PT-2020-20607 · Isomorphic · Smartclient

Published 2020-02-23 · Updated 2024-08-04 · CVE-2020-9353

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SmartClient version 12.0

Description An issue was discovered in the Remote Procedure Call (RPC) loadFile provided by the console functionality. The issue affects the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL, where unauthenticated Local File Inclusion is possible via directory-traversal sequences in the elem XML element in the transaction parameter. The documentation notes that these tools are available to anyone by default and should only be deployed into a trusted environment, or restricted to administrators or end users by protecting the tools path with normal authentication and authorization mechanisms on the web server.

Recommendations For SmartClient version 12.0, restrict access to the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL by protecting the tools path with normal authentication and authorization mechanisms on the web server to minimize the risk of exploitation. Consider disabling the console functionality until a patch is available. Avoid using the elem XML element in the transaction parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-9353

Affected Products

Smartclient

References · 6

• 🔥 https://seclists.org/fulldisclosure/2020/Feb/18 · Exploit
• https://osv.dev/vulnerability/CVE-2020-9353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9353 · Security Note
• https://www-demos.smartclient.com/smartclient-12.0/isomorphic/system/reference/?id=group..toolsDeployment · Note
• https://t.me/cvenotify/1160 · Telegram Post
• https://t.me/cvenotify/88944 · Telegram Post