Multiple vulnerabilities in IBM Enterprise Records

1) Input validation error

EUVDB-ID: #VU53973

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28169

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information..

The vulnerability exists due to a double decoding issue when parsing URI with certain characters. A remote attacker can send requests to the ConcatServlet and WelcomeFilter and view contents of protected resources within the WEB-INF directory.

Example:

/concat?/%2557EB-INF/web.xml

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Enterprise Records : before 5.2.1.8 IF002

External links

http://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-found-in-eclipse-jetty-may-affect-ibm-enterprise-records/
http://www.ibm.com/support/pages/node/6830869

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) HTTP request smuggling attack

EUVDB-ID: #VU13527

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7656

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to conduct an HTTP request smuggling attack on the target system.

The vulnerability exists due to improper handling of HTTP/0.9 requests. A remote attacker can send a specially crafted HTTP/0.9 request that submits malicious request headers, cause the software and an upstream HTTP agent to misinterpret the boundary of the request and poison the web cache on the system, which could be used to conduct further attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Enterprise Records : before 5.2.1.8 IF002

External links

http://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-found-in-eclipse-jetty-may-affect-ibm-enterprise-records/
http://www.ibm.com/support/pages/node/6830869

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU13528

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7657

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to improper handling of queries that do not match the dynamic URL pattern for webapps that use default error handling settings. A remote attacker can send a query that submits malicious input, trigger a java.nio.file.InvalidPathException message, which could allow the attacker to view sensitive information, such as the software installation path.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Enterprise Records : before 5.2.1.8 IF002

External links

http://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-found-in-eclipse-jetty-may-affect-ibm-enterprise-records/
http://www.ibm.com/support/pages/node/6830869

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.