CVE-2018-14931 in FT Intellect Core Banking
Summary
by MITRE
An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exists via a /IntellectMain.jsp?IntellectSystem= URI.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/11/2023
The vulnerability identified as CVE-2018-14931 represents a critical security flaw within the Polaris FT Intellect Core Banking 9.7.1 platform, specifically affecting both the Core and Portal modules. This issue manifests as an open redirect vulnerability that can be exploited through a carefully crafted URI path involving the /IntellectMain.jsp?IntellectSystem= endpoint. The vulnerability stems from inadequate input validation and sanitization mechanisms within the application's redirect handling logic, allowing malicious actors to manipulate the redirection flow to arbitrary web addresses.
This open redirect vulnerability falls under the CWE-601 category of URL Redirection to Untrusted Site, which is classified as a medium severity issue in the Common Weakness Enumeration framework. The flaw enables attackers to construct malicious URLs that appear legitimate but redirect users to phishing sites or malicious domains. The specific URI pattern /IntellectMain.jsp?IntellectSystem= provides an entry point where user-supplied parameters are not properly validated before being used in redirect operations. This creates a pathway for attackers to manipulate the system's redirect behavior and potentially execute social engineering attacks against unsuspecting users.
The operational impact of this vulnerability extends beyond simple redirection attacks and can compromise the integrity of the banking application's authentication and authorization mechanisms. When users are redirected to malicious sites through this vulnerability, they may unknowingly provide sensitive information such as login credentials, personal identification numbers, or financial data. The attack surface is particularly concerning in a core banking environment where users frequently access the system for financial transactions and sensitive operations. This vulnerability can be exploited by attackers to harvest credentials, conduct phishing campaigns, or deliver malware through the manipulated redirect mechanisms.
Security professionals should consider this vulnerability in the context of the MITRE ATT&CK framework, specifically under the T1566 technique of Phishing, where open redirect vulnerabilities serve as effective attack vectors for credential theft. The vulnerability's exploitation requires minimal technical skill and can be automated, making it particularly dangerous in environments where users may not be adequately trained to recognize suspicious redirects. Organizations should implement immediate mitigations including input validation for all redirect parameters, explicit URL whitelisting, and comprehensive user education about recognizing potential phishing attempts.
Mitigation strategies for CVE-2018-14931 should focus on implementing strict input validation and sanitization for all parameters used in redirect operations. The system should validate that redirect URLs conform to predetermined trusted domains and reject any external redirects that do not explicitly match the application's legitimate domain or authorized partners. Additionally, implementing a redirect whitelist approach where only known safe URLs are permitted will significantly reduce the attack surface. Organizations should also consider deploying web application firewalls with signature-based detection capabilities to identify and block malicious redirect attempts. Regular security assessments and penetration testing should be conducted to ensure that similar vulnerabilities are not present in other components of the banking application ecosystem, as this type of flaw often indicates broader input validation weaknesses that may affect other modules within the system.