PT-2019-13984 · Tyto · Tyto Sahi Pro

Goutham Madhwaraj · Published 2019-09-06 · Updated 2020-08-24 · CVE-2019-15102

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tyto Sahi Pro versions 6.x through 8.0.0

Description An issue in TestRunner Non distributed and distributed endpoints allows an attacker to execute arbitrary scripts on the remote Sahi Pro server due to the lack of an authentication mechanism. Additionally, the password-protected web interface for remote script access lacks server-side validation, enabling an attacker to create, modify, or delete scripts without a password. Combining these issues can result in remote code execution on the Sahi Pro server.

Recommendations For Tyto Sahi Pro versions 6.x through 8.0.0, consider disabling the TestRunner Non distributed and distributed endpoints until a patch is available. Restrict access to the web interface to minimize the risk of exploitation. Avoid using the web interface for remote script access until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-15102

Affected Products

Tyto Sahi Pro

References · 3

• 🔥 https://barriersec.com/2019/08/cve-2019-15102-sahi-pro · Exploit
• https://osv.dev/vulnerability/CVE-2019-15102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15102 · Security Note