OneShield Policy Framework up to 5.1.9 Log Header/Form Element Poison injection

Summaryinfo

A vulnerability has been found in OneShield Policy Framework up to 5.1.9 and classified as critical. Affected by this issue is some unknown functionality of the component Log Handler. Performing a manipulation as part of Header/Form Element results in injection (Poison). This vulnerability is reported as CVE-2019-11642. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in OneShield Policy Framework up to 5.1.9. This affects an unknown part of the component Log Handler. The manipulation as part of a Header/Form Element leads to a injection vulnerability (Poison). CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging console. This is predicated on the debugging console and Java Bean being made available to the deployed application.

The bug was discovered 05/01/2019. The weakness was disclosed 05/08/2019. This vulnerability is uniquely identified as CVE-2019-11642 since 05/01/2019. It is possible to initiate the attack remotely. A authentication is necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 5.1.10 eliminates this vulnerability.

The entry VDB-134488 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• OneShield

Name

• Policy Framework

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion