Executive Summary

This vulnerability exists in the Industrial Application Software IAS Canias ERP version 8.03, specifically in the doAction function of the RMI Interface component.

The issue arises from improper authentication due to manipulation of the sessionId argument, allowing an attacker to bypass authentication controls.

The attack can be launched remotely, and the exploit has already been made public.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can remotely bypass authentication by manipulating the sessionId parameter.

This could allow unauthorized access to the system without valid credentials.

According to Resource 1, it is possible to retrieve sensitive information about active user sessions, such as session IDs and user names, without authentication.

Such unauthorized access could lead to information disclosure and potential further exploitation within the affected ERP system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to interact with the Canias ERP server's RMI Interface remotely without authentication to retrieve active user session information.

A Java program named GetUserList.java can be used to connect to the Canias ERP server on the default RMI port 27499 and query the remote interface "11000000S2OUT" to fetch active user sessions.

This program requires the canias803.jar library and uses Java RMI to perform the detection.

• Run the GetUserList.java program with the target IP address and port (default 27499) to retrieve active sessions.
• Alternatively, monitor network traffic for unauthorized RMI calls to port 27499 targeting the "11000000S2OUT" interface.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Industrial Application Software IAS Canias ERP 8.03 allows remote attackers to manipulate the sessionId argument, resulting in improper authentication. This can lead to unauthorized access to user session information without proper authentication.

Such unauthorized access to user session data could potentially expose sensitive personal or organizational information, which may violate data protection requirements under regulations like GDPR or HIPAA that mandate strict controls over access to personal and sensitive data.

Because the exploit is publicly known and the vendor has not responded, affected organizations may face increased risk of data breaches, which could lead to non-compliance with these standards and regulations.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability allows remote attackers to manipulate the sessionId argument in the doAction function of the RMI Interface, resulting in improper authentication. Since the exploit is public and the vendor has not responded, immediate mitigation steps should focus on limiting exposure.

• Restrict network access to the RMI service, especially port 27499, to trusted IP addresses only.
• Monitor and log all RMI interface access attempts to detect suspicious activity.
• If possible, disable or block the RMI Interface component until a patch or vendor guidance is available.
• Review active user sessions for any unauthorized access using tools or scripts that interact with the RMI Interface.
• Apply network-level protections such as firewalls or VPNs to limit remote access to the affected system.

Useful 0 Not Useful 0