CVE-2015-6742 in Banking
Summary
by MITRE
Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2017
The vulnerability described in CVE-2015-6742 represents a critical security flaw in Basware Banking (Maksuliikenne) software versions prior to 8.90.07.X. This issue stems from the implementation of a hardcoded password within the ANCO account configuration, creating a persistent security weakness that fundamentally undermines the system's access control mechanisms. The vulnerability specifically affects the authentication and authorization processes that govern access to sensitive banking functionalities within the Basware platform.
The technical flaw manifests through the use of a static, hard-coded password that is embedded within the software code or configuration files rather than being dynamically generated or securely managed through proper credential management practices. This hardcoded credential is typically stored in plaintext within the application binaries or configuration files, making it accessible to anyone who can obtain access to these resources. The vulnerability type aligns with CWE-259: Use of Hard-coded Password and CWE-798: Use of Hard-coded Credentials, which are well-documented weaknesses in software security that have been consistently identified as high-risk issues in security assessments.
The operational impact of this vulnerability is significant as it allows remote authenticated users to bypass intended access restrictions by simply knowing the hardcoded password. This creates a scenario where legitimate users who have authenticated to the system can leverage this knowledge to gain unauthorized access to restricted functionalities, potentially leading to data breaches, financial fraud, or system compromise. The attack vector is particularly concerning because it requires only authentication to the system, not any additional exploitation techniques, making it accessible to attackers who have already gained some level of access to the platform.
This vulnerability directly maps to several ATT&CK techniques including T1078: Valid Accounts, where adversaries use legitimate credentials to access systems, and T1566: Phishing, as the hardcoded password could be discovered through various reconnaissance methods. The security implications extend beyond simple credential theft, as this vulnerability represents a design flaw that compromises the entire authentication framework of the system. Organizations using affected versions of Basware Banking are exposed to potential unauthorized access to financial transactions, account information, and other sensitive data processed through the platform.
The recommended mitigations include immediate upgrading to Basware Banking version 8.90.07.X or later, which contains the necessary patches to resolve the hardcoded password issue. Additionally, organizations should implement proper credential management practices, including regular password rotation, secure credential storage mechanisms, and removal of any hardcoded credentials from application code. Security teams should also conduct thorough audits of their systems to identify any other instances of hardcoded credentials and implement monitoring solutions to detect unauthorized access attempts. The vulnerability highlights the importance of following secure coding practices and adhering to industry standards such as those outlined in the OWASP Top Ten and NIST Cybersecurity Framework to prevent similar issues from occurring in the future.