CVE-2018-6885 : What You Need to Know

A security concern was identified in MicroStrategy Web Services, specifically the Microsoft Office plugin, allowing unauthorized access to asset files and potentially leading to remote code execution.

Understanding CVE-2018-6885

What is CVE-2018-6885?

An issue in MicroStrategy Web Services (Microsoft Office plugin) before versions 10.4 Hotfix 7 and 10.11 allows unauthorized access to asset files using the MicroStrategy user's privileges, potentially leading to remote code execution.

The Impact of CVE-2018-6885

The vulnerability enables attackers to gain access to admin dashboard credentials, posing a risk of unauthorized access and potential remote code execution.

Technical Details of CVE-2018-6885

Vulnerability Description

The vulnerability is a path traversal issue within a SOAP request of the web service component, allowing unauthorized access to asset files.

Affected Systems and Versions

MicroStrategy Web Services versions prior to 10.4 Hotfix 7 and 10.11

Exploitation Mechanism

Attackers exploit the path traversal vulnerability in the SOAP request to gain unauthorized access to asset files and potentially execute remote code.

Mitigation and Prevention

Immediate Steps to Take

Update MicroStrategy Web Services to version 10.4 Hotfix 7 or 10.11 to mitigate the vulnerability.
Monitor and restrict access to sensitive files and directories.

Long-Term Security Practices

Regularly update and patch software to address security vulnerabilities.
Implement strong authentication mechanisms to prevent unauthorized access.
Conduct regular security audits and penetration testing to identify and address potential vulnerabilities.

Patching and Updates

Apply security patches and updates provided by MicroStrategy to address the vulnerability.