CERT-In Vulnerability Note
CIVN-2024-0332
Multiple Vulnerabilities in Brokerage Technology Solutions Front Office Products
Original Issue Date:November 04, 2024
Severity Rating: HIGH
Systems Affected
- Wave 2.0 - all versions prior to 1.1.7
- Aero - all versions prior to 120820241550
Overview
Multiple vulnerabilities have been reported in Brokerage Technology Solutions Front Office products, which could allow a remote attacker to perform brute force attack, authentication bypass or gain unauthorized access to sensitive information of other user accounts.
Target Audience
End-users of Brokerage Technology Solutions Front Office products.
Risk Assessment
High risk of unauthorized access, data breaches and potential financial losses.
Impact Assessment
Unauthorized access to sensitive user information, data breaches and compromised user accounts.
Description
Wave 2.0 and Aero are front office solutions developed by Brokerage Technology Solutions capable of trading by stock brokerage firms and dealers.
1. Sensitive Information Disclosure Vulnerability
(
CVE-2024-51556
)
This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensitive information belonging to other users.
2. No Rate Limiting Vulnerability
(
CVE-2024-51557
)
This vulnerability exists in Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
3. Brute Force Attack Vulnerability
(
CVE-2024-51558
)
This vulnerability exists in Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.
4. Improper Access Control Vulnerability
(
CVE-2024-51559
)
This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts.
5. Improper Error Handling Vulnerability
(
CVE-2024-51560
)
This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for "userId" parameter in the API request leading to generation of error message containing sensitive information on the targeted system.
6. Authentication bypass Vulnerability
(
CVE-2024-51561
)
This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process.
Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for accessing other user accounts.
Credit
These vulnerabilities are reported by Mohit Gadiya.
Solution
- Upgrade Wave 2.0 to version 1.1.7
- Upgrade Aero to version 120820241550
Vendor Information
Brokerage Technology Solutions
https://brokeragetechnologysolutions.63moons.com/products/front-office/#wave2
References
Brokerage Technology Solutions
https://brokeragetechnologysolutions.63moons.com/products/front-office/#wave2
CVE Name
CVE-2024-51556
CVE-2024-51557
CVE-2024-51558
CVE-2024-51559
CVE-2024-51560
CVE-2024-51561
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|