ICU Scandinavia Boomerang Credential Exposure via HTTP

Executive Summary

ICU Scandinavia Boomerang has an information disclosure vulnerability where sensitive credential files are exposed via static HTTP. An unauthenticated remote attacker can retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access plaintext credentials for service accounts and SMTP servers. This could lead to unauthorized access to systems, data breaches, or further exploitation of connected services.

Useful 0 Not Useful 0

Compliance Impact

Exposure of credentials may violate compliance requirements for data protection and security. Systems handling sensitive data must protect credentials to meet standards like GDPR and HIPAA, and this vulnerability undermines those requirements.

Useful 0 Not Useful 0

Detection Guidance

Check for exposed XML files in the webroot by accessing paths like /config.xml or /credentials.xml via HTTP. Use tools like curl or wget to request these files from the server. Example: curl http://<target-ip>/config.xml. Verify if sensitive credentials are visible in plaintext.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Boomerang to version 2.4.18.029 or later immediately. If upgrading is not possible, restrict access to the webroot by blocking external HTTP requests to sensitive paths or disabling static file serving for XML files. Review and rotate any exposed credentials.

Useful 0 Not Useful 0