Improper Restriction of XML External Entity Reference in BVMS

Advisory Information

• Advisory ID: BOSCH-SA-506619-BT
• CVE Numbers and CVSS v3.1 Scores:
  • CVE-2018-1285
    • Base Score: 9.8 (Critical)
• Published: 16 Mar 2022
• Last Updated: 16 Mar 2022

Summary

When BVMS is installed in an installation folder where low-priviledged users have write access, BVMS is affected by a security vulnerability, which potentially allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Bosch rates the vulnerability with a CVSS v3.1 Base Score of 5.7 (Medium) when the BVMS is installed in default location.

Bosch recommends customers to follow the least priviledge-approach for user permissions in the BVMS installation folder.

Affected Products

• Bosch BVMS <= 9.0.0
• Bosch BVMS 10.0 <= 10.0.2
• Bosch BVMS 10.1 <= 10.1.1
• Bosch BVMS 11.0 <= 11.1.0
• Bosch DIVAR IP 7000 R2
• Bosch DIVAR IP all-in-one 5000
• Bosch DIVAR IP all-in-one 7000

Solution and Mitigations

Install BVMS into a directory where low-privileged OS users do not have write permissions

BVMS relies on its installation directory to be trustworthily protected against modification by non-administrators. When BVMS is installed in the default location %ProgramFiles%, the vulnerability can only be exploited when an attacker already possesess administrative priviliges in the OS prior to the actual attack.

Bosch strongly recommends not to install BVMS into a directory where low-privileged OS users have write permissions.

Vulnerability Details

CVE-2018-1285

CVE description: Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

• Problem Type:
  • CWE-611
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Base Score: 9.8 (Critical)

Remarks

Security Update Information

With respect to Directive (EU) 2019/770 and Directive (EU) 2019/771 and their national transposition laws, please note:

It is your responsibility to download and/or install any security updates provided by us, for example to maintain product or data security. If you fail to install a security update provided to you within a reasonable period of time, we will not be liable for any product defect solely due to the absence of such security update.

Alternatively, we are entitled to directly download and/or install security updates regardless of your settings. In these cases, we will provide you with the relevant information, e.g. in this security advisory.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system . The CVSS environmental score is specific to each customer’s environment and should be defined by the customer to attain a final scoring.

Additional Resources

• [1] Third Party Supplier Advisory: https://issues.apache.org/jira/browse/LOG4NET-575
• [2] CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-1285

Please contact the Bosch PSIRT if you have feedback, comments, or additional information about this vulnerability at: psirt@bosch.com .

Revision History

• 16 Mar 2022: Initial Publication

Appendix

Modified CVSS Score

CVSS Base Score: 5.7 (Medium) CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Affected Products

Material Lists

BVMS

Bosch DIVAR IP 7000 R2

Bosch DIVAR IP all-in-one 5000

Bosch DIVAR IP all-in-one 7000

DIVAR IP all-in-one 7000 R3