CVE-2022-38583
📋 TL;DR
This vulnerability allows low-privileged Sage 300 workstation users to access and modify credentials stored in the SharedData folder on connected servers. Attackers can impersonate users and gain system administrator access to the SQL database, potentially compromising all program records and database server functionality. Affected systems include Sage 300 versions 2017-2022 configured in Windows Peer-to-Peer or Client Server Network setups.
💻 Affected Systems
- Sage 300
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Sage 300 database with ability to create, update, delete all records, execute arbitrary code on database server, and potentially pivot to other systems.
Likely Case
Unauthorized access to sensitive business data, financial manipulation, credential theft, and privilege escalation within the Sage 300 environment.
If Mitigated
Limited to authorized user actions with proper access controls and monitoring in place.
🎯 Exploit Status
Exploitation requires low-privileged Sage 300 user access and network access to the SharedData folder. The attack path is straightforward once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Sage for specific patched versions
Vendor Advisory: http://sage.com
Restart Required: Yes
Instructions:
1. Contact Sage support for the latest security patches. 2. Apply patches to all Sage 300 servers and workstations. 3. Restart Sage 300 services and verify functionality. 4. Test critical business processes after patching.
🔧 Temporary Workarounds
Restrict SharedData Folder Permissions
windowsModify NTFS permissions on the SharedData folder to restrict access to authorized administrators only
icacls "C:\ProgramData\Sage\Sage 300\SharedData" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F"
Implement Network Segmentation
allIsolate Sage 300 servers from regular workstation networks to limit access to SharedData folder
🧯 If You Can't Patch
- Implement strict access controls on SharedData folder (minimum privilege principle)
- Enable detailed auditing and monitoring of access to SharedData folder and SQL database connections
🔍 How to Verify
Check if Vulnerable:
Check Sage 300 version (Help > About) and verify if SharedData folder has overly permissive permissions allowing low-privileged users write/read access.Check Version:
Within Sage 300 application: Help > About or check program files version informationVerify Fix Applied:
Verify SharedData folder permissions only allow authorized administrators, test that low-privileged users cannot access the folder, and confirm Sage 300 version is patched.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to SharedData folder
- Unusual SQL database connections from non-standard accounts
- Multiple failed authentication attempts followed by successful privileged access
Network Indicators:
- Unexpected SMB traffic to Sage server SharedData folder
- SQL connection attempts from unexpected workstations
SIEM Query:
EventID=4663 AND ObjectName LIKE '%SharedData%' AND AccessMask IN ('0x10000', '0x120089') | OR | SQL audit logs showing privilege escalation or unusual administrator account usage