CVE-2019-18956 Explained : Impact and Mitigation

Proxia Proxima Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43, and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, as well as SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 are vulnerable to remote code execution due to a flaw in Java deserialization.

Understanding CVE-2019-18956

This CVE identifies a vulnerability in Proxia Proxima Suite, SparkSpace, and Proxia PHR that allows remote code execution through insecure Java deserialization.

What is CVE-2019-18956?

This CVE pertains to the insecure deserialization of the proxia-error cookie in various products, enabling unauthorized attackers to execute arbitrary code.

The Impact of CVE-2019-18956

The vulnerability allows unauthenticated attackers to craft serialized payloads to execute arbitrary code, posing a significant security risk to affected systems.

Technical Details of CVE-2019-18956

The technical aspects of the vulnerability are as follows:

Vulnerability Description

Insecure deserialization of the proxia-error cookie in all requests (GET or POST)
Exploitable through the prepareError function in the dv2eemvc.jar component's com.divisait.dv2ee.controller.MVCControllerServlet class

Affected Systems and Versions

Proxia Proxima Suite versions 9 < 9.12.16, 10.0 < 10.0.32, and 10.1 < 10.1.5
SparkSpace versions 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4
Proxia PHR versions 1.0 < 1.0.30 and 1.1 < 1.1.2

Exploitation Mechanism

Attackers can create serialized payloads to execute arbitrary code by leveraging the prepareError function in the vulnerable component

Mitigation and Prevention

To address CVE-2019-18956, consider the following steps:

Immediate Steps to Take

Apply vendor-supplied patches promptly
Monitor network traffic for signs of exploitation
Restrict access to vulnerable systems

Long-Term Security Practices

Implement secure coding practices to prevent deserialization vulnerabilities
Regularly update and patch software components

Patching and Updates

Ensure all affected systems are updated with the latest security patches