PT-2020-20605 · Isomorphic · Smartclient

Published 2020-02-23 · Updated 2024-08-04 · CVE-2020-9351

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SmartClient version 12.0

Description An issue was discovered in SmartClient where an unauthenticated attacker can make a POST request to "/tools/developerConsoleOperations.jsp" or "/isomorphic/IDACall" with malformed XML data in the transaction parameter. The server replies with a verbose error showing the absolute path of the application. It is noted that these tools are available to anyone by default and should only be deployed into a trusted environment, or restricted to administrators or end users by protecting the tools path with normal authentication and authorization mechanisms on the web server.

Recommendations For SmartClient version 12.0, restrict access to the "/tools/developerConsoleOperations.jsp" and "/isomorphic/IDACall" endpoints by protecting the tools path with normal authentication and authorization mechanisms on the web server to minimize the risk of exploitation. Consider temporarily disabling these endpoints until a more permanent solution is available.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2020-9351

Affected Products

Smartclient

References · 6

• 🔥 https://seclists.org/fulldisclosure/2020/Feb/18 · Exploit
• https://osv.dev/vulnerability/CVE-2020-9351 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9351 · Security Note
• https://www-demos.smartclient.com/smartclient-12.0/isomorphic/system/reference/?id=group..toolsDeployment · Note
• https://t.me/cvenotify/88942 · Telegram Post
• https://t.me/cvenotify/1158 · Telegram Post