VISAM has not yet responded to the multiple vulnerabilities in its VBASE product, according to CISA.
The vulnerabilities include relative path traversal, incorrect default permissions, inadequate encryption strength, insecure storage of sensitive information, and a stack-based buffer overflow. Gjoko Krstic of Applied Risk discovered these vulnerabilities.
Successful exploitation of these remotely exploitable vulnerabilities could allow an attacker to read the contents of unexpected files, escalate privileges to system level, execute arbitrary code on the targeted system, bypass security mechanisms, and discover the cryptographic key for the web login.
The following versions of VBASE, an automation platform, suffer from the issues:
- VBASE Editor, Version 18.104.22.168
- VBASE Web-Remote Module
In one vulnerability, input passed in the URL is not properly verified before use, which may allow an attacker to read arbitrary files from local resources.
CVE-2020-7008 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.
In addition, weak or insecure permissions on the VBASE directory may result in elevation of privileges or malicious effects on the system the next time a privileged user runs the application.
CVE-2020-7004 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.2.
Also, there is a weak hashing algorithm and insecure permissions that may allow a local attacker to bypass the password-protected mechanism through brute-force attacks, cracking techniques, or overwriting the password hash.
CVE-2020-10601 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.1.
In another issue, an unauthenticated attacker may discover the cryptographic key from the web server and gain information about the login and the encryption/decryption mechanism, which may be exploited to bypass authentication of the HTML5 HMI web interface.
CVE-2020-7000 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.
Also, a vulnerable ActiveX component may end up exploited resulting in a buffer overflow, which may allow remote attackers to cause a denial-of-service condition and execute arbitrary code.
CVE-2020-10599 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 9.0.
The product sees use in multiple industry sectors and it sees action on a global basis.
No known public exploits specifically target these vulnerabilities. However, an attacker with low skill level could leverage the vulnerabilities.
Germany-based VISAM has not yet responded to provide mitigations for these vulnerabilities.
For more information about these vulnerabilities and how VISAM plans to address them, contact VISAM using the information provided on their contact page (German language).