CVE-2019-16702
📋 TL;DR
CVE-2019-16702 is a remote buffer overflow vulnerability in Integard Pro that allows unauthenticated attackers to execute arbitrary code by sending a specially crafted long NoJs parameter to the /LoginAdmin URI. This affects Integard Pro version 2.2.0.9026, potentially compromising the entire system where the software is installed.
💻 Affected Systems
- Integard Pro
📦 What is this software?
Integard Pro by Integard Pro Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Remote code execution leading to system takeover, data theft, or ransomware deployment.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Public exploit code is available, making exploitation trivial for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to Integard Pro web interface using firewall rules or network segmentation.
Windows Firewall: New-NetFirewallRule -DisplayName "Block Integard Admin" -Direction Inbound -LocalPort 80,443 -Protocol TCP -Action Block
Linux iptables: iptables -A INPUT -p tcp --dport 80 -j DROP && iptables -A INPUT -p tcp --dport 443 -j DROP
Web Application Firewall
allDeploy WAF rules to block requests with long NoJs parameters to /LoginAdmin endpoint.
ModSecurity rule: SecRule ARGS:NoJs "@gt 100" "id:1001,phase:2,deny,status:403,msg:'Potential buffer overflow attempt'"
Cloudflare WAF: Create rule blocking requests with NoJs parameter > 100 chars to /LoginAdmin
🧯 If You Can't Patch
- Isolate the Integard Pro server in a separate network segment with strict access controls
- Implement application whitelisting to prevent execution of unauthorized code on the affected system
🔍 How to Verify
Check if Vulnerable:
Check if Integard Pro version 2.2.0.9026 is installed and if the /LoginAdmin endpoint is accessible via HTTP.Check Version:
Check Integard Pro About dialog or installation directory for version informationVerify Fix Applied:
Verify that the /LoginAdmin endpoint is no longer accessible or that requests with long NoJs parameters are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /LoginAdmin with unusually long NoJs parameter values
- Multiple failed buffer overflow attempts in application logs
Network Indicators:
- HTTP POST requests to /LoginAdmin with NoJs parameter exceeding normal length
- Unusual outbound connections from Integard Pro server
SIEM Query:
source="web_logs" AND uri="/LoginAdmin" AND (param_length(NoJs) > 100 OR param_contains(NoJs, "\x90\x90"))🔗 References
- http://packetstormsecurity.com/files/155578/Integard-Pro-NoJs-2.2.0.9026-Remote-Buffer-Overflow.html
- https://github.com/purpl3-f0x/exploit-dev/blob/master/nojs_integard.py
- http://packetstormsecurity.com/files/155578/Integard-Pro-NoJs-2.2.0.9026-Remote-Buffer-Overflow.html
- https://github.com/purpl3-f0x/exploit-dev/blob/master/nojs_integard.py
