Horizon Business Services Caterease up to 24.0.1.2405 TDS7 PreLogin Authentication downgrade

Summaryinfo

A vulnerability has been found in Horizon Business Services Caterease up to 24.0.1.2405 and classified as critical. The affected element is an unknown function of the component TDS7 PreLogin Authentication. This manipulation causes downgrade. This vulnerability is tracked as CVE-2024-38883. The attack is only possible within the local network. Moreover, an exploit is present.

Detailsinfo

A vulnerability classified as problematic was found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software). Affected by this vulnerability is an unknown part of the component TDS7 PreLogin Authentication. The manipulation with an unknown input leads to a downgrade vulnerability. The CWE definition for the vulnerability is CWE-757. A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. As an impact it is known to affect confidentiality. The summary by CVE is:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Drop Encryption Level attack due to the selection of a less-secure algorithm during negotiation.

The bug was discovered 04/11/2024. The weakness was disclosed by Calvin Star (Skelet4r) with jTag Labs as security advisory (VulDB). The public release has been coordinated in cooperation with Horizon Business Services. Caterease does not enforce encryption during the TDS7 PreLogin authentication sequence, making it susceptible to a downgrade attack. Attackers can intercept the initial handshake between the Caterease client and the SQL server and manipulate the server's response to indicate that encryption is not supported. As a result, the client will proceed to send sensitive information, including database credentials, in plaintext over the network. This also makes the TCP stream between the client and server susceptible to other attacks because encryption is no longer supported. This vulnerability is known as CVE-2024-38883 since 06/21/2024. The exploitation appears to be difficult. The attack needs to be done within the local network. The exploitation doesn't need any form of authentication. Technical details are unknown but a private exploit is available. The attack technique deployed by this issue is T1562.010 according to MITRE ATT&CK.

A private exploit has been developed by Skelet4r in Python. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 113 days. During that time the estimated underground price was around . Although an exploit is not currently publicly available, a proof-of-concept exploit has been developed by Skelet4r and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. To exploit this vulnerability, an attacker can manipulate the TDS7 PreLogin authentication sequence to force a downgrade of the encryption level. By intercepting and modifying the server's response to indicate that encryption is not supported, the attacker can cause the client to send credentials in cleartext. This can be done using network interception tools and custom scripts to alter the communication between the client and server, exposing sensitive information such as SQL user credentials.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383223: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-757: Selection of Less-Secure Algorithm During Negotiation ( (by jTag Labs)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion