CVE-2021-35193
📋 TL;DR
Patterson Eaglesoft dental practice management software versions 18-21 has a certificate authentication flaw where the same certificate is accepted across different customer installations. This allows attackers to bypass client-side authentication and remotely access SQL database credentials. Dental practices using affected Eaglesoft versions are vulnerable.
💻 Affected Systems
- Patterson Eaglesoft
📦 What is this software?
Eaglesoft by Pattersondental
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of patient databases including PHI/PII data, financial records, and practice operations data leading to data breach, ransomware, or system destruction.
Likely Case
Unauthorized access to patient databases resulting in data theft, potential HIPAA violations, and practice disruption.
If Mitigated
Limited impact if network segmentation prevents external access to Eaglesoft servers and proper authentication controls are in place.
🎯 Exploit Status
Proof-of-concept code available on GitHub. Attackers can develop custom clients to bypass authentication. No authentication required to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://patterson.eaglesoft.net/Home/Contact-Us
Restart Required: No
Instructions:
Contact Patterson Dental support for guidance. No official patch information available in public sources.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Eaglesoft servers from untrusted networks and internet access
Firewall Rules
allRestrict access to Patterson Application Service ports to authorized IPs only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Eaglesoft servers
- Monitor for unusual database access patterns and failed authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check Eaglesoft version in Help > About. If version is 18, 19, 20, or 21, system is vulnerable.Check Version:
Check Eaglesoft application version via Help > About menuVerify Fix Applied:
Contact Patterson Dental support for verification. No public verification method available.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL database connection attempts
- Failed authentication attempts to Patterson Application Service
- Unexpected client connections to Eaglesoft services
Network Indicators:
- Unusual traffic to Eaglesoft database ports from unauthorized sources
- Custom client connections bypassing normal authentication patterns
SIEM Query:
source="eaglesoft" AND (event_type="authentication_failure" OR event_type="database_access")🔗 References
- http://patterson.eaglesoft.net/Home/Contact-Us
- https://github.com/jshafer817/Eaglesoft
- https://justinshafer.blogspot.com/2021/07/eaglesoft-18-through-21-vulnerability.html
- http://patterson.eaglesoft.net/Home/Contact-Us
- https://github.com/jshafer817/Eaglesoft
- https://justinshafer.blogspot.com/2021/07/eaglesoft-18-through-21-vulnerability.html
