CVE-2015-6743 in Banking
Summary
by MITRE
Basware Banking (Maksuliikenne) 8.90.07.X uses a hardcoded password for an unspecified account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2017
The vulnerability described in CVE-2015-6743 represents a critical security flaw in Basware Banking version 8.90.07.X, specifically affecting the Maksuliikenne component. This issue stems from the implementation of a hardcoded password within the software configuration, creating a persistent security weakness that undermines the authentication mechanisms designed to protect the system. The vulnerability allows remote authenticated users to exploit this predetermined credential, effectively bypassing the intended access controls and gaining unauthorized privileges within the system.
The technical flaw manifests as a hardcoded credential vulnerability, which falls under the CWE-798 weakness category, specifically CWE-798: Use of Hardcoded Credentials. This type of vulnerability occurs when authentication credentials such as passwords, keys, or tokens are embedded directly within the source code or configuration files of an application, making them easily discoverable by attackers who gain access to the system. The hardcoded password creates a backdoor that persists across system restarts and updates, as it cannot be easily modified or rotated without code changes.
From an operational impact perspective, this vulnerability significantly weakens the security posture of the Basware Banking system by providing attackers with a direct path to bypass authentication controls. Remote authenticated users who possess knowledge of the hardcoded password can access restricted system functions, potentially leading to data breaches, unauthorized transactions, and system compromise. The vulnerability's remote nature means that attackers do not need physical access to the system, and the authenticated access requirement indicates that the attack can be executed by someone who has already gained legitimate access to the system through other means.
The attack pattern associated with this vulnerability aligns with the MITRE ATT&CK framework under the technique T1078: Valid Accounts, where adversaries leverage legitimate credentials to gain access to systems. Additionally, this vulnerability maps to T1566: Phishing and T1046: Network Service Scanning as attackers may first need to identify system components and then exploit the hardcoded credentials. The vulnerability's classification as a privilege escalation issue under ATT&CK framework demonstrates how a single hardcoded password can enable attackers to move laterally within the network and access higher-privileged system functions.
Organizations should implement immediate mitigations including replacing the hardcoded password with a dynamic authentication mechanism, conducting comprehensive credential audits, and implementing proper access control policies. The system should be updated to use rotating credentials or secure key management systems rather than static passwords. Additionally, regular security assessments should be performed to identify and remediate similar hardcoded credential issues throughout the software stack. Network segmentation and monitoring should be implemented to detect unauthorized access attempts, while privileged access should be restricted to least-privilege principles to minimize potential damage from credential compromise. The vulnerability highlights the critical importance of following secure coding practices and avoiding hardcoded credentials in production systems, particularly in financial applications where security is paramount.