELBA5 Network Installation (https://www.elba.at)
CVSSv3 Score: 10.0 (https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Vulnerability Status: Fixed with version 5.8.1
Author: Florian Bogner @ Bee IT Security Consulting e.U.
Tested on: Windows 7 / Windows 10 / Windows 2018
Release Date: 16-Nov-2019
CVE:  Not requested
Full Vulnerability Write Up: https://bogner.sh/elba

Product Description
===================================================
ELBA5 (https://www.elba.at) is one of Austria’s most important business-focused electronic banking applications. It is used by the finance departments of many large organizations and supports about 24 different banks.

Vulnerability Description
===================================================
During a detailed analysis of the ELBA5 network installation, a design issue in the backend authentication module was identified. This issue could be abused to gain full control over the SQL Anywhere database of the ELBA5 server component. As this service was running within the context of the SYSTEM user, full control over the underlying server operating could be gained. Additionally, it was also possible to modify any data stored within the database. This especially includes queued wire transfers.

Further Details
===================================================
A full writeup of the underlying issues, as well as a reliably working Python exploit is available at: https://bogner.sh/elba

Suggested Solution
===================================================
Everyone should update to the latest ELBA5 release, namely version 5.8.1.
A lot of testing went into making the transition to a new authentication module completely transparent for end-users.

I want to sincerely thank everyone involved in fixing this issue. It was a great pleasure working with you guys!

___________

Florian Bogner
Information Security Expert, Speaker

Bee IT Security Consulting e.U.
Nibelungenstraße 37
3123 A-Schweinern

Tel: +43 660 123 9 454
Mail: florian@...-itsecurity.at
Web: https://www.bee-itsecurity.at

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)