Horizon Business Services Caterease up to 24.0.1.2405 cleartext transmission

Summaryinfo

A vulnerability marked as problematic has been reported in Horizon Business Services Caterease up to 24.0.1.2405. This vulnerability affects unknown code. Performing a manipulation results in cleartext transmission. This vulnerability is known as CVE-2024-38891. Access to the local network is required for this attack. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software). This affects an unknown code. The manipulation with an unknown input leads to a cleartext transmission vulnerability. CWE is classifying the issue as CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. This is going to have an impact on confidentiality. The summary by CVE is:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffing Network Traffic attack due to the cleartext transmission of sensitive information.

The bug was discovered 04/06/2024. The weakness was published by Calvin Star (Skelet4r) with jTag Labs as security advisory (VulDB). The public release has been coordinated with Horizon Business Services. Caterease leaks sensitive information, including user details, client details, database details, and software license keys, in cleartext during the application's startup phase. This vulnerability arises because the application transmits this information without encryption, making it vulnerable to interception by attackers using network sniffing tools. The lack of encryption during data transmission severely compromises the confidentiality of the transmitted information. This vulnerability is uniquely identified as CVE-2024-38891 since 06/21/2024. The exploitability is told to be difficult. The attack needs to be initiated within the local network. No form of authentication is needed for exploitation. Technical details are unknown but a private exploit is available. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

A private exploit has been developed by Skelet4r. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 118 days. During that time the estimated underground price was around . A proof-of-concept exploit has been developed by Skelet4r and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. Although a dedicated exploit is not currently publicly available for CVE-2024-38891, exploiting this vulnerability is straightforward and can be achieved using common "off the shelf" network sniffing tools such as Tshark. An attacker can use these tools to capture network traffic during the application's startup phase, where sensitive data is transmitted in cleartext. By running Tshark, an attacker can monitor the network for packets containing unencrypted information such as names, emails, password hashes, and license keys.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383232: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-319: Cleartext Transmission of Sensitive Information (by jTag Labs)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion