Horizon Business Services Caterease up to 24.0.1.2405 SQL User unnecessary privileges

Summaryinfo

A vulnerability was found in Horizon Business Services Caterease up to 24.0.1.2405. It has been rated as problematic. Affected is an unknown function of the component SQL User Handler. The manipulation leads to unnecessary privileges. This vulnerability is documented as CVE-2024-38887. The attack requires being on the local network. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software) and classified as critical. This issue affects an unknown function of the component SQL User Handler. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. Using CWE to declare the problem leads to CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges.

The bug was discovered 04/27/2024. The weakness was released by Calvin Star (Skelet4r) with jTag Labs as security advisory (VulDB). The public release was coordinated with Horizon Business Services. Caterease grants excessive privileges to the default Caterease SQL user by making this user a member of the dbo role in the SQL database. This role grants full administrative access not only to the Caterease database but also to all other databases within the SQL server. This misconfiguration means that any action performed by the Caterease client, regardless of the actual user's privileges within the application, is executed with administrative-level permissions in the SQL database. The identification of this vulnerability is CVE-2024-38887 since 06/21/2024. The exploitation is known to be easy. The attack needs to approached within the local network. Technical details are unknown but a private exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/21/2024). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A private exploit has been developed by Skelet4r in Python. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 96 days. During that time the estimated underground price was around . Although a dedicated exploit is not currently publicly available for CVE-2024-38887, a proof-of-concept exploit has been developed by Skelet4r and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. Exploiting this vulnerability involves leveraging the excessive privileges granted to the default SQL user, 'Caterease,' which operates with dbo permissions. Every Caterease user, regardless of their front-end permissions, utilizes this same SQL user on the server side. This means that it is only the front-end application preventing certain actions. By bypassing the front-end and directly sending commands, an attacker can execute any action with the elevated privileges of the Caterease SQL user. To perform this exploit, an attacker can analyze the TCP stream between the client and the server to identify the sequence and acknowledgment numbers. By creating custom packets with the correct SEQ and ACK numbers and using tools like Python with libraries such as Scapy or Socket, the attacker can inject malicious commands into the stream. These commands will be executed with the elevated dbo permissions, allowing the attacker to perform actions that the original Caterease user should not be able to do, such as modifying or deleting data, creating new users, or altering database structures.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383227: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-250: Execution with Unnecessary Privileges (by jTag Labs)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion