IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

86.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

IBM Planning Analytics versions 2.0.0 through 2.0.8 are vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.

Impact

Attackers can gain admin access and execute arbitrary code with SYSTEM privileges, leading to full system compromise.

Fix

Update to the latest version or 2.0.9 or apply the security patches provided by IBM.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains_any(body, "IBM Planning Analytics","IBM Cognos TM1") and compare_versions(version, '>= 2.0.0') && compare_versions(version, '<= 2.0.8') and status_code == 200

Run it with nuclei: nuclei -id CVE-2019-4716 -u <target>

The full check

id: CVE-2019-4716

info:
  name: IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection
  author: 0x_Akoko
  severity: critical
  description: |
    IBM Planning Analytics versions 2.0.0 through 2.0.8 are vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.
  impact: |
    Attackers can gain admin access and execute arbitrary code with SYSTEM privileges, leading to full system compromise.
  remediation: |
    Update to the latest version or 2.0.9 or apply the security patches provided by IBM.
  reference:
    - https://www.ibm.com/support/pages/node/1127781
    - https://nvd.nist.gov/vuln/detail/CVE-2019-4716
    - http://packetstormsecurity.com/files/156953/IBM-Cognos-TM1-IBM-Planning-Analytics-Server-Configuration-Overwrite-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-4716
    cwe-id: CWE-94
    epss-score: 0.86441
    epss-percentile: 0.99738
    cpe: cpe:2.3:a:ibm:planning_analytics:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ibm
    product: planning_analytics
    shodan-query: title:"Arc for TM1"
  tags: cve,cve2019,ibm,planning_analytics,passive,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "IBM Planning Analytics","IBM Cognos TM1")'
          - "compare_versions(version, '>= 2.0.0') && compare_versions(version, '<= 2.0.8')"
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'var appVersion = "([0-9.]+)";'

References

Use this check only on systems you are authorised to test. Where the data comes from