CVE-2015-6744 in Banking
Summary
by MITRE
Basware Banking (Maksuliikenne) before 8.90.07.X relies on the client to enforce (1) login verification, (2) audit trail creation, and (3) account locking, which allows remote attackers to "disrupt security-critical functions" by "dropping network traffic." NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2017
The vulnerability identified as CVE-2015-6744 affects Basware Banking (Maksuliikenne) versions prior to 8.90.07.X, representing a critical flaw in the security architecture of this financial transaction processing system. This vulnerability stems from the application's improper delegation of security-critical functions to the client-side component rather than maintaining centralized enforcement within the server environment. The flaw specifically impacts three fundamental security mechanisms: login verification, audit trail creation, and account locking functionality. According to the vulnerability description, remote attackers can exploit this weakness by simply dropping network traffic, which effectively undermines the integrity of the security controls that should normally be enforced server-side.
The technical nature of this vulnerability places it squarely within the realm of CWE-310, which addresses cryptographic weaknesses and improper security control enforcement. This weakness manifests as a failure in the principle of least privilege and centralized security enforcement, where client-side components should never be trusted to perform critical security operations without server-side validation and control. The attack vector leverages network packet dropping capabilities to disrupt communication between client and server, effectively bypassing the security mechanisms that should normally prevent unauthorized access and maintain audit integrity. This approach aligns with ATT&CK technique T1072, which involves using remote services to gain access to systems, though in this case the attack method is more subtle and involves network manipulation rather than direct service exploitation.
The operational impact of this vulnerability is severe and multifaceted, as it allows attackers to disrupt security-critical functions without requiring sophisticated exploitation techniques or privileged access. The ability to "drop network traffic" to compromise login verification means that authentication mechanisms can be circumvented, potentially allowing unauthorized users to gain access to financial transaction systems. The audit trail creation failure creates a significant gap in security monitoring and forensic capabilities, making it difficult to track unauthorized access attempts or malicious activities. Account locking functionality disruption further compounds the risk by potentially allowing brute force attacks or credential stuffing attempts to succeed without the normal account lockout mechanisms preventing excessive login attempts. This vulnerability type represents a classic case of security control bypass where network-level manipulation can effectively neutralize server-side security measures.
The mitigation strategy for CVE-2015-6744 requires immediate implementation of the vendor-provided patch or upgrade to Basware Banking version 8.90.07.X or later, which addresses the client-server security control delegation issue. Organizations should also implement network-level monitoring to detect unusual traffic dropping patterns that might indicate this specific attack technique being employed. Additional defensive measures include implementing redundant authentication verification mechanisms, enhancing network traffic analysis capabilities, and ensuring that critical security functions are always enforced server-side regardless of client behavior. The vulnerability highlights the importance of maintaining proper separation of concerns in security architecture, where client-side components should never be responsible for enforcing security controls that require centralized management and validation. Organizations should also consider implementing network intrusion detection systems specifically configured to identify and alert on traffic manipulation patterns that could indicate attempts to exploit this type of vulnerability.