CVE-2018-11247
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Nasdaq BWise 5.0 systems by exploiting the unauthenticated JMX/RMI interface on port 81. The lack of authentication for SAP BO Component sessions enables complete system compromise. Organizations running Nasdaq BWise 5.0 with the JMX/RMI interface exposed are affected.
💻 Affected Systems
- Nasdaq BWise
📦 What is this software?
Bwise by Nasdaq
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, lateral movement within the network, and complete business disruption.
Likely Case
Remote code execution allowing attackers to install backdoors, steal sensitive data, or use the system as a pivot point for further attacks.
If Mitigated
Limited impact if interface is properly firewalled and network segmentation prevents access to vulnerable systems.
🎯 Exploit Status
The vulnerability requires no authentication and has publicly available exploit details, making it trivial for attackers to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Contact Nasdaq for official patch or guidance
2. Apply vendor-recommended security updates
3. Verify the JMX/RMI interface now requires authentication
🔧 Temporary Workarounds
Block Port 81 Access
allRestrict network access to port 81 using firewall rules to prevent external exploitation
iptables -A INPUT -p tcp --dport 81 -j DROP
netsh advfirewall firewall add rule name="Block BWise Port 81" dir=in action=block protocol=TCP localport=81
Disable JMX/RMI Interface
allDisable the vulnerable JMX/RMI interface if not required for business operations
Consult Nasdaq BWise documentation for JMX/RMI disable procedures
🧯 If You Can't Patch
- Implement strict network segmentation to isolate BWise systems from untrusted networks
- Deploy intrusion detection systems to monitor for exploitation attempts on port 81
🔍 How to Verify
Check if Vulnerable:
Test if port 81 is accessible and if JMX/RMI connections can be established without authentication using tools like nmap or telnetCheck Version:
Check Nasdaq BWise administration interface or consult system documentation for version informationVerify Fix Applied:
Verify that port 81 is no longer accessible or that JMX/RMI connections now require authentication📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 81
- JMX/RMI authentication failures or successes
- Unexpected process execution from BWise services
Network Indicators:
- Traffic to port 81 from unexpected sources
- JMX/RMI protocol patterns in network traffic
SIEM Query:
source_port=81 OR dest_port=81 AND (protocol="JMX" OR protocol="RMI")