Instant Financial Issuance (On Premise) Software (formerly CardWizard) - Sensitive Information Disclosure (CVE-2024-39341) / Hardcoded Cryptographic Keys (CVE-2024-39342)

CVE-2024-39341_CVE-2024-39342.txt

# Exploit Title: Instant Financial Issuance (On Premise) Software (formerly CardWizard) - Sensitive Information Disclosure
# Date: 08/20/2024
# Exploit Authors: Victor A. Morales, Omar A. Crespo, GM Sectec Inc.
# Vendor Homepage: https://trustedcare.entrust.com/login
# Version: 6.10.0, 6.9.0, 6.9.1, 6.9.2, 6.8.x and older
# Instant Financial Issuance as a Service (8.x) is not affected.
# Fix: Entrust Security Bulletin E24-003
# Tested on: Windows Server 2019 Standard Build 17763

# CVE: CVE-2024-39341
Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) leaves behind a configuration file (i.e. WebAPI.cfg.xml) after the installation process. This file can be accessed without authentication on HTTP port 80 by guessing the correct IIS webroot path. It includes system configuration parameter names and values with sensitive configuration values encrypted.

http://<CWserver>:80/cardwizardAPI_<CustomerAbbr>/WebAPI.cfg.xml

# CVE: CVE-2024-39342
Entrust Instant Financial Issuance (formerly known as Cardwizard) uses a DLL library (i.e. DCG.Security.dll) with a custom AES encryption process that relies on static hard-coded key values. These keys are not uniquely generated per installation of the software. Combined with the encrypted password that can be obtained from "WebAPI.cfg.xml" in CVE-2024-39341, the decryption is trivial and can lead to privilege escalation on the Windows host.