CVE-2015-6746 in Banking
Summary
by MITRE
Basware Banking (Maksuliikenne) before 8.90.07.X stores private keys in plaintext in the SQL database, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/13/2017
The vulnerability identified as CVE-2015-6746 affects Basware Banking (Maksuliikenne) versions prior to 8.90.07.X, representing a critical security flaw in the handling of cryptographic materials within financial communication systems. This issue stems from the improper storage of private keys in plaintext format within the SQL database infrastructure, creating a significant exposure that undermines the fundamental security posture of the financial transactions being processed. The flaw specifically impacts the authentication and integrity mechanisms that are essential for secure banking communications, as private keys are fundamental components in establishing trust between financial institutions and their clients.
The technical implementation of this vulnerability involves the database storage of private cryptographic keys without any form of encryption or protection mechanisms. This plaintext storage approach directly violates established security best practices and industry standards such as those outlined in CWE-312, which addresses the exposure of sensitive information through improper storage of credentials and cryptographic materials. The vulnerability allows remote attackers to gain unauthorized access to these plaintext keys, enabling them to perform man-in-the-middle attacks and impersonate legitimate banking systems. The unspecified vectors mentioned in the description suggest that attackers could potentially exploit this weakness through various network-based attack scenarios, including but not limited to network sniffing, database injection attacks, or lateral movement within compromised network environments.
The operational impact of this vulnerability extends far beyond simple data exposure, as it fundamentally compromises the integrity and authenticity of banking communications. Attackers with access to these plaintext private keys can forge digital signatures, manipulate transaction data, and potentially redirect financial flows without detection. This vulnerability directly affects the financial services industry's compliance with regulatory frameworks such as the Payment Card Industry Data Security Standard (PCI DSS) and the General Data Protection Regulation (GDPR), as it creates exposure points for sensitive financial data and transactional integrity. The ability to spoof communications with banks through this vulnerability represents a severe threat to financial institution security and customer trust, potentially leading to significant financial losses and reputational damage.
The mitigation strategies for this vulnerability require immediate implementation of database encryption mechanisms and proper key management protocols. Organizations must implement encrypted storage solutions for all cryptographic materials and establish robust key management systems that separate key storage from database access. The remediation process should include database schema modifications to encrypt private key storage, implementation of access controls and audit logging for database interactions, and regular security assessments to prevent similar issues. This vulnerability aligns with ATT&CK technique T1552.004, which focuses on unsecured credentials and credential access through database exploitation. Additionally, the issue demonstrates the importance of following security frameworks such as NIST SP 800-57 for cryptographic key management and the ISO 27001 information security management standards, which emphasize the protection of sensitive data through proper storage and access control mechanisms.