CVE-2015-6745 in Banking
Summary
by MITRE
Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2017
The vulnerability described in CVE-2015-6745 represents a critical weakness in the Basware Banking (Maksuliikenne) version 8.90.07.X security architecture that fundamentally undermines account lockout mechanisms designed to prevent unauthorized access attempts. This issue specifically targets the client-side enforcement of account locking procedures, creating a significant security gap that allows malicious local users to circumvent protective measures through simple file manipulation operations. The vulnerability stems from an architectural design flaw where the system delegates account lockout enforcement to client components rather than maintaining centralized control, creating opportunities for privilege escalation and unauthorized system access.
The technical implementation flaw manifests when local users exploit the system's reliance on client-side locking table entries by simply deleting the relevant database entries or files that contain account lockout information. This action effectively nullifies the security controls that should prevent brute force attacks and unauthorized access attempts, allowing attackers to continue attempting logins without facing the intended account lockout restrictions. The vulnerability is categorized as a weakness in access control mechanisms and represents a failure in proper authentication flow management that violates fundamental security principles. This type of vulnerability aligns with CWE-307, which addresses improper restriction of excessive authentication attempts, and demonstrates how inadequate input validation and access control enforcement can create exploitable conditions.
The operational impact of this vulnerability extends beyond simple account compromise, as it enables attackers to conduct extended brute force attacks against user credentials without the system's normal protective measures. Local users who can manipulate the locking table entries gain the ability to repeatedly attempt authentication without facing account lockout restrictions, effectively disabling the system's built-in protection against credential stuffing and password guessing attacks. This weakness creates a persistent security risk that can be exploited by both malicious insiders and external attackers who have gained local access to the system, potentially leading to unauthorized account access, data breaches, and privilege escalation. The vulnerability's persistence is particularly concerning as it operates at the application level and can be exploited without requiring elevated privileges beyond local system access.
The security implications of this vulnerability are compounded by the fact that it resulted from an incorrect fix for CVE-2015-6744, indicating a pattern of flawed security remediation that may have created additional vulnerabilities or weakened the overall security posture. This demonstrates the importance of thorough testing and validation of security patches, as improper fixes can create new attack vectors or fail to address the root cause of security issues. Organizations implementing Basware Banking solutions must recognize that this vulnerability represents a fundamental flaw in the authentication architecture that requires immediate remediation. The attack surface is limited to local access scenarios, but the potential for privilege escalation and unauthorized system access makes this vulnerability particularly dangerous in environments where local user access is not properly controlled.
Recommended mitigations for this vulnerability include implementing centralized account lockout enforcement that cannot be bypassed through client-side manipulation, establishing proper file system permissions and access controls for locking table entries, and implementing monitoring for unauthorized modifications to critical security files. System administrators should also consider implementing additional authentication controls such as multi-factor authentication, rate limiting at the network level, and enhanced logging of authentication attempts to detect and respond to suspicious activities. The solution should address the root cause by ensuring that account lockout mechanisms are enforced server-side and cannot be circumvented through simple file deletion operations, aligning with ATT&CK technique T1110 for credential access and T1078 for valid accounts to prevent unauthorized access through compromised credentials. Organizations should also conduct thorough security assessments to identify similar vulnerabilities in other components of their security infrastructure and ensure that all authentication mechanisms are properly validated and tested before deployment.