Superadmin Credentials Stored as Non-Salted MD5 Hash in R-SOFT DMS

Executive Summary

The vulnerability in R-SOFT DMS involves the storage of superadmin credentials using a non-salted nested MD5 hash. This weak hashing method allows an attacker who obtains the password hash to decode the superadmin credentials. Additionally, the superadmin password cannot be changed except by modifying the configuration file, which increases the risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the storage of superadmin credentials using a non-salted nested MD5 hash in R-SOFT DMS. Detection would involve identifying the presence of these hashed credentials in the system configuration files.

Since the password hash is stored in the configuration file and cannot be changed except by modifying this file, inspecting the configuration files for such hashes is a key step.

A suggested command to detect the presence of MD5 hashes in configuration files on a Unix-like system could be:

• grep -rE '[a-f0-9]{32}' /path/to/r-soft/dms/config/

This command recursively searches for 32-character hexadecimal strings (typical of MD5 hashes) in the configuration directory of R-SOFT DMS.

Additionally, monitoring network traffic for unauthorized access attempts or unusual activity related to superadmin credentials could help detect exploitation attempts, but specific network detection commands are not provided in the available information.

Useful 0 Not Useful 0

Impact Analysis

An attacker who exploits this vulnerability can decode the superadmin credentials, potentially gaining unauthorized full administrative access to the R-SOFT DMS system. This could lead to unauthorized data access, system manipulation, and compromise of sensitive information.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves storing superadmin credentials using a non-salted nested MD5 hash, which allows attackers to decode these credentials if they obtain the password hash. This weak credential storage and inability to change the password except by modifying the configuration file can lead to unauthorized access.

Such unauthorized access and weak credential protection can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strong access controls and protection of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability can be mitigated by upgrading R-SOFT DMS to version v3.17-2000 or later, where the issue has been fixed.

Since the superadmin password cannot be changed except by modifying the configuration file, immediate mitigation involves applying the update and reviewing configuration file security to prevent unauthorized access.

Useful 0 Not Useful 0