CVE-2019-16948 : Security Advisory and Response

A vulnerability called SSRF (Server-Side Request Forgery) has been found in Enghouse Web Chat version 6.1.300.31. By modifying the port number in the WebServiceLocation parameter of any POST request, it is possible to test a range of ports to see what is accessible on the internal network, rather than what is normally visible to external web traffic. The response received from open ports will differ from the response received from closed ports. The product does not permit changing the protocol, except for http(s), which will result in an error. However, the type of error message returned can be used to determine whether a port is open or not.

Understanding CVE-2019-16948

This section provides insights into the nature and impact of the CVE.

What is CVE-2019-16948?

CVE-2019-16948 is an SSRF vulnerability discovered in Enghouse Web Chat version 6.1.300.31. It allows an attacker to manipulate the port number in POST requests to probe internal network accessibility.

The Impact of CVE-2019-16948

The vulnerability enables attackers to bypass normal external web traffic restrictions and potentially gain unauthorized access to internal network resources.

Technical Details of CVE-2019-16948

Explore the technical aspects of the CVE.

Vulnerability Description

SSRF vulnerability in Enghouse Web Chat version 6.1.300.31
Modification of port number in WebServiceLocation parameter of POST requests
Ability to test a range of ports for internal network accessibility

Affected Systems and Versions

Enghouse Web Chat version 6.1.300.31

Exploitation Mechanism

Attackers can manipulate the port number in POST requests to determine internal network visibility
Response from open ports differs from closed ports
Protocol change, except for http(s), triggers an error that can be used to identify open ports

Mitigation and Prevention

Learn how to address and prevent the CVE.

Immediate Steps to Take

Update Enghouse Web Chat to a patched version
Implement network segmentation to restrict access
Monitor and analyze network traffic for suspicious activities

Long-Term Security Practices

Conduct regular security audits and penetration testing
Educate users on safe browsing practices and social engineering awareness
Employ intrusion detection and prevention systems

Patching and Updates

Apply security patches and updates promptly
Follow vendor recommendations for secure configuration and usage