ConnectWise Automate up to 2019.11/2020.6 INSERT Statement sql injection

Summaryinfo

A vulnerability, which was classified as critical, was found in ConnectWise Automate up to 2019.11/2020.6. Impacted is an unknown function. Such manipulation as part of INSERT Statement leads to sql injection. This vulnerability is uniquely identified as CVE-2020-15008. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in ConnectWise Automate up to 2019.11/2020.6 (Network Management Software) and classified as critical. Affected by this issue is some unknown functionality. The manipulation as part of a INSERT Statement leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.

The weakness was disclosed 07/07/2020 (Website). The advisory is shared for download at slagle.tech. This vulnerability is handled as CVE-2020-15008 since 06/24/2020. The attack may be launched remotely. A simple authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 2019.12 or 2020.7 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Network Management Software

Vendor

• ConnectWise

Name

• Automate

Version

• 2019.0
• 2019.1
• 2019.2
• 2019.3
• 2019.4
• 2019.5
• 2019.6
• 2019.7
• 2019.8
• 2019.9
• 2019.10
• 2019.11
• 2020.0
• 2020.1
• 2020.2
• 2020.3
• 2020.4
• 2020.5
• 2020.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion