CVE-2023-47800: Natus Neuroworks EEG RCE Vulnerability

CVE-2023-47800 Overview

CVE-2023-47800 is a critical hardcoded credentials vulnerability affecting Natus NeuroWorks and SleepWorks medical software before version 8.4 GMA3. The vulnerability exists because these applications utilize a default password of xltek for the Microsoft SQL Server service sa (system administrator) account. This security flaw allows threat actors to perform remote code execution, data exfiltration, or other malicious actions including tampering with medical data or destroying/disrupting MSSQL services.

Critical Impact

Attackers can gain full administrative access to the underlying SQL Server database using the hardcoded credentials, potentially compromising sensitive medical data including EEG and sleep study records, and executing arbitrary code on the database server.

Affected Products

• Natus NeuroWorks EEG (versions before 8.4 GMA3)
• Natus SleepWorks (versions before 8.4 GMA3)
• Microsoft SQL Server instances configured by these applications

Discovery Timeline

• 2023-11-10 - CVE-2023-47800 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-47800

Vulnerability Analysis

This vulnerability is classified as CWE-798 (Use of Hard-coded Credentials), a severe security weakness commonly found in applications that embed authentication credentials directly in their source code or configuration. In this case, Natus NeuroWorks and SleepWorks applications ship with a preconfigured Microsoft SQL Server instance using the default sa account password xltek.

The sa account in Microsoft SQL Server is the built-in system administrator account with unrestricted access to all database operations. When an attacker discovers this hardcoded credential, they gain complete control over the database server, including the ability to read, modify, or delete all data, create new administrative accounts, and potentially execute operating system commands through SQL Server's extended stored procedures like xp_cmdshell.

Root Cause

The root cause of this vulnerability is the insecure default configuration practice where the application installer configures Microsoft SQL Server with a well-known, hardcoded password for the sa account. This design decision likely prioritized ease of installation and configuration over security, assuming the systems would be deployed in isolated network environments. However, this assumption fails when these medical devices are connected to networks accessible by unauthorized users.

Attack Vector

The attack vector for CVE-2023-47800 is network-based and requires no authentication or user interaction. An attacker with network access to the SQL Server instance (typically TCP port 1433) can connect using the hardcoded credentials. Once authenticated as sa, the attacker has multiple exploitation paths:

1. Data Exfiltration: Query and extract all patient medical records, EEG data, and sleep study information stored in the database
2. Remote Code Execution: Enable and use xp_cmdshell to execute arbitrary operating system commands
3. Data Tampering: Modify medical records, potentially leading to misdiagnosis or improper treatment
4. Service Disruption: Delete databases, corrupt data, or shut down the SQL Server service entirely

The attacker would typically use SQL Server management tools or command-line utilities to connect to the vulnerable instance:

sqlcmd -S <target_ip> -U sa -P xltek

Once connected, enabling command execution is straightforward through SQL Server configuration options, allowing the attacker to execute system commands with the privileges of the SQL Server service account.

Detection Methods for CVE-2023-47800

Indicators of Compromise

• Failed or successful SQL Server authentication attempts using the sa account from unexpected source IP addresses
• Unusual database queries targeting patient records or system tables
• Activation or usage of xp_cmdshell extended stored procedure
• New user accounts or login credentials created in SQL Server
• Unexpected network connections to SQL Server port 1433 from external networks

Detection Strategies

• Monitor SQL Server authentication logs for sa account login attempts, especially from non-administrative workstations
• Implement network intrusion detection rules to identify SQL Server authentication traffic containing the known default password
• Deploy database activity monitoring to detect unusual query patterns or bulk data extraction
• Configure alerts for changes to SQL Server configuration, particularly enabling of dangerous extended stored procedures

Monitoring Recommendations

• Enable SQL Server audit logging and forward logs to a centralized SIEM solution
• Monitor for new network connections to TCP port 1433 from unauthorized systems
• Implement file integrity monitoring on the SQL Server data directories
• Review SQL Server login activity regularly for unauthorized access patterns

How to Mitigate CVE-2023-47800

Immediate Actions Required

• Change the sa account password immediately to a strong, unique password that meets organizational security requirements
• Disable the sa account if not required and use Windows Authentication mode instead
• Restrict network access to SQL Server to only authorized systems using firewall rules
• Audit existing database contents for signs of unauthorized access or data modification
• Review SQL Server configuration to ensure xp_cmdshell and other dangerous features are disabled

Patch Information

Natus has released version 8.4 GMA3 of NeuroWorks and SleepWorks which addresses this vulnerability. Organizations should upgrade to version 8.4 GMA3 or later. For detailed patch information and installation guidance, refer to the Natus Security Bulletin. Additional technical details are available in the Trustwave Security Advisory TWSL2023-006.

Workarounds

• Implement network segmentation to isolate medical devices from general network traffic
• Configure host-based firewall rules on the SQL Server host to restrict connections to authorized IP addresses only
• Disable SQL Server Browser service to prevent service discovery
• Enable SQL Server audit logging to detect and investigate unauthorized access attempts
• Consider implementing a database activity monitoring solution for additional visibility

# SQL Server configuration to disable dangerous features
# Run in SQL Server Management Studio or sqlcmd

-- Disable xp_cmdshell
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;

-- Change sa password (replace with strong password)
ALTER LOGIN sa WITH PASSWORD = 'YourNewStrongPassword123!';

-- Optionally disable sa account
ALTER LOGIN sa DISABLE;