PT-2020-15668 · Symmetric Ds · Symmetric Ds

Greendog · Published 2020-10-05 · Updated 2020-10-20 · CVE-2020-24231

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symmetric DS versions prior to 3.12.0

Description The issue allows an attacker to interact with JMX, which can lead to arbitrary code execution. This is possible because mx4j, used by Symmetric DS to provide access to JMX over HTTP, has no authentication by default and is available on all interfaces. An attacker can get system information, invoke MBean methods, and install additional MBeans from a remote host using MLet.

Recommendations For Symmetric DS versions prior to 3.12.0, consider disabling access to JMX over HTTP or restricting it to specific interfaces and implementing authentication to prevent unauthorized access. As a temporary workaround, consider disabling the MLet functionality to prevent the installation of additional MBeans from remote hosts.

Fix

Related Identifiers

CVE-2020-24231

Affected Products

Symmetric Ds

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-24231 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24231 · Vendor Advisory
• https://symmetricds.org/issues/view.php?id=4263 · Vendor Advisory
• https://t.me/cibsecurity/15057 · Telegram Post