Programi Bilanc build 007 release 014 31.01.2020 leaves a static key in source code that any attacker can leverage to decrypt data.
e8143a10f9abe21e5d7712b11ead70ee3b98e732d5ee78ed8d06fcc8ff14de5f
Programi Bilanc - Build 007 Release 014 31.01.2020 - Broken encryption with guessable static encryption key
===============================================================================
Identifiers
-------------------------------------------------
CVE-2020-11719
Vendor
-------------------------------------------------
Balanc Shpk (https://bilanc.com)
Product
-------------------------------------------------
Programi Bilanc
Affected versions
-------------------------------------------------
Programi Bilanc - Build 007 Release 014 31.01.2020 and possibly below
Credit
-------------------------------------------------
Georg Ph E Heise (@gpheheise) / Lufthansa Industry Solutions (@LHIND_DLH)
Vulnerability summary
-------------------------------------------------
Remote attacker can decrypt data with minimal effort while local attackers can obtain the static key from the source code.
Technical details
------------------------------------------------
Remote attacker can decrypt data with minimal effort as the encryption used is outdated and broken. Local attackers with access to the software can obtain the static key from the source code.
Proof of concept
-------------------------------------------------
Withheld
Solution
-------------------------------------------------
Don’t use the software in its current version & contact vendor for a solution
Timeline
-------------------------------------------------
Date| Status
------------|--------------------
01–APR-2020 | Reported to vendor
30-JUN-2020 | End of 90 days Full Disclosure Time
17-DEZ-2020 | FULL disclosure