CVE-2017-6022
📋 TL;DR
This vulnerability involves hard-coded passwords in BD PerformA and KLA Journal Service software, allowing attackers to access the BD Kiestra Database containing protected health and personal information. Affected organizations include healthcare facilities using these specific BD laboratory automation products.
💻 Affected Systems
- BD PerformA
- KLA Journal Service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of PHI/PII data in the database, potential data exfiltration, and unauthorized access to sensitive patient information leading to regulatory violations and reputational damage.
Likely Case
Unauthorized database access leading to exposure of limited patient data, though exploitation requires network access to the database service.
If Mitigated
If proper network segmentation and access controls are implemented, the impact is limited to authorized network segments only.
🎯 Exploit Status
Exploitation requires knowledge of hard-coded credentials and network access to the database service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PerformA: 2.0.15.0; KLA Journal Service: 1.0.52
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-01
Restart Required: Yes
Instructions:
1. Contact BD for updated software versions. 2. Install PerformA 2.0.15.0 or later. 3. Install KLA Journal Service 1.0.52 or later. 4. Restart affected services.
🔧 Temporary Workarounds
Network Segmentation
allIsolate BD Kiestra Database from untrusted networks and limit access to authorized systems only.
Credential Rotation
allChange database passwords if possible, though this may break functionality if hard-coded.
🧯 If You Can't Patch
- Implement strict network access controls to limit database access to authorized IP addresses only.
- Monitor database access logs for unauthorized connection attempts using known hard-coded credentials.
🔍 How to Verify
Check if Vulnerable:
Check software version in application interface or installation directory. For PerformA, verify version is 2.0.14.0 or earlier. For KLA Journal Service, verify version is 1.0.51 or earlier.Check Version:
Check application interface or consult BD documentation for version verification method.Verify Fix Applied:
Confirm installation of PerformA 2.0.15.0+ or KLA Journal Service 1.0.52+ via version check.📡 Detection & Monitoring
Log Indicators:
- Database connection attempts using hard-coded credentials
- Unauthorized access to BD Kiestra Database
Network Indicators:
- Unexpected connections to database port (typically 1433 for SQL Server)
- Traffic patterns indicating database enumeration
SIEM Query:
source="database_logs" AND (credential="hardcoded_password" OR user="default_user")