Kirona Dynamic Resource Scheduler - Information Disclosure

mediumseverity

5.3CVSS score

48.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Kirona Dynamic Resource Scheduler is susceptible to information disclosure. An unauthenticated user can directly access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd), which contains sensitive information with exposed SQL queries, such as database version, table name, and column name.

Impact

Unauthenticated attackers can access sensitive information including database version, table names, and column names through exposed SQL queries, facilitating further SQL injection or database attacks.

Fix

Apply the latest patch or update provided by the vendor to fix the information disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/osm/REGISTER.cmd ; GET {{BaseURL}}/osm_tiles/REGISTER.cmd
Positive when: contains "DEBUGMAPSCRIPT=TRUE" and "@echo off" AND status 200

Run it with nuclei: nuclei -id CVE-2019-17503 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-17503

info:
  name: Kirona Dynamic Resource Scheduler - Information Disclosure
  author: LogicalHunter
  severity: medium
  description: Kirona Dynamic Resource Scheduler is susceptible to information disclosure. An unauthenticated user can directly access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd), which contains sensitive information with exposed SQL queries, such as database version, table name, and column name.
  impact: |
    Unauthenticated attackers can access sensitive information including database version, table names, and column names through exposed SQL queries, facilitating further SQL injection or database attacks.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the information disclosure vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/47498
    - https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities
    - http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17503
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-17503
    cwe-id: CWE-425
    epss-score: 0.48303
    epss-percentile: 0.98875
    cpe: cpe:2.3:a:kirona:dynamic_resource_scheduling:5.5.3.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: kirona
    product: dynamic_resource_scheduling
  tags: cve,cve2019,exposure,edb,packetstorm,kirona,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/osm/REGISTER.cmd"
      - "{{BaseURL}}/osm_tiles/REGISTER.cmd"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "DEBUGMAPSCRIPT=TRUE"
          - "@echo off"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from