Description Preview
Patterson Application Service in Eaglesoft versions 18 through 21 contains a critical security flaw where the same certificate authentication is accepted across different customer installations running the same software version. This vulnerability allows attackers to gain remote access to SQL database credentials. While normal operation requires username/password authentication on the client side, this security control can be bypassed by developing a custom client that skips the authentication step, leading to unauthorized database access.
Overview
This vulnerability (CVE-2021-35193) is classified as CWE-295 (Improper Certificate Validation). The issue affects Patterson Eaglesoft dental practice management software versions 18 through 21. The core problem is that the Patterson Application Service uses the same certificate for authentication across different customer installations of the same version. An attacker with knowledge of this vulnerability can develop a custom client that bypasses the normal client-side authentication process and uses the certificate to gain access to SQL database credentials. This represents a significant security risk as it could lead to unauthorized access to sensitive patient data and dental practice information stored in the SQL database.
Remediation
Users of Patterson Eaglesoft versions 18 through 21 should:
- Contact Patterson Dental immediately to obtain and apply the latest security patches
- Ensure that each installation uses unique certificates for authentication
- Implement network segmentation to restrict access to the Patterson Application Service
- Monitor database access logs for any suspicious activity
- Consider implementing additional authentication mechanisms such as multi-factor authentication
- Follow the vendor's security advisories and update recommendations via the Patterson Eaglesoft support channels
References
- Vendor Advisory: http://patterson.eaglesoft.net/Home/Contact-Us
- Exploit Details: https://github.com/jshafer817/Eaglesoft
- Technical Analysis: https://justinshafer.blogspot.com/2021/07/eaglesoft-18-through-21-vulnerability.html
- CVE Details: CVE-2021-35193 (CWE-295: Improper Certificate Validation)
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
