1. Introduction
EMC RSA Archer versions prior to 6.7.0.3 are affected by multiple vulnerabilities. This is an application-level issue that could allow attackers to obtain sensitive information or execute commands on the server. Systems running vulnerable versions of EMC RSA Archer web servers are at risk. A successful exploit could compromise confidentiality, integrity and availability.
2. Technical Explanation
- Root cause: Insufficient input validation and insecure default configurations allow unauthorized access to sensitive information and command execution.
- Exploit mechanism: An attacker with valid credentials can read log files containing sensitive data or, as an administrator, inject commands into the system via a vulnerable application endpoint.
- Scope: EMC RSA Archer versions prior to 6.7 P3 (6.7.0.3), 6.6 P6 (6.6.0.6) and 6.5 P7 (6.5.0.7).
3. Detection and Assessment
Confirming vulnerability involves checking the installed version of EMC RSA Archer. A thorough assessment includes reviewing logs for evidence of exploitation.
- Quick checks: Check the application’s ‘About’ page or configuration files to determine the installed version.
- Scanning: Nessus scanner may identify this vulnerability using ID 9524eeb5 as an example.
- Logs and evidence: Review application logs for unusual activity, such as unexpected command executions or access attempts by unauthorized users.
# Example command placeholder:
# No specific command available to directly check version from the shell. Check the application UI.
4. Solution / Remediation Steps
The recommended solution is to upgrade EMC RSA Archer to a patched version. Follow these steps to apply the fix.
4.1 Preparation
- Ensure compatibility with any dependent systems or integrations. A roll back plan involves restoring from the pre-upgrade backup if issues occur.
- A change window may be required depending on your environment, requiring approval from relevant IT teams.
4.2 Implementation
- Step 1: Download the latest EMC RSA Archer installer (version 6.7.0.3 or later) from the vendor’s support portal.
- Step 2: Stop the EMC RSA Archer service on the affected server.
- Step 3: Run the installer and follow the on-screen instructions to upgrade the application.
- Step 4: Verify the installation by checking the ‘About’ page of the upgraded application.
- Step 5: Restart the EMC RSA Archer service.
4.3 Config or Code Example
Before
# No specific config example available, as this is an application upgrade. Older versions are vulnerable.After
# Verify version 6.7.0.3 or later is installed after the upgrade process. Check 'About' page in the application UI.4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent this type of vulnerability. Least privilege reduces impact if exploited, while input validation blocks unsafe data.
- Practice 1: Implement least privilege access controls to limit user permissions and reduce the potential damage from a compromised account.
- Practice 2: Enforce strict input validation on all application inputs to prevent command injection attacks.
4.5 Automation (Optional)
No specific automation script is available for this vulnerability, as it requires an application upgrade.
5. Verification / Validation
Confirm the fix by verifying the upgraded version and re-testing for the original vulnerabilities. A simple service smoke test should also be performed.
- Post-fix check: Check the ‘About’ page in the application UI to confirm version 6.7.0.3 or later is installed.
- Monitoring: Monitor application logs for any unexpected errors or unusual activity related to authentication or command execution.
# Post-fix command and expected output
# Check 'About' page in the application UI - Expected Output: Version 6.7.0.3 (or later)
6. Preventive Measures and Monitoring
Update security baselines to include patched versions of EMC RSA Archer. Implement CI/CD pipeline checks for known vulnerabilities.
- Baselines: Update your security baseline or policy to require version 6.7.0.3 or later of EMC RSA Archer.
- Pipelines: Add vulnerability scanning in your CI or deployment pipelines to identify and block deployments of vulnerable versions.
- Asset and patch process: Implement a regular patch review cycle for all applications, including EMC RSA Archer, to ensure timely updates.
7. Risks, Side Effects, and Roll Back
The upgrade may introduce compatibility issues with existing integrations. A roll back involves restoring from the pre-upgrade backup.
- Risk or side effect 2: Potential downtime during the upgrade process; plan accordingly and communicate with stakeholders.
- Roll back: 1) Stop the upgraded EMC RSA Archer service. 2) Restore the database and configuration files from the pre-upgrade backup. 3) Restart the original EMC RSA Archer service.
8. References and Resources
Link only to sources that match this exact vulnerability. Use official advisories and trusted documentation.
- Vendor advisory or bulletin: http://www.nessus.org/u?9524eeb5
- NVD or CVE entry: CVE-2020-5331, CVE-2020-5332
- Product or platform documentation relevant to the fix: No specific link available. Refer to EMC RSA Archer official upgrade documentation.