lisa-2905/cve-2024-56428Proof-of-concept exploit for CVE-2024-56428 that reads cleartext credentials from iLabClient's local Apache Derby database.
Cleartext credentials in local database of the iLabClient
The iLabClient is used to download the results from the laboratory server. The configuration data
are stored locally in the Apache Derby instance iLabClient. The password is stored in plain text. In order to
be able to read this, a connection to the local database must first be established, for example as described in
CVE-2024-56429.
Read out the passwords:
select EINSTELLUNGEN from configs;
The get_configs.sh script can be executed to read out the configuration data. It is important that
no other program (e.g. the iLabClient itself) accesses the database during execution.
Explanations to the script:
#! /bin/bash
"C:\ilabClient\java8u422\bin\java.exe" -jar ".\derby-lib\derbyrun.jar" ij script_sql.sql
read
"C:\ilabClient\java8u422\bin\java.exe": Use of the Java version supplied with the installation of the client. Change
this if the client was installed in a different directory.
-jar: Instruction that a JAR file is to be executed
".\derby-lib\derbyrun.jar ij" Execution of the ij tool from Apache Derby
script_sql.sql: Script that reads out the corresponding configurations. Change the path to the database in this file
when the client was installed in a different directory.
Discoverer: Lisa Ulbrich (Lufthansa Industry Solutions AS GmbH)