Horizon Business Services Caterease up to 24.0.1.2405 SQL User hard-coded password

Summaryinfo

A vulnerability was found in Horizon Business Services Caterease up to 24.0.1.2405. It has been classified as critical. This affects an unknown function of the component SQL User Handler. Performing a manipulation results in hard-coded password. This vulnerability is cataloged as CVE-2024-38885. The attack must originate from the local network. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software). This affects an unknown code block of the component SQL User Handler. The manipulation with an unknown input leads to a hard-coded password vulnerability. CWE is classifying the issue as CWE-259. The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform unauthorized access using known operating system credentials due to hardcoded SQL user credentials in the client application.

The bug was discovered 04/11/2024. The weakness was shared by Calvin Star (Skelet4r) with jTag Labs as security advisory (VulDB). The vendor cooperated in the coordination of the public release. Caterease contains hardcoded SQL user credentials within the client application. These credentials are embedded in the software and are identical across all instances of the application, making them a single point of failure. Attackers who gain access to the client application can easily extract these hardcoded credentials and use them to log in to any Caterease SQL database. This vulnerability is uniquely identified as CVE-2024-38885 since 06/21/2024. The exploitability is told to be easy. Access to the local network is required for this attack. No form of authentication is needed for exploitation. Technical details are unknown but a private exploit is available. MITRE ATT&CK project uses the attack technique T1078.001 for this issue.

A private exploit has been developed by Skelet4r in Python. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 113 days. During that time the estimated underground price was around . Although an exploit is not currently publicly available, a proof-of-concept exploit has been developed by Skelet4r and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. Exploiting this vulnerability can be achieved through various attack vectors that leverage the hard-coded credentials in the client application. One effective method involves spoofing a SQL Server connection and turning off encryption support to force the Caterease client into transmitting the credentials in clear text. By setting up a rogue SQL Server and intercepting the client's connection attempt, an attacker can capture the transmitted credentials. Once the hard-coded credentials are extracted, they can be used to gain unauthorized access to any Caterease SQL database.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383225: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-259: Use of Hard-coded Password (by jTag Labs)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion