PT-2023-23928 · Dataprobe · Dataprobe Iboot Pdu

Jesse Chick + 1 · Published 2023-08-13 · Updated 2023-08-25 · CVE-2023-3264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dataprobe iBoot PDU version 1.43.03312023 or earlier

Description The issue concerns the use of hard-coded credentials for interactions with the internal Postgres database and an authentication bypass vulnerability in the REST API due to the mishandling of special characters when parsing credentials. This allows a malicious agent to obtain a valid authorization token, read information relating to the state of the relays and power distribution, and potentially read, modify, or delete arbitrary database records.

Recommendations For version 1.43.03312023 or earlier, as a temporary workaround, consider restricting access to the REST API and the internal Postgres database to minimize the risk of exploitation. Avoid using special characters when parsing credentials in the REST API until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-3264

Affected Products

Dataprobe Iboot Pdu

References · 10

• https://trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3264 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3264 · Vendor Advisory
• https://twitter.com/fletch_ai/status/1691300433443123200 · Twitter Post
• https://twitter.com/cracbot/status/1691328924519927808 · Twitter Post
• https://t.me/cvenotify/57268 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1691038596877217792 · Twitter Post
• https://t.me/cvenotify/56391 · Telegram Post
• https://t.me/cibsecurity/68425 · Telegram Post
• https://twitter.com/CVEnew/status/1690945901924077568 · Twitter Post