PT-2020-20606 · Isomorphic · Smartclient

Published 2020-02-23 · Updated 2024-08-04 · CVE-2020-9352

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SmartClient version 12.0

Description An issue was discovered in the downloadWSDL feature, allowing unauthenticated exploitation of blind XXE. This can occur by sending a POST request to the "/tools/developerConsoleOperations.jsp" endpoint with a valid payload in the transaction parameter. The documentation notes that these tools are available to anyone by default and should only be deployed into a trusted environment, or restricted to administrators or end users by protecting the tools path with normal authentication and authorization mechanisms on the web server.

Recommendations For SmartClient version 12.0, restrict access to the "/tools/developerConsoleOperations.jsp" endpoint to minimize the risk of exploitation, and consider protecting the tools path with normal authentication and authorization mechanisms on the web server.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-9352

Affected Products

Smartclient

References · 8

• 🔥 https://seclists.org/fulldisclosure/2020/Feb/18 · Exploit
• 🔥 https://blog.certimetergroup.com/it/articolo/security/smartclient-v12-xml-external-entity--cve-2020-9352 · Exploit
• https://osv.dev/vulnerability/CVE-2020-9352 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9352 · Security Note
• https://www-demos.smartclient.com/smartclient-12.0/isomorphic/system/reference/?id=group..toolsDeployment · Note
• https://t.me/cvenotify/84555 · Telegram Post
• https://t.me/cvenotify/88943 · Telegram Post
• https://t.me/cvenotify/1159 · Telegram Post