CVE-2022-25804: 
IGEL Universal Management Suite vulnerability analysis and mitigation

An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100, where insecure permissions for the serverconfig registry key (under HKEY_LOCAL_MACHINE) allowed storage of superuser/database credentials. The vulnerability was discovered in January 2022 and publicly disclosed in May 2022 (Atredis Advisory).

The vulnerability exists in the de.igel.rm.config.PrefDBCredentials class in RMGUI.jar, which is used to encrypt and decrypt credentials for the UMS superuser. On Windows systems, the stored credentials are located in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Prefs\de\igel\rm\config\serverconfig as dbuser and dbpassword values. The implementation uses a hardcoded DES key in the PrefDBCredentials class for encryption and decryption of the dbpassword value (Atredis Advisory).

This vulnerability allows a low-privileged attacker with Operating System (OS) access to read the encrypted dbpassword value. Due to the hardcoded DES key in the PrefDBCredentials class, an attacker with access to the encrypted dbpassword value can decrypt the password and gain superuser/database access to IGEL UMS and its database (Atredis Advisory).

The vulnerability can be exploited by an attacker with low-privilege access to the operating system where IGEL UMS is installed. The attacker can read the registry values and use the hardcoded DES key to decrypt the credentials, leading to elevated access (Atredis Advisory).

The vendor recommends making the UMS Server host accessible only to users that need to access UMS and keeping the UMS database and its backups under strict access control. No patches were initially available to address these findings (Atredis Advisory).