ERPScanERPSCAN-18-002Oracle MICROS POS missing authorisation check
EPSS
Percentile
97.9%
Application: Oracle MICROS POS **Versions Affected:**Oracle Hospitality Simphony 2.7-2.9 Vendor URL: Oracle **Bug:**Missing Authentication for Critical Function **Reported:**21.07.2017 **Vendor response:**22.07.2017 **Date of Public Advisory:**17.01.2018 Reference:Oracle CPU January 2018 Author: Dmitry Chastuhin (ERPScan) aka @_chipik
VULNERABILITY INFORMATION
Class: Missing Authentication
Risk: High
Impact: Provides an attacker with the privilege to read sensitive data
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2018-2636
CVSS Information
CVSS Base Score v3: 8.1 / 10
CVSS Base Vector:
| AV: Attack Vector (Related exploit range) | Network (N) |
|---|---|
| AC: Attack Complexity (Required attack complexity) | High (H) |
| PR: Privileges Required (Level of privileges needed to exploit) | None (N) |
| UI: User Interaction (Required user participation) | None (N) |
| S: Scope (Change in scope due to impact caused to components beyond the vulnerable component) | Unchanged (U) |
| C: Impact to Confidentiality | High (H) |
| I: Impact to Integrity | High (H) |
| A: Impact to Availability | High (H) |
VULNERABILITY DESCRIPTION
A remote unauthenticated attacker can read any file and receive information on various services without authentication from a vulnerable MICROS workstation. The attacker can snatch DB usernames and password hashes, brute them and gain full access to the DB with all business data.
VULNERABLE PACKAGES
Oracle Hospitality Simphony: 2.7
Oracle Hospitality Simphony: 2.8
Oracle Hospitality Simphony: 2.9
SOLUTIONS AND WORKAROUNDS
To correct this vulnerability, implement Oracle CPU January 2018
TECHNICAL DESCRIPTION
Proof of Concept
In case an insider has access to the vulnerable URL, he or she can pilfer numerous files from the MICROS workstation including services logs and read files like SimphonyInstall.xml or Dbconfig.xml that contain usernames and encrypted passwords to connect to DB, get information about ServiceHost, etc.
You can find more information on CVE-2018-2636 in our blog and script to be sure that your environment has no such vulnerabilities.
Related
