IBM Sterling Control Center vulnerable to denial of service due to Spring Boot and remote code execution due to Spring Framework (CVE-2023-20883 and CVE-2016-1000027)

Advisory No: TZCERT/SA/2024/02/08-2

Date of First Release: 8^th February 2024

Source: IBM

Software Affected: IBM Sterling Control Center

Overview:

IBM has disclosed the remote code vulnerabilities affecting IBM Sterling Control Center. The vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.

Description:

The vulnerabilities with CVEID CVE-2016-1000027 and CVE-2023-20883 result from unsafe deserialization flaw in library under Pivota Spring Framework and the flaw VMware Tanzu Spring boot when Spring MVC is used together with a reverse proxy cache respectively. From the two vulnerabilities, the first one can be leveraged by using the specially crafted input to execute arbitrary code on the affected system whilst the other through the specially crafted request can result into denial-of-service condition.

Impact:

Successful exploitation of these vulnerabilities may allow the remote attacker to take control of the affected system or cause a denial-of-service condition to the affected system.

Solution:

IBM has released security updates to resolve these vulnerabilities. Users and administrations are encouraged to update as soon as possible.

References:

1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3