## https://sploitus.com/exploit?id=CEB6CBD3-5A67-5F5C-A2FF-3BFA78364A95
# CVE-2023-3349 / CVE-2023-3350 | IBERMATICA RPS 2019
Security research documenting an unauthenticated information disclosure and a
cryptographic design flaw in **IBERMATICA RPS 2019**.
The vulnerabilities can be chained to expose application logs containing
authentication-related SQL queries and recover user passwords from reversible
AES-CBC ciphertext.
> [DISCLAIMER]
> This repository is provided for security research, defensive validation, and
> educational purposes only. Test exclusively on systems you own or are
> explicitly authorized to assess.
## Summary
An unauthenticated user can access the RPS service status page at:
```text
/RPS2019Service/status.html
```
The page exposes operational logging controls and allows generated logs to be
downloaded. These logs may contain sensitive application data, including
usernames, IP addresses, SQL queries, and password-related values.
Passwords are not protected with a one-way password hashing function. Instead,
RPS 2019 uses AES-128-CBC with keying material derived predictably from the
username. Once a username and its encrypted password value are obtained from
the logs, the password can be recovered in plaintext.
## Vulnerabilities
| CVE | Description | CWE | CVSS 3.1 (CNA) |
| --- | --- | --- | --- |
| [CVE-2023-3349](https://nvd.nist.gov/vuln/detail/CVE-2023-3349) | Unauthenticated exposure of sensitive information through downloadable application logs | CWE-200 | 8.2 High |
| [CVE-2023-3350](https://nvd.nist.gov/vuln/detail/CVE-2023-3350) | Reversible password protection based on AES-128-CBC and predictable username-derived keying material | CWE-327 | 8.2 High |
## Affected product
- **Product:** IBERMATICA RPS
- **Affected version:** RPS 2019
- **Component:** RPS 2019 Service status and logging functionality
## Attack chain
1. Access the exposed RPS status page without authentication.
2. Enable application logging through the available status-page controls.
3. Trigger or wait for authentication activity.
4. Download the generated log file.
5. Extract usernames and encrypted password values from logged SQL queries.
6. Derive the AES keying material from the corresponding username.
7. Decrypt the stored value and recover the password in plaintext.
No SQL injection, password brute force, or prior application account is
required for this chain.
## Technical notes
The investigation identified the following conditions:
- Debug logs contain complete SQL queries related to authentication.
- Login attempts for nonexistent usernames may log the supplied password in
plaintext.
- Existing-user passwords appear as Base64-encoded ciphertext in SQL queries.
- The encryption scheme uses AES-128 in CBC mode.
- The key and initialization vector are deterministically derived from the
username and padded to 16 bytes with a fixed character.
- The same predictable value is used as both key and IV.
AES is not the underlying problem by itself. The vulnerability results from
using reversible encryption for passwords, predictable keying material, and an
IV that is neither random nor independent.
## Impact
Successful exploitation may allow a remote, unauthenticated attacker to:
- retrieve sensitive operational and application information;
- enumerate valid usernames and infrastructure details;
- obtain plaintext passwords;
- compromise privileged RPS accounts;
- reuse exposed credentials against other services where passwords have been
shared.
## Remediation and hardening
- Apply the vendor-provided update or mitigation for RPS 2019.
- Remove public access to `/RPS2019Service/status.html`.
- Require strong authentication and authorization for all diagnostic,
administrative, status, health, debug, and metrics endpoints.
- Disable production debug logging when it is not strictly required.
- Redact credentials, authentication data, and complete SQL queries from logs.
- Store passwords with a modern, salted, one-way password hashing function such
as Argon2id, scrypt, or bcrypt.
- Rotate all credentials that may have appeared in affected logs.
- Review historical access logs for requests to the status page and log
downloads.
- Prevent direct Internet exposure of ERP management and support interfaces.
## Detection opportunities
Defenders should investigate:
- unexpected requests to `/RPS2019Service/status.html`;
- requests that enable, stop, delete, or download application logs;
- access to status or diagnostic endpoints from untrusted networks;
- unusual authentication events following access to RPS log files;
- reuse of RPS credentials against other internal or external services.
## Disclosure
The issues were discovered by **LABS @ ITRES** during an authorized offensive
security engagement and were assigned CVE identifiers through INCIBE-CERT.
A detailed technical write-up is available in the first entry of the
**Old Dives** series:
- [Old Dives #01: The RPS Status Page That Gave Passwords Back](https://labs.itresit.es/2026/07/28/old-dives-01-the-status-page-that-gave-passwords-back-cve-2023-3349-cve-2023-3350/)
## References
- [CVE-2023-3349 — NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-3349)
- [CVE-2023-3350 — NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-3350)
- [Multiple vulnerabilities in IBERMATICA RPS 2019 — INCIBE-CERT](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ibermatica-rps-2019)
- [LABS @ ITRES](https://labs.itresit.es/)
## Legal notice
The information in this repository is intended to help organizations identify,
validate, and remediate the documented vulnerabilities. The authors and
contributors are not responsible for misuse or damage resulting from the use
of this material.