PT-2023-16621 · Software Ag · Webmethods Onedata

Published 2023-09-06 · Updated 2023-09-14 · CVE-2023-0925

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions webMethods OneData version 10.11

Description The issue allows an unauthenticated attacker with network connectivity to the Java RMI registry and RMI interface ports to abuse the functionality and instruct the webMethods OneData application to load a malicious serialized Java object. This object can be deserialized on the vulnerable server, and the malicious code runs as the operating system account used to run the software, typically the local System account on Windows. The Java RMI registry listens on TCP port 2099 by default, and two RMI interfaces listen on a single, dynamically assigned TCP high port.

Recommendations For version 10.11, consider restricting access to the Java RMI registry port (2099) and the dynamically assigned RMI interface ports to minimize the risk of exploitation. As a temporary workaround, consider disabling the Java RMI registry and RMI interfaces until a patch is available. Avoid using the vulnerable version of webMethods OneData until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-0925

Affected Products

Webmethods Onedata

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-0925 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0925 · Vendor Advisory
• https://softwareag.com/en_corporate/platform/integration-apis/webmethods-integration.html · Note
• https://twitter.com/CVEnew/status/1699477267716661583 · Twitter Post
• https://t.me/cibsecurity/70028 · Telegram Post