CVE-2023-4539
📋 TL;DR
This vulnerability allows attackers to access sensitive data in Comarch ERP XL databases using a hard-coded password that's identical across all installations. It affects all Comarch ERP XL installations from version 2020.2.2 through 2023.2. Attackers with network access to the database can exploit this to retrieve embedded sensitive information.
💻 Affected Systems
- Comarch ERP XL
📦 What is this software?
Erp Xl by Comarch
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to theft of all sensitive business data, financial information, customer records, and intellectual property stored in the ERP system.
Likely Case
Unauthorized access to sensitive business data, potentially including financial records, customer information, and operational data stored in the database.
If Mitigated
Limited or no data exposure if proper network segmentation and access controls prevent unauthorized database connections.
🎯 Exploit Status
Exploitation requires only knowledge of the hard-coded password and network access to the database. No authentication to the ERP system itself is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.3 or later
Vendor Advisory: https://cert.pl/en/posts/2024/02/CVE-2023-4537/
Restart Required: Yes
Instructions:
1. Upgrade Comarch ERP XL to version 2023.3 or later. 2. Change the password for the affected database account. 3. Restart the ERP application and database services.
🔧 Temporary Workarounds
Change Database Account Password
allManually change the password for the hard-coded database account to a strong, unique password.
ALTER USER [account_name] IDENTIFIED BY '[new_strong_password]';
Restrict Database Network Access
allImplement network segmentation and firewall rules to restrict database access to only authorized application servers.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the database from untrusted networks
- Change the hard-coded database account password immediately and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check Comarch ERP XL version via administration console or configuration files. If version is between 2020.2.2 and 2023.2 inclusive, the system is vulnerable.Check Version:
Check ERP administration panel or consult Comarch documentation for version checking commands specific to your installation.Verify Fix Applied:
Verify version is 2023.3 or later and attempt to connect to the database using the previously known hard-coded password (should fail).📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts to database with the hard-coded password
- Unusual database queries from unexpected sources
- Database connection attempts from unauthorized IP addresses
Network Indicators:
- Database connection attempts on port 1433 (MSSQL) or 1521 (Oracle) from unexpected sources
- Unusual data extraction patterns in database traffic
SIEM Query:
source="database_logs" AND (event_type="authentication_failure" AND user="[hardcoded_account]") OR (source_ip NOT IN [allowed_ips] AND destination_port IN (1433,1521))