CVE-2018-19234

Vulnerability

The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before version 2.0 does not validate update packages, enabling an attacker to supply a malicious update. Additionally, the application uses a hardcoded AES-256 key and initialization vector to encrypt credentials, which can be extracted to decrypt the password for a remote server [1]. This allows an attacker to upload arbitrary files to the server, including a replacement update package. Affected versions are all builds prior to 2.0 [1][2].

Exploitation

An attacker with network access to the update service can craft a malicious update package and deliver it to the agent. Alternatively, by decompiling the agent binary to obtain the hardcoded AES key and IV, the attacker can decrypt credentials used for file uploads [1]. The attacker can then upload a tampered update to the server, which is subsequently distributed to all agents that install updates from that server [1]. No authentication is required to interact with the update service, and user interaction is not needed for the update installation [1][2].

Impact

Successful exploitation allows remote code execution with SYSTEM privileges on the target machine. The attacker gains full control over the affected system, including the ability to install programs, view/change/delete data, or create new accounts with full user rights [1][2].

Mitigation

COMPAREX released a patch in version 2.0 that addresses this vulnerability. Users should upgrade to the latest version immediately [1]. No workaround is available for unpatched versions. The vendor has not listed this CVE in CISA's Known Exploited Vulnerabilities catalog at the time of writing.