Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to the electron module (CVE-2022-29247, CVE-2022-36077)

Summary

IBM App Connect Enterprise is vulnerable to a remote attacker due to the electron module (CVE-2022-29247, CVE-2022-36077). Electron is used for Discovery Connectors in IBM App Connect Enterprise. The latest fixpack includes electron v21.2.0

Vulnerability Details

CVEID:CVE-2022-36077
**DESCRIPTION:**Node.js electron module could allow a remote attacker to obtain sensitive information, caused by a flaw with delaying a check for redirecting to file:// URLs from other schemes. By sending a specially-crafted SMB URL, an attacker could exploit this vulnerability to obtain hashed SMB credentials, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/240205 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L)

CVEID:CVE-2022-29247
**DESCRIPTION:**Node.js electron module could allow a remote authenticated attacker to gain unauthorized access to the system. An attacker could exploit this vulnerability to obtain access to a new renderer process with nodeIntegrationInSubFrames enabled which in turn allows effective access to ipcRenderer.
CVSS Base score: 2.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228986 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by applying the appropriate fix to IBM App Connect Enterprise

Product(s)

|

Version(s)

|

APAR

|

Remediation / Fix

—|—|—|—

IBM App Connect Enterprise

|

v12.0.1.0 - v12.0.6.0

|

IT42583

|

The APAR (IT42583) is available in IBM App Connect Enterprise 12.0.7.0

IBM App Connect Enterprise v12.0.7.0

Workarounds and Mitigations

None