CVE-2020-24548 : Security Advisory and Response

Ericom Access Server 9.2.0 allows SSRF to make outbound WebSocket connection requests on arbitrary TCP ports, potentially exposing closed ports to attackers.

Understanding CVE-2020-24548

This CVE involves a Server-Side Request Forgery (SSRF) vulnerability in Ericom Access Server 9.2.0.

What is CVE-2020-24548?

Ericom Access Server 9.2.0 permits SSRF, enabling attackers to initiate WebSocket connections on any TCP port.
Attackers can receive error messages indicating closed ports, aiding them in reconnaissance.

The Impact of CVE-2020-24548

Malicious actors can exploit this vulnerability to scan internal systems, potentially leading to further attacks.

Technical Details of CVE-2020-24548

This section delves into the specifics of the vulnerability.

Vulnerability Description

Ericom Access Server 9.2.0 is susceptible to SSRF, allowing attackers to establish outbound WebSocket connections on various TCP ports.

Affected Systems and Versions

Product: Ericom Access Server 9.2.0
Vendor: Ericom
Versions: All versions are affected.

Exploitation Mechanism

Attackers can manipulate the SSRF vulnerability to scan for open ports and gather information for potential attacks.

Mitigation and Prevention

Protecting systems from CVE-2020-24548 is crucial to prevent unauthorized access and data breaches.

Immediate Steps to Take

Implement firewall rules to restrict outbound traffic and prevent SSRF attacks.
Regularly monitor network traffic for suspicious activities.
Apply security patches and updates provided by Ericom to address the vulnerability.

Long-Term Security Practices

Conduct regular security assessments and penetration testing to identify and mitigate vulnerabilities.
Educate users and IT staff on the risks of SSRF attacks and best practices for secure web application development.
Consider implementing a Web Application Firewall (WAF) to filter and block malicious traffic.

Patching and Updates

Ericom should release patches or updates to fix the SSRF vulnerability in Access Server 9.2.0.