^{CVE-2021-3380:}ICREM H8 SSRMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Print Invoice Functionality that allows attackers to access sensitive information.

Overview

The vulnerability exists in the Print Invoice Functionality of ICREM H8 SSRMS, a carrier-grade OSS/BSS system. The application fails to properly validate that the user has appropriate permissions to access the requested invoice data. By manipulating parameters that directly reference internal objects (such as invoice IDs), an attacker can access invoices belonging to other customers or organizations. This IDOR vulnerability occurs because the application uses client-supplied input to directly access objects without sufficient authorization checks. The vulnerability has been documented in Exploit-DB (ID: 49508) and represents a significant privacy and confidentiality risk for organizations using the affected software.

Remediation

Organizations using ICREM H8 SSRMS should implement the following remediation steps:

1. Update to the latest version of the software if a patch is available from Height8 Technology.
2. Implement proper access control checks that validate user permissions before allowing access to invoice data.
3. Use indirect reference maps where object references are mapped to user-specific values rather than using direct database identifiers.
4. Implement session-based validation to ensure users can only access resources they are authorized to view.
5. Consider implementing additional security controls such as:
   • Proper logging and monitoring of access to sensitive information
   • Rate limiting to prevent automated exploitation attempts
   • Input validation to reject unexpected parameter values

Contact Height8 Technology support for specific patch information and additional security guidance.

References

1. Exploit Database: https://www.exploit-db.com/exploits/49508
2. Vendor Advisory: http://www.height8tech.com/carrier-grade-OSS-BSS.php
3. Height8 Technology: http://height8.com
4. ICREM Product Information: http://icrem.com
5. CWE-639: Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html