CVE-2019-11603 : Security Advisory and Response

In versions prior to ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2, a vulnerability known as HTTP Traversal Attack allows attackers to access files outside the designated http root.

Understanding CVE-2019-11603

This CVE involves a path traversal vulnerability in ProSyst mBS SDK and Bosch IoT Gateway Software, potentially enabling unauthorized access to sensitive files.

What is CVE-2019-11603?

CVE-2019-11603 is a security flaw in earlier versions of ProSyst mBS SDK and Bosch IoT Gateway Software that permits remote attackers to read files located outside the http root directory.

The Impact of CVE-2019-11603

CVSS Base Score: 7.5 (High Severity)
Confidentiality Impact: High
Attack Vector: Network
Attack Complexity: Low
This vulnerability poses a significant risk to the confidentiality of sensitive information.

Technical Details of CVE-2019-11603

Vulnerability Description

The vulnerability allows remote attackers to perform HTTP Traversal Attacks, potentially leading to unauthorized access to files outside the intended directory structure.

Affected Systems and Versions

Versions prior to ProSyst mBS SDK 8.2.6
Versions prior to Bosch IoT Gateway Software 9.0.2

Exploitation Mechanism

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None

Mitigation and Prevention

Immediate Steps to Take

Update to ProSyst mBS SDK 8.2.6 or later
Update to Bosch IoT Gateway Software 9.0.2 or later
Monitor network traffic for any suspicious activity

Long-Term Security Practices

Implement access controls to restrict file access
Regularly update software and apply security patches

Patching and Updates

Apply the latest security patches provided by ProSyst and Bosch to address this vulnerability