SB2019103110 - Multiple vulnerabilities in ClipSoft REXPERT
Published: October 31, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Arbitrary file upload (CVE-ID: CVE-2019-17325)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file uploads in the "ActiveX" method in "RexViewerCtrl30.ocx". A remote attacker can upload arbitrary file and access sensitive information on the target system.
Note: To exploit this vulnerability the target must visit a malicious web page.
2) Path traversal (CVE-ID: CVE-2019-17324)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP POST request with ../ characters and create malicious HTML file, because they can inject a content with crafted template.
Note: To exploit this vulnerability the target must visit a malicious web page.
3) XML injection (CVE-ID: CVE-2019-17323)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the affected software does not properly handle user-supplied XML files in the "report print" function of rexpert viewer. A remote unauthenticated attacker can trick a victim to open a specially crafted XML file that submits malicious input to the targeted system and execute arbitrary files on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Improper access control (CVE-ID: CVE-2019-17322)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can create arbitrary files via a POST request with the parameter set to the file path to be written.
Note: To exploit this vulnerability the target must visit a malicious web page.
5) Information disclosure (CVE-ID: CVE-2019-17321)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper input validation. A remote attacker can gain unauthorized access to sensitive information on the system when requesting web page associated with session, such as username via session file path of HTTP response data.
6) Improper access control (CVE-ID: CVE-2019-17326)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can issue a HTTP GET request with a specially crafted parameter, bypass implemented security restrictions and delete files on the target system.
Note: To exploit this vulnerability the target must visit a malicious web page.
Remediation
Install update from vendor's website.