BizRobo! Hard-Coded Cryptographic Key Vulnerability

A vulnerability exists in all versions of BizRobo! due to the use of a hard-coded cryptographic key. This issue allows for the potential decryption of credentials stored in robot files, as they are encrypted with the same single key. The vulnerability could be exploited if the encryption key is obtained.

Impact

If the encryption key is available, credentials within robot files can be decrypted and accessed.

Reproduction

To reproduce this vulnerability, access to a robot file is required. This can be achieved by logging into the Management Console with a user that has permission to use the robot, and accessing the backup files or the database where the robot file data is stored. Once the robot file is obtained, if the hard-coded encryption key is also acquired, the encrypted credentials can be decrypted.

Remediation

The vendor recommends applying the provided workaround information to the deployment environment.