CVE-2018-14930 in FT Intellect Core Banking
Summary
by MITRE
An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. CSRF can occur via a /CollatWebApp/gcmsRefInsert?name=SUPP URI.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2023
The vulnerability identified as CVE-2018-14930 represents a critical cross-site request forgery flaw within the Armor module of Polaris FT Intellect Core Banking version 9.7.1. This security weakness exists in the web application's handling of requests to the specific URI path /CollatWebApp/gcmsRefInsert?name=SUPP which allows unauthorized users to manipulate the system through crafted requests. The vulnerability stems from the absence of proper anti-CSRF mechanisms in the application's authentication and authorization framework, creating a pathway for malicious actors to execute unauthorized actions on behalf of legitimate users who are authenticated within the system.
The technical implementation of this flaw demonstrates a classic CSRF vulnerability pattern where the application fails to validate the origin of requests or implement anti-CSRF tokens in the targeted endpoint. This allows an attacker to construct malicious web pages or send crafted HTTP requests that, when executed by a victim's browser, perform actions within the context of the authenticated user session. The specific URI path suggests this vulnerability exists within a collateral management system component that handles reference data insertion operations, making it particularly dangerous as it could enable unauthorized modifications to critical financial data or system configurations.
From an operational perspective, this vulnerability poses significant risk to financial institutions using the Polaris FT Intellect Core Banking system, as successful exploitation could lead to unauthorized data modifications, system configuration changes, or potentially financial loss through manipulation of collateral management processes. The impact extends beyond simple data integrity concerns as the vulnerability could be leveraged to escalate privileges or gain deeper access to the banking system's core functionalities. Security teams must consider this flaw as potentially enabling a broader attack surface that could compromise the confidentiality, integrity, and availability of the entire core banking infrastructure.
Organizations should implement immediate mitigations including the deployment of anti-CSRF tokens for all state-changing requests within the application, implementation of proper referer header validation, and enforcement of SameSite cookie attributes. The vulnerability aligns with CWE-352 which specifically addresses Cross-Site Request Forgery weaknesses in web applications. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and persistence through manipulation of system configuration components, potentially enabling adversaries to establish long-term access to banking systems. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities in other components of the core banking infrastructure, particularly within modules handling sensitive financial operations and data management functions.