Multiple vulnerabilities in IBM App Connect Enterprise

Published: 2023-09-12 | Updated: 2024-10-25

Risk	Critical
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2023-36665 CVE-2023-37903 CVE-2023-37466 CVE-2023-26115
CWE-ID	CWE-1321 CWE-254 CWE-1333
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #3 is available.
Vulnerable software	IBM App Connect Enterprise Universal components / Libraries / Software for developers
Vendor	IBM Corporation

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Prototype pollution

EUVDB-ID: #VU78870

Risk: Critical

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Red]

CVE-ID: CVE-2023-36665

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pollute the prototype of Object.prototype by adding and overwriting its data and functions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM App Connect Enterprise: 12.0.1.0 - 12.0.9.0

CPE2.3

External links

https://www.ibm.com/support/pages/node/7031624

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security features bypass

EUVDB-ID: #VU79504

Risk: Medium

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-37903

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to unspecified error. An attacker with code execution primitive inside the context of vm2 sandbox can use the Node.js custom inspect function to escape the sandbox and run arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM App Connect Enterprise: 12.0.1.0 - 12.0.9.0

CPE2.3

External links

https://www.ibm.com/support/pages/node/7031624

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security features bypass

EUVDB-ID: #VU80135

Risk: High

CVSSv4.0: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2023-37466

CWE-ID: CWE-254 - Security Features

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of user-supplied input within the Promise handler. A remote attacker can pass specially crafted data to the application, bypass sanitization with `@@species` accessor property to escape the sandbox and run arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM App Connect Enterprise: 12.0.1.0 - 12.0.9.0

CPE2.3

External links

https://www.ibm.com/support/pages/node/7031624

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Inefficient regular expression complexity

EUVDB-ID: #VU79799

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-26115

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM App Connect Enterprise: 12.0.1.0 - 12.0.9.0

CPE2.3

External links

https://www.ibm.com/support/pages/node/7031624

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.