CVE-2019-10648

EUVD-2019-0427 · Published Apr 2, 2019

Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.

Technologies

Robocode Robocode

Weaknesses

CWE-862CWE-20

CVSS scores

v3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Stealth Defense Impairment Credential Access

T1190Exploit Public-Facing Application T1211Exploitation for Stealth T1542.002Component Firmware T1556Modify Authentication Process

References

https://github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bd#diff-0296a8f9d4a509789f4dc4f052d9c36f
https://sourceforge.net/p/robocode/bugs/406/
https://nvd.nist.gov/vuln/detail/CVE-2019-10648
https://sourceforge.net/p/robocode/bugs/406

Potentially impacted assets

See if this affects your attack surface