On 25.6.2022, ARGE RBT reported to us that there were various security gaps in our „Mediacenter“ product. With version 2.0 we have fixed all known security gaps.
We would like to thank Mr. Pfister and our customer’s IT security team for conducting the pentest with us.
Vulnerability
The vulnerability was an XSS which was possible due to incorrect input validation. The vulnerability was not able to take over the site or customers on its own, but in conjunction with other vulnerabilities (like an arbitrary file write) was able to take over the entire site and all customers.
Fix
After the gaps became known, we developed a fix together with the auditors, which first validates the data. In the Roal out of Version 2.0, these vulnerabilities have all been patched. In addition, the code was streamlined, which eliminated these gaps across the page.
All affected Customers have been updatet.
Thanks
Thanks go out to Mr. Pfister at ARGE RBT and the IT-Security Department at the BR, there Mr. Rennollet and Mr. Herrmann.
I would also like to thank our customer for the opportunity to carry out this pentest at all.