1. Introduction
EMC RSA Archer versions prior to 6.7.0.3 (6.7 P3) or 6.6 P6 (6.6.0.6) are affected by an authorization bypass vulnerability. This allows a remote authenticated user to view sensitive information. This impacts the confidentiality of data stored within the application and is typically found on web servers hosting the Archer platform.
2. Technical Explanation
The EMC RSA Archer application has a vulnerability where access controls are not properly enforced, allowing authorized users to potentially bypass intended restrictions. Exploitation requires authentication to the application. CVE-2020-5333 details this issue.
- Root cause: Insufficient authorization checks within the web application allow authenticated users to access data they should not be permitted to view.
- Exploit mechanism: An attacker with valid credentials can manipulate requests to access sensitive information outside of their authorized scope. For example, modifying a request parameter could grant access to another user’s data.
- Scope: Affected versions include EMC RSA Archer prior to 6.7.0.3 and 6.6.0.6.
3. Detection and Assessment
You can confirm if a system is vulnerable by checking the application version. A thorough method involves reviewing access logs for unauthorized data access attempts.
- Quick checks: Access the Archer web interface and check the ‘About’ section or similar to determine the installed version.
- Scanning: Nessus vulnerability scanner may identify this issue with ID 9524eeb5 as an example.
- Logs and evidence: Examine application logs for unusual access patterns or attempts to access restricted data. Look for error messages related to authorization failures.
# No specific command available, check the Archer web interface version.4. Solution / Remediation Steps
Apply the latest patch from the vendor to resolve this issue.
4.1 Preparation
- Ensure you have a rollback plan in place, including restoring from backup if necessary.
- A change window may be required depending on your environment; approval from security or IT management might be needed.
4.2 Implementation
- Step 1: Download the latest patch for EMC RSA Archer (version 6.7.0.3 or later) from the vendor’s support portal.
- Step 2: Apply the patch according to the vendor’s instructions. This typically involves running an installer or applying a configuration update.
4.3 Config or Code Example
This vulnerability requires a full software upgrade, so there are no simple config changes.
Before
# Affected versions prior to 6.7.0.3 and 6.6.0.6After
# Version 6.7.0.3 or later installed.4.4 Security Practices Relevant to This Vulnerability
Implementing least privilege and regular patch cadence can help prevent this issue.
- Practice 1: Least privilege – Limit user access rights to only the data and functions they require, reducing the potential impact of a compromised account.
- Practice 2: Patch cadence – Regularly apply security patches from vendors to address known vulnerabilities in software applications.
4.5 Automation (Optional)
No automation script is provided as this requires vendor-specific patching procedures.
5. Verification / Validation
- Post-fix check: Access the Archer web interface and confirm that the installed version is 6.7.0.3 or later.
- Re-test: Re-run the earlier detection method (checking the application version) to ensure it now shows a patched version.
- Monitoring: Monitor application logs for any authorization failures or unusual access attempts.
# Check Archer web interface version - expected output should be 6.7.0.3 or later.6. Preventive Measures and Monitoring
Update security baselines to include the latest patch levels for EMC RSA Archer. Implement regular vulnerability scanning in your CI/CD pipelines.
- Baselines: Update your security baseline or policy to require version 6.7.0.3 or later of EMC RSA Archer.
- Pipelines: Add vulnerability scanning to your CI/CD pipeline to identify and prevent the deployment of vulnerable versions of software applications.
- Asset and patch process: Establish a regular patch review cycle (e.g., monthly) to ensure timely application of security updates.
7. Risks, Side Effects, and Roll Back
Patching may cause temporary service downtime. Ensure you have a rollback plan in place.
- Risk or side effect 1: Patching can sometimes introduce compatibility issues with other systems; test thoroughly in a non-production environment first.
- Risk or side effect 2: Service interruption during the patching process is possible; schedule maintenance windows accordingly.
- Roll back: Restore from backup if the patch causes unexpected issues. Revert to the previous version of the application and database.
8. References and Resources
- Vendor advisory or bulletin: http://www.nessus.org/u?9524eeb5
- NVD or CVE entry: CVE-2020-5333
- Product or platform documentation relevant to the fix: Refer to EMC RSA Archer official documentation for patch installation instructions.