Sage 300

Sage 300 Clientside RBAC Bypass via SQL Connection Retrieval
CVE-2023-29927 4.3 - Medium - May 16, 2023

Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the programs role-based access controls.

CVE-2022-41400: Sage 300 Hard-Coded Blowfish Key Exposes Passwords
CVE-2022-41400 9.8 - Critical - April 28, 2023

Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings.

Use of Hard-coded Credentials

Sage 300 DB config Blowfish Key Hardcoding Allows Unauth DB Access
CVE-2022-41399 7.5 - High - April 28, 2023

The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database.

Use of Hard-coded Credentials

Sage 300 Hard-Coded Apache Solr Credentials (CVE-2022-41398)
CVE-2022-41398 7.5 - High - April 28, 2023

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information.

Use of Hard-coded Credentials

HardCoded BF Key in Sage 300 Web Screens/Global Search
CVE-2022-41397 9.8 - Critical - April 28, 2023

The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration files and in database tables.

Use of Hard-coded Credentials

Sage_300 6.46.9: Low-Priv Workstation User Can Modify SharedData to Impersonate SQL
CVE-2022-38583 7.8 - High - April 28, 2023

On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.

Incorrect Default Permissions

In Sage 300 ERP (formerly accpac) through 6.8.x
CVE-2021-45492 7.8 - High - July 14, 2022

In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C:\ folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileges to SYSTEM. Furthermore, if the Global Search or Web Screens functionality is enabled, then privilege escalation is possible via the GlobalSearchService and Sage.CNA.WindowsService services, again via DLL search-order hijacking because unprivileged users would have modify permissions on the application directory. Note that while older versions of the software default to installing in %PROGRAMFILES(X86)% (which would allow the Sage folder to inherit strong permissions, making the installation not vulnerable), the official Sage 300 installation guides for those versions recommend installing in C:\Sage, which would make the installation vulnerable.

Incorrect Permission Assignment for Critical Resource