How to remediate – IBM Rational Focal Point Default Credentials

1. Introduction

IBM Rational Focal Point is a web application used for managing quality assurance processes. This vulnerability exists because the application ships with known default credentials, allowing attackers to gain administrative access. Successful exploitation could lead to complete control of the application and compromise sensitive data. Confidentiality, integrity, and availability are all at risk.

2. Technical Explanation

Nessus detected that IBM Rational Focal Point was accessible using a default username and password combination. An attacker can exploit this by simply attempting to log in with these credentials. This is possible because the application does not enforce strong password policies or require initial credential changes during installation.

• Root cause: Use of hardcoded, well-known default credentials for the ‘admin’ user account.
• Exploit mechanism: An attacker attempts to log in using the default ‘admin’ username and a known default password. If successful, they gain administrative access.
• Scope: IBM Rational Focal Point installations that have not had their default credentials changed are affected.

3. Detection and Assessment

You can confirm if your system is vulnerable by attempting to log in with the default credentials. A thorough assessment involves scanning for open ports associated with the web application and then testing those ports with a credentialed scan using known defaults.

• Quick checks: Attempt to login via the web interface using username ‘admin’ and password ‘admin’.
• Scanning: Nessus plugin ID 10429 can identify this vulnerability. Other scanners may have similar plugins.
• Logs and evidence: Check application logs for successful logins from the default ‘admin’ account. Log locations vary depending on installation, but common paths include /opt/rational/focalpoint/logs or within the application’s data directory.

# No command available to confirm exposure without attempting login.

4. Solution / Remediation Steps

The solution is to change the default password for the ‘admin’ user account immediately. Follow these steps to secure your installation.

4.1 Preparation

• No services need to be stopped, but it is recommended to perform this during a maintenance window. A roll back plan involves restoring the backed-up configuration.

4.2 Implementation

1. Step 1: Log in to the IBM Rational Focal Point web application using the default credentials (username ‘admin’, password ‘admin’).
2. Step 2: Navigate to the Administration section of the application. The exact path may vary depending on the version, but it is typically under Settings or User Management.
3. Step 3: Locate the user account for ‘admin’.
4. Step 4: Change the password for the ‘admin’ account to a strong, unique password.
5. Step 5: Log out of the application and verify that you can no longer log in using the default credentials.

4.3 Config or Code Example

Before

# No config file available for demonstration, as password is changed via UI. Default username: admin, default password: admin

After

# Password has been changed to a strong unique value via the application's user management interface. Username remains 'admin'. 

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue. Least privilege reduces impact if an account is compromised, and safe defaults ensure systems start in a secure state.

• Practice 1: Enforce strong password policies to require complex passwords and regular changes.
• Practice 2: Implement least privilege principles by granting users only the minimum necessary permissions.

4.5 Automation (Optional)

Automation is not recommended for this specific vulnerability due to the UI-based nature of the password change process.

5. Verification / Validation

• Post-fix check: Attempt to login using username ‘admin’ and the *new* password you set. Successful login confirms the change.
• Re-test: Re-run the initial quick check (attempting to log in with default credentials) – it should now fail.
• Monitoring: Monitor application logs for failed login attempts using the ‘admin’ account, which could indicate brute-force attacks.

# No command available to confirm exposure without attempting login.

6. Preventive Measures and Monitoring

• Baselines: Update your security baseline to require immediate password changes for default accounts upon installation of IBM Rational Focal Point.

7. Risks, Side Effects, and Roll Back

• Roll back: Restore the backed-up IBM Rational Focal Point configuration.

8. References and Resources

• Vendor advisory or bulletin: No specific vendor advisory found for default credentials, refer to general IBM Rational Focal Point security guidance.
• NVD or CVE entry: No specific CVE entry found for this exact issue, as it is a configuration vulnerability.
• Product or platform documentation relevant to the fix: IBM Rational Focal Point Documentation