CVE-2020-35567
📋 TL;DR
This vulnerability involves MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software using a hardcoded database password shared across all installations. Attackers who discover this password can access the application database, potentially compromising sensitive data. All users running affected versions are impacted.
💻 Affected Systems
- MB CONNECT LINE mymbCONNECT24
- MB CONNECT LINE mbCONNECT24
📦 What is this software?
Mbconnect24 by Mbconnectline
Mymbconnect24 by Mbconnectline
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, manipulation, or deletion; potential lateral movement to other systems if database contains credentials.
Likely Case
Unauthorized database access allowing attackers to read or modify configuration data, user information, or other stored sensitive information.
If Mitigated
Limited impact if database is isolated with network controls and minimal sensitive data, though password exposure remains a risk.
🎯 Exploit Status
Exploitation requires discovering the shared password, which could be obtained through reverse engineering, leaks, or other means. Once obtained, attackers can directly connect to the database.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.6.2
Vendor Advisory: https://mbconnectline.com/security-advice/
Restart Required: Yes
Instructions:
1. Update to a version beyond 2.6.2. 2. Follow vendor instructions to apply the patch. 3. Restart the application services. 4. Verify the database password has been changed to a unique, strong password.
🔧 Temporary Workarounds
Change Database Password Manually
allManually change the database password to a unique, strong password and update the application configuration.
Specific commands depend on database type and OS; consult vendor documentation for password change procedures.
Network Isolation
linuxRestrict database access to only the application server using firewall rules or network segmentation.
Example for Linux iptables: iptables -A INPUT -p tcp --dport [DB_PORT] -s [APP_SERVER_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [DB_PORT] -j DROP
🧯 If You Can't Patch
- Isolate the database server from untrusted networks using firewalls or VLANs.
- Implement database auditing and monitoring to detect unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Check the software version; if it is 2.6.2 or earlier, it is vulnerable. Review configuration files for hardcoded passwords.Check Version:
Consult vendor documentation for version check command; typically via web interface or configuration files.Verify Fix Applied:
Confirm the software version is beyond 2.6.2 and that the database password has been changed to a unique value not shared with other instances.📡 Detection & Monitoring
Log Indicators:
- Failed or successful database login attempts from unexpected IP addresses
- Unusual database queries or access patterns
Network Indicators:
- Database connection attempts from unauthorized sources
- Traffic to database port from non-application servers
SIEM Query:
Example: 'sourceIP != [APP_SERVER_IP] AND destinationPort == [DB_PORT]'