PT-2018-2245 · Unknown · S3 Browser

Igor Kanygin · Published 2018-10-09 · Updated 2019-02-04 · CVE-2018-20298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions S3 Browser versions prior to 8.1.5

Description The issue is related to an XML external entity (XXE) vulnerability in the S3 protocol, which is based on HTTP. This vulnerability allows remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server. The exploitation of this vulnerability can enable a remote attacker to view files and obtain user NTLMv2 hash values by masquerading as a legitimate server.

Recommendations For versions prior to 8.1.5, update to version 8.1.5 or later to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2019-00308

CVE-2018-20298

Affected Products

S3 Browser

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-20298 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20298 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00308 · Security Note
• https://s3browser.com/news.aspx · Vendor Advisory
• https://ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34 · Note
• https://ptsecurity.com/ru-ru/research/threatscape/pt-2018-34 · Note