PT-2019-18400 · Vivo · Vivo Vitro

Kevin Backhouse + 1 · Published 2019-01-28 · Updated 2023-06-12 · CVE-2019-6986

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions VIVO Vitro version 1.10.0

Description The issue allows a remote attacker to execute arbitrary SPARQL via the uri parameter, potentially leading to a regular expression denial of service (ReDoS). This can be achieved by crafting a specific request to the "/individual?uri=" endpoint, utilizing FILTER%20regex.

Recommendations For VIVO Vitro version 1.10.0, consider restricting access to the uri parameter in the "/individual?uri=" endpoint to minimize the risk of exploitation. Avoid using the uri parameter with untrusted input until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Command Injection

Weakness Enumeration

CWE-400

CWE-77

Related Identifiers

CVE-2019-6986

GHSA-HGQ9-Q8G2-3JMG

Affected Products

Vivo Vitro

References · 10

• 🔥❌ https://github.com/kevinbackhouse/SecurityExploits/tree/0ec74459ac53685a7959ed58d580ef8abece3685/vivo-project · Exploit, Deleted
• https://github.com/vivo-project/Vitro/pull/111 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-6986 · Security Note
• https://osv.dev/vulnerability/GHSA-hgq9-q8g2-3jmg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6986 · Vendor Advisory
• https://github.com/vivo-project/Vitro · Note
• https://github.com/vivo-project/Vitro/pull/111/commits/248ef19107a5ac6f86304fd8f3bc75f3787f8d49 · Note
• http://packetstormsecurity.com/files/172838/VIVO-SPARQL-Injection.html · Note
• https://jira.duraspace.org/browse/VIVO-1697 · Note
• https://t.me/defcon_news/114705 · Telegram Post