CVE-2017-10816
📋 TL;DR
This is a critical SQL injection vulnerability in MaLion for Windows and Mac versions 5.0.0 to 5.2.1. Remote attackers can execute arbitrary SQL commands via the Relay Service Server, potentially leading to complete system compromise. Organizations using affected MaLion versions are at risk.
💻 Affected Systems
- MaLion for Windows
- MaLion for Mac
📦 What is this software?
Malion by Intercom
Malion by Intercom
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover, data exfiltration, lateral movement within network, and persistent backdoor installation.
Likely Case
Database compromise, credential theft, and unauthorized access to sensitive information stored in MaLion systems.
If Mitigated
Limited impact with proper network segmentation, database permissions, and input validation controls in place.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with readily available tools. The CVSS 9.8 score indicates trivial exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.2 or later
Vendor Advisory: http://www.intercom.co.jp/information/2017/0801.html
Restart Required: Yes
Instructions:
1. Download MaLion version 5.2.2 or later from official vendor site. 2. Stop MaLion services. 3. Install the updated version. 4. Restart services. 5. Verify successful update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate MaLion Relay Service Server from untrusted networks and internet access
Database Permission Reduction
allLimit database user permissions to minimum required functionality
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure of Relay Service Server
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check MaLion version in application settings or installation directory. Versions 5.0.0 through 5.2.1 are vulnerable.Check Version:
Check application About menu or installation propertiesVerify Fix Applied:
Confirm MaLion version is 5.2.2 or later. Test Relay Service Server functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts
- Unexpected database schema changes
Network Indicators:
- SQL syntax patterns in network traffic to Relay Service Server
- Unusual outbound database connections
SIEM Query:
source="malion_logs" AND (sql OR injection OR UNION OR SELECT*)