CVE-2023-3440 – This CVE-2023-3440 is an incorrect default perm... (How to Fix)

Q: What is the severity of CVE-2023-3440?

CVE-2023-3440 has a CVSS score of 8.4 (HIGH). This CVE-2023-3440 is an incorrect default permissions vulnerability in Hitachi JP1/Performance Management on Windows that allows file manipulation. Attackers can exploit improper file permissions to modify, delete, or create files in the application directory. This affects multiple JP1/Performance Management components across various versions.

📋 TL;DR

This CVE-2023-3440 is an incorrect default permissions vulnerability in Hitachi JP1/Performance Management on Windows that allows file manipulation. Attackers can exploit improper file permissions to modify, delete, or create files in the application directory. This affects multiple JP1/Performance Management components across various versions.

💻 Affected Systems

Products:

Hitachi JP1/Performance Management - Manager
Hitachi JP1/Performance Management - Base
Hitachi JP1/Performance Management - Agent Option for Application Server
Hitachi JP1/Performance Management - Agent Option for Enterprise Applications
Hitachi JP1/Performance Management - Agent Option for HiRDB
Hitachi JP1/Performance Management - Agent Option for IBM Lotus Domino
Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Exchange Server
Hitachi JP1/Performance Management - Agent Option for Microsoft(R) Internet Information Server
Hitachi JP1/Performance Management - Agent Option for Microsoft(R) SQL Server
Hitachi JP1/Performance Management - Agent Option for Oracle
Hitachi JP1/Performance Management - Agent Option for Platform
Hitachi JP1/Performance Management - Agent Option for Service Response
Hitachi JP1/Performance Management - Agent Option for Transaction System
Hitachi JP1/Performance Management - Remote Monitor for Microsoft(R) SQL Server
Hitachi JP1/Performance Management - Remote Monitor for Oracle
Hitachi JP1/Performance Management - Remote Monitor for Platform
Hitachi JP1/Performance Management - Remote Monitor for Virtual Machine
Hitachi JP1/Performance Management - Agent Option for Domino
Hitachi JP1/Performance Management - Agent Option for IBM WebSphere Application Server
Hitachi JP1/Performance Management - Agent Option for IBM WebSphere MQ
Hitachi JP1/Performance Management - Agent Option for JP1/AJS3
Hitachi JP1/Performance Management - Agent Option for OpenTP1
Hitachi JP1/Performance Management - Agent Option for Oracle WebLogic Server
Hitachi JP1/Performance Management - Agent Option for uCosminexus Application Server
Hitachi JP1/Performance Management - Agent Option for Virtual Machine

Versions: Multiple version ranges as specified in CVE description

Operating Systems: Windows

Default Config Vulnerable: ⚠️ Yes

Notes: Affects specific version ranges for each component; some components have vulnerable versions ending with wildcards indicating all subversions.

📦 What is this software?

Jp1\/performance Management by Hitachi

View all CVEs affecting Jp1\/performance Management →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise through privilege escalation, data destruction, or malware deployment by modifying critical system files or installing malicious executables.

🟠

Likely Case

Unauthorized file modification leading to data corruption, service disruption, or credential theft by accessing configuration files.

🟢

If Mitigated

Limited impact with proper file system permissions, application isolation, and least privilege principles in place.

🌐 Internet-Facing: LOW

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access to the Windows system where JP1/Performance Management is installed. The vulnerability stems from incorrect default file permissions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by component - see vendor advisory for specific fixed versions

Vendor Advisory: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html

Restart Required: Yes

Instructions:

1. Identify affected JP1/Performance Management components
2. Download appropriate patches from Hitachi support portal
3. Apply patches according to vendor instructions
4. Restart affected services or systems as required

🔧 Temporary Workarounds

Restrict File Permissions

windows

Manually adjust file system permissions on JP1/Performance Management directories to restrict write access to authorized users only

icacls "C:\Program Files\Hitachi\JP1\Performance Management" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"

Application Isolation

windows

Run JP1/Performance Management components with least privilege accounts and isolate from other critical systems

🧯 If You Can't Patch

Implement strict access controls to JP1/Performance Management directories
Monitor file system changes in JP1 directories using audit policies

🔍 How to Verify

Check if Vulnerable:

Check installed JP1/Performance Management component versions against affected ranges in vendor advisory

Check Version:

Check version through JP1/Performance Management console or examine installation directory properties

Verify Fix Applied:

Verify component versions match or exceed fixed versions listed in vendor advisory

📡 Detection & Monitoring

Log Indicators:

Unexpected file modifications in JP1 directories
Access denied errors from legitimate users
Unauthorized user attempts to access JP1 files

Network Indicators:

Unusual file transfer patterns from JP1 systems

SIEM Query:

EventID=4663 AND ObjectName LIKE '%JP1%Performance Management%' AND Accesses LIKE '%Write%'

📊 Metadata

CVE ID: CVE-2023-3440

CVSS v3 Score: 8.4 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-276

Published: October 3, 2023

Last Updated: November 21, 2024

🔗 References

https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html Vendor Advisory
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-145/index.html Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-3440, you might also want to check these: