CVE-2017-3221
📋 TL;DR
CVE-2017-3221 is a blind SQL injection vulnerability in the Inmarsat AmosConnect 8 login form that allows remote attackers to extract user credentials, including usernames and passwords. This affects organizations using Inmarsat AmosConnect 8 for satellite communications. Attackers can exploit this without authentication to gain access to sensitive login credentials.
💻 Affected Systems
- Inmarsat AmosConnect 8
📦 What is this software?
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
Amosconnect 8 by Inmarsat
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts, unauthorized access to satellite communication systems, potential data exfiltration, and lateral movement within the network.
Likely Case
Credential theft leading to unauthorized access to AmosConnect systems, potential email and communication interception, and privilege escalation within the application.
If Mitigated
Limited impact with proper network segmentation, credential monitoring, and application firewalls blocking SQL injection attempts.
🎯 Exploit Status
SQL injection in login form allows credential extraction without authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - contact Inmarsat for updates
Vendor Advisory: http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/
Restart Required: Yes
Instructions:
1. Contact Inmarsat support for security patches
2. Apply the provided security update
3. Restart AmosConnect services
4. Verify the fix by testing for SQL injection
🔧 Temporary Workarounds
Web Application Firewall
allDeploy WAF with SQL injection protection rules
Network Segmentation
allRestrict access to AmosConnect interface to trusted networks only
🧯 If You Can't Patch
- Implement strong network segmentation to isolate AmosConnect from untrusted networks
- Deploy a web application firewall with SQL injection detection and blocking rules
🔍 How to Verify
Check if Vulnerable:
Test login form with SQL injection payloads like ' OR '1'='1Check Version:
Check AmosConnect version in application interface or contact Inmarsat supportVerify Fix Applied:
Retest with SQL injection payloads after patch application - should return proper error messages or reject input📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL-like patterns
- Successful logins from unexpected IP addresses
Network Indicators:
- SQL injection patterns in HTTP POST requests to login endpoint
- Unusual outbound database connections
SIEM Query:
source="amosconnect.log" AND ("sql" OR "injection" OR "syntax" OR "union" OR "select")🔗 References
- http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/
- http://www.securityfocus.com/bid/99899
- https://twitter.com/mkolsek/status/923988845783322625
- https://www.kb.cert.org/vuls/id/586501
- http://www.inmarsat.com/news/inmarsat-response-to-ioactive-claims/
- http://www.securityfocus.com/bid/99899
- https://twitter.com/mkolsek/status/923988845783322625
- https://www.kb.cert.org/vuls/id/586501
