Blue Prism Robotic Process Automation 6.4.0.8445 Access Control AutomateAppCore.dll access control

Summaryinfo

A vulnerability was found in Blue Prism Robotic Process Automation 6.4.0.8445 and classified as critical. Affected is an unknown function in the library AutomateAppCore.dll of the component Access Control. The manipulation results in access control. This vulnerability is reported as CVE-2019-11875. The attack can be launched remotely. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Blue Prism Robotic Process Automation 6.4.0.8445 (Automation Software). Affected is an unknown code in the library AutomateAppCore.dll of the component Access Control. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user account to connect to the Blue Prism server, but the roles associated to this account are not required to have any permissions. First of all, the application files are modified to grant full permissions on the client side. In a test environment (or his own instance of the software) an attacker is able to grant himself full privileges also on the server side. He can then, for instance, create a process with malicious behavior and export it to disk. With the modified client, it is possible to import the exported file as a release and overwrite any existing process in the database. Eventually, the bots execute the malicious process. The server does not check the user's permissions for the aforementioned actions, such that a modification of the client software enables this kind of attack. Possible scenarios may involve changing bank accounts or setting passwords.

The bug was discovered 01/30/2019. The weakness was disclosed 05/22/2019 as confirmed mailinglist post (Bugtraq). The advisory is shared for download at seclists.org. The public release has been coordinated in cooperation with the vendor. This vulnerability is traded as CVE-2019-11875 since 05/10/2019. It is possible to launch the attack remotely. A authentication is needed for exploitation. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1068.

After 2 days, there has been an exploit disclosed. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 100 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Automation Software

Vendor

• Blue Prism

Name

• Robotic Process Automation

Version

• 6.4.0.8445

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion