CVE-2019-4723
📋 TL;DR
IBM Cognos Analytics 11.0 and 11.1 have a vulnerability where the New Data Server Connection page incorrectly enables autocomplete for credential fields. This allows a remote attacker to potentially extract saved credentials from a user's browser. Organizations using affected versions of IBM Cognos Analytics are at risk.
💻 Affected Systems
- IBM Cognos Analytics
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrative credentials, gain full access to Cognos Analytics, and potentially compromise connected data sources.
Likely Case
Attackers harvest user credentials through phishing or compromised sessions, leading to unauthorized access to business intelligence data.
If Mitigated
With proper network segmentation and access controls, impact is limited to the Cognos Analytics environment only.
🎯 Exploit Status
Exploitation requires tricking authenticated users into visiting a malicious page or using the vulnerable page. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply security patch from IBM (see advisory)
Vendor Advisory: https://www.ibm.com/support/pages/node/6451705
Restart Required: Yes
Instructions:
1. Download the security patch from IBM Fix Central. 2. Apply the patch according to IBM documentation. 3. Restart Cognos Analytics services.
🔧 Temporary Workarounds
Disable autocomplete manually
allManually add autocomplete='off' to credential fields in the New Data Server Connection page HTML
Edit the relevant JSP/HTML files to add autocomplete='off' to input fields for credentials
🧯 If You Can't Patch
- Restrict access to the New Data Server Connection page using network controls or application firewalls
- Implement strong session management and educate users about credential security
🔍 How to Verify
Check if Vulnerable:
Inspect the New Data Server Connection page HTML for missing autocomplete='off' on credential input fieldsCheck Version:
Check Cognos Analytics version via administrative console or configuration filesVerify Fix Applied:
Verify the patch version is installed and check that autocomplete='off' is present on credential fields📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to the New Data Server Connection page
- Multiple failed login attempts from new locations
Network Indicators:
- Traffic to the vulnerable page from unexpected sources
SIEM Query:
source='cognos' AND (url CONTAINS 'newDataServerConnection' OR event='authentication_failure')🔗 References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172129
- https://security.netapp.com/advisory/ntap-20210622-0004/
- https://www.ibm.com/support/pages/node/6451705
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172129
- https://security.netapp.com/advisory/ntap-20210622-0004/
- https://www.ibm.com/support/pages/node/6451705
