Critical Security Vulnerabilities Identified in Sage X3 Enterprise Management Software

Published: July 8, 2021

Recent research has revealed four significant security vulnerabilities in Sage X3’s enterprise resource planning (ERP) software. Two of these vulnerabilities can potentially be combined to facilitate an attack, allowing malicious actors to execute harmful commands and gain control over compromised systems. These issues were identified by researchers at Rapid7, who reported their findings to Sage Group on February 3, 2021. In response, the company has released patches for various versions of Sage X3, including Version 9 (Syracuse 9.22.7.2), Sage X3 HR & Payroll Version 9 (Syracuse 9.24.1.3), Version 11 (Syracuse 11.25.2.6), and Version 12 (Syracuse 12.10.2.8) in March. The identified vulnerabilities include:

  • CVE-2020-7388 (CVSS score: 10.0): Unauthenticated Remote Command Execution (RCE) as SYSTEM in the AdxDSrv.exe component.
  • CVE-2020-7389 (CVSS score: 5.5): System “CHAINE” Variable Script Command Injection (No fix planned).

Sage X3 Enterprise Management Software Exposed to Critical Vulnerabilities

On July 8, 2021, it was reported that four significant security vulnerabilities have been identified within the Sage X3 enterprise resource planning (ERP) software suite. Two of these vulnerabilities are particularly concerning, as they can potentially be exploited in tandem to facilitate attacks that allow malicious actors to execute unauthorized commands and gain control over affected systems.

The vulnerabilities were uncovered by researchers from Rapid7, who disclosed their findings to Sage Group on February 3, 2021. In the wake of this revelation, Sage Group has implemented patches across various releases of the Sage X3 software. These updates were released in March for Sage X3 Version 9 (Syracuse 9.22.7.2), Sage X3 HR & Payroll Version 9 (Syracuse 9.24.1.3), Sage X3 Version 11 (Syracuse 11.25.2.6), and Sage X3 Version 12 (Syracuse 12.10.2.8).

Among the vulnerabilities reported, one stands out with a Common Vulnerability Scoring System (CVSS) score of 10.0, indicating a critical risk. This vulnerability, identified as CVE-2020-7388, involves an unauthenticated remote command execution (RCE) flaw, allowing attackers to run commands with SYSTEM privileges within the AdxDSrv.exe component. The second vulnerability, CVE-2020-7389, carries a CVSS score of 5.5 and pertains to a script command injection issue related to a system variable known as “CHAINE.” No plans for a fix have been announced for this particular vulnerability.

These findings raise alarms regarding the potential impact on businesses utilizing the Sage X3 ERP system, particularly in the context of cybersecurity risk management. The targeted software is utilized by a wide array of organizations, meaning that companies across sectors could be at risk if these vulnerabilities are not addressed.

The implications of these vulnerabilities fall within the scope of several tactics outlined in the MITRE ATT&CK framework. For instance, the initial access and privilege escalation techniques may be relevant in understanding how attackers could penetrate a system and elevate their privileges to a level required for executing harmful commands. Persistent access could also be a concern, as cybercriminals frequently look to maintain a foothold within compromised environments to exfiltrate data or launch further attacks.

Organizations utilizing Sage X3 are strongly urged to evaluate their systems and apply the latest available patches to mitigate potential threats. Such proactive measures are essential in safeguarding operations and maintaining the integrity of organizational data amid an evolving landscape of cybersecurity challenges. Addressing these vulnerabilities not only protects sensitive information but also reinforces trust with clients and partners in an increasingly digital business environment.

Source link

Related Posts

Significant Vulnerabilities Identified in Philips Vue PACS Medical Imaging Systems

Date: July 9, 2021

A series of security vulnerabilities have been revealed in the Philips Clinical Collaboration Platform Portal (commonly known as Vue PACS). Some of these vulnerabilities could potentially be exploited by malicious actors to gain control over affected systems. According to a warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), “Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or compromise system data integrity, thereby threatening the confidentiality, integrity, or availability of the system.”

These 15 vulnerabilities affect the following systems:

  • VUE Picture Archiving and Communication Systems (versions 12.2.x.x and earlier)
  • Vue MyVue (versions 12.2.x.x and earlier)
  • Vue Speech (versions 12.2.x.x and earlier)
  • Vue Motion (versions 12.2.1.5 and earlier)

Notably, four specific issues (CVE-2020-1938, CVE-2018-12326, CVE-2018-11218, CVE-2020-4670, and CVE-2018-8014) have been assigned a Critical rating.

Urgent: Critical RCE Vulnerability in ForgeRock Access Manager Under Active Exploitation

Cybersecurity agencies in Australia and the U.S. are sounding the alarm about a serious vulnerability in ForgeRock’s OpenAM access management system, which is being actively exploited to execute remote code on compromised systems. The Australian Cyber Security Centre (ACSC) has reported that threat actors are leveraging this flaw to infiltrate multiple hosts, deploying additional malware and tools. However, details regarding the nature and scope of the attacks, as well as the identities of the perpetrating actors, remain undisclosed.

Identified as CVE-2021-35464, this vulnerability is a pre-authentication remote code execution (RCE) flaw linked to unsafe Java deserialization in the Jato framework used by ForgeRock Access Manager. Exploiting this vulnerability allows attackers to execute commands within the context of the current user rather than as a root user.

Critical Windows Update: Address 117 Security Flaws, Including 9 Active Zero-Days

July 14, 2021

Microsoft has released its July Patch Tuesday updates, addressing a total of 117 security vulnerabilities, among which are nine zero-day flaws—four of which are currently being exploited in the wild, potentially allowing attackers to gain control of affected systems. Out of these vulnerabilities, 13 are classified as Critical, 103 as Important, and one as Moderate in severity. Notably, six of these vulnerabilities were publicly known at the time of the update.

The updates affect a wide range of Microsoft products, including Windows, Bing, Dynamics, Exchange Server, Office, the Scripting Engine, Windows DNS, and Visual Studio Code. This month saw a significant increase in the number of vulnerabilities patched, surpassing the totals from May (55) and June (50).

Among the most critical actively exploited vulnerabilities are:

  • CVE-2021-34527 (CVSS Score: 8.8) – Windows Print Spooler Remote Code Execution…

Microsoft Alerts Users to Unpatched Vulnerability in Windows Print Spooler

On July 16, 2021, Microsoft issued new guidance about a vulnerability in the Windows Print Spooler service, stating that it is working on a fix for an upcoming security update. Identified as CVE-2021-34481 (CVSS score: 7.8), this local privilege escalation flaw can be exploited for unauthorized actions on affected systems. The vulnerability was discovered and reported by security researcher Jacob Baines.

According to Microsoft’s advisory, “An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploits this vulnerability could execute arbitrary code with SYSTEM privileges.” This would allow them to install software, access, modify, or delete data, and create new accounts with full user rights. It is important to note that successful exploitation requires the attacker to have specific conditions met.