SB2020092410 - Multiple vulnerabilities in Ozeki NG SMS Gateway

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020092410

SB2020092410 - Multiple vulnerabilities in Ozeki NG SMS Gateway

Published: September 24, 2020

Security Bulletin ID SB2020092410
Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

High 40% Medium 40% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2020-14023)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the SMS WCF and RSS To SMS modules. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


2) Cross-site scripting (CVE-ID: CVE-2020-14024)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the Receiver and Recipient fields in the Mailbox feature, via the OZFORM_GROUPNAME field in the Group configuration of addresses, via the listname field in the Defining address lists configuration, and via any GET Parameter passed to the /default URL of the application. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


3) Cross-site request forgery (CVE-ID: CVE-2020-14025)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as installing new modules or changing a password.


4) CSV Injection (CVE-ID: CVE-2020-14026)

The vulnerability allows a remote attacker to inject arbitrary code into CSV files.

The vulnerability exists due to improper input validation within the in the Export Of Contacts feature. A remote user can inject arbitrary code into a CSV file.



5) Input validation error (CVE-ID: CVE-2020-14027)

The vulnerability allows a remote attacker to compromise the application.

The vulnerability exists due to the database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE. A remote attacker can force the application to connect to a database server under attacker control and gain full access to the application.


6) Path traversal (CVE-ID: CVE-2020-14028)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the Autoreply module. A remote attacker can send a specially crafted HTTP request and overwrite arbitrary files on the system with SYSTEM privileges.

Successful exploitation of the vulnerability may result in a complete system compromise.


7) Path traversal (CVE-ID: CVE-2020-14031)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the TXT File module. A remote user can send a specially crafted HTTP request and delete arbitrary files on the system with SYSTEM privileges.


8) Path traversal (CVE-ID: CVE-2020-14021)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the The ASP.net SMS module. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.


9) XML External Entity injection (CVE-ID: CVE-2020-14029)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the RSS To SMS module. A remote user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


10) Arbitrary file upload (CVE-ID: CVE-2020-14022)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file when importing contacts via the "Import Contacts" functionality. A remote user can upload a .bat file and execute it on the server.


Remediation

Install update from vendor's website.

References