H2 Console Authentication Bypass in Northstar

Executive Summary

This vulnerability is an unauthenticated remote code execution (RCE) flaw in Northstar, a quantitative trading platform, affecting versions up to 9.1.1. The H2 Console is enabled with default credentials (username 'sa' and empty password) and is accessible without authentication due to an incomplete auth interceptor. Attackers can exploit this by accessing the H2 Console, logging in with default credentials, creating a command-execution alias via 'CREATE ALIAS', and running arbitrary system commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the H2 Console is accessible on your network. Use commands like 'curl -v http://<target-ip>:<port>/h2-console' or 'nmap -p <port> --script http-vuln-cve2016-6665 <target-ip>' to identify exposed H2 Console instances. Verify if authentication is required by attempting to access '/h2-console' without credentials.

• Check if the H2 Console is enabled by inspecting Northstar configuration files for 'h2-console' settings.
• Test default credentials by logging in with username 'sa' and an empty password.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any network-reachable attacker to execute arbitrary system commands on the affected system without authentication. The attacker can gain control of the system running Northstar, potentially leading to data theft, system compromise, or further network infiltration. The impact is severe as it enables full control over the vulnerable system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. It exposes sensitive data to attackers, potentially resulting in legal penalties, loss of customer trust, and regulatory fines due to inadequate security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the H2 Console by modifying Northstar configuration to remove or comment out H2 Console-related settings. Ensure the application binds to localhost only and not to all network interfaces.

• Change the default 'sa' user password to a strong, unique value if the H2 Console must remain enabled.
• Update Northstar to a version that fixes the incomplete auth interceptor issue.
• Restrict network access to the H2 Console port using firewalls or network segmentation.

Useful 0 Not Useful 0