Horizon Business Services Caterease up to 24.0.1.2405 Profile Name security check

Summaryinfo

A vulnerability was found in Horizon Business Services Caterease up to 24.0.1.2405 and classified as critical. The impacted element is an unknown function of the component Profile Name Handler. Such manipulation leads to security check. This vulnerability is listed as CVE-2024-38884. The attack must be carried out locally. In addition, an exploit is available. Applying the suggested workaround is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software). Affected by this issue is an unknown code of the component Profile Name Handler. The manipulation with an unknown input leads to a security check vulnerability. Using CWE to declare the problem leads to CWE-358. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique. Impacted is confidentiality, and integrity. CVE summarizes:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attack due to improperly implemented security checks for standard authentication mechanisms

The bug was discovered 04/02/2024. The weakness was presented by Austin Henderson (CerebralStud) with jTag Labs as security advisory (VulDB). The public release was coordinated in cooperation with the vendor. Caterease's Active Directory authentication mechanism has improperly implemented security checks, allowing local attackers to bypass authentication. Instead of performing a robust verification with the Active Directory Domain Controller, the application merely checks if the profile name of the acting user matches the Active Directory username set for the Caterease user account. As a result, attackers with the ability to create local profiles can exploit this flaw by creating a local user with the same profile name as any valid Active Directory user. This vulnerability is handled as CVE-2024-38884 since 06/21/2024. The exploitation is known to be easy. The attack needs to be approached locally. Technical details are unknown but a private exploit is available. The MITRE ATT&CK project declares the attack technique as T1211.

A private exploit has been developed by CerebralStud in C#. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 121 days. During that time the estimated underground price was around . Although an exploit is not currently publicly available, a proof-of-concept exploit has been developed by CerebralStud and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. To exploit this vulnerability, an attacker with local privileges can launch the Caterease client application using a local profile with the same name as an Active Directory user. Since the Caterease application improperly authenticates based on profile name alone, the attacker can bypass the Active Directory authentication mechanisms and gain unauthorized access to the Caterease user account that has the Active Directory setting enabled. This can be achieved by creating a new local user on the computer or by launching the application as a different user profile via a script.

The best possible mitigation is suggested to be Workaround. Disable the Active Directory feature for all Caterease user accounts to prevent its use for authentication. This will ensure that only valid authentication methods are used, thereby eliminating the vulnerability caused by improper security checks.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383224: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-358: Improperly Implemented Security Check for Standard (by jTag Labs)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion