PT-2020-16823 · Qognify · Qognify Ocularis

Joachim Kerschbaumer + 1 · Published 2020-12-29 · Updated 2021-03-26 · CVE-2020-27868

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qognify Ocularis version 5.9.0.395

Description This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the handling of serialized objects provided to the "EventCoordinator" endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM.

Recommendations For Qognify Ocularis version 5.9.0.395, consider disabling the EventCoordinator endpoint until a patch is available to prevent deserialization of untrusted data. Restrict access to the ConnectedChannel GotMessage function to minimize the risk of exploitation. Avoid providing user-supplied data to the EventCoordinator endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-27868

ZDI-20-1453

Affected Products

Qognify Ocularis

References · 5

• https://qognify.com/support-training/software-downloads · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27868 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-1453 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27868 · Vendor Advisory
• https://t.me/cvenotify/9841 · Telegram Post