-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2021-038 
Product:                   MIK.starlight Server
Manufacturer:              MIK GmbH
Affected Version(s):       -
Tested Version(s):         7.9.5.24363
Vulnerability Type:        CWE-798: Use of Hard-Coded Credentials
Risk Level:                Medium
Solution Status:           Open
Manufacturer Notification: 2021-07-02
Solution Date:             -
Public Disclosure:         2021-08-27
CVE Reference:             -
Author of Advisory:        Nicola Staller, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

The MIK.starlight server is a web server that provides the basis for the 
MIK.starlight suite. 

The manufacturer describes the product as follows (see [1]):

"MIK.starlight suite offers exceptional customisable user interfaces
for data analytics and reporting. With our self-service business 
intelligence solutions, users can easily create their own reports or 
adapt existing ones, freeing up time and ensuring optimum flexibility."

The use of hard-coded credentials may allow unauthorized access to the
application.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The source code of the MIK.starlight server contains a hard-coded 
password.



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

- -
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

SySS is not aware of a solution for the described security issue.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2021-07-02: Vulnerability reported to manufacturer
2021-08-27: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for MIK.starlight
    https://www.mik.de/starlight-bi-suite-2/
[2] SySS Security Advisory SYSS-2021-038
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-038.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Nicola Staller of SySS 
GmbH.

E-Mail: nicola.staller@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Nicola_Staller.asc
Key ID: 0x41DD2290
Key Fingerprint: A127 394A F398 B097 2332  637C 9DF3 39F9 41DD 2290  

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoSc5SvOYsJcjMmN8nfM5+UHdIpAFAmEnTyEACgkQnfM5+UHd
IpBX9Q/+MLkPSHBswdQmttiOz8BkaI+Y/uS4CEepv/2JFB8O1vRK9eNcRDRsNZw7
lAW+nFkIGabe9p8BDDjNQ7PUfT+BDdzLliLxD3kLJN5gxCTn2Ol4TeIs/09xsypE
NWEwctj16xT3RyImzFy628HIhwcvcru2G8BN+qHMCepp2r2tJjrspq8S6IuX5HPx
HWXSpg9cZu5Yu0+gQAUlcZpL+aIJHki2on/Km6SWCO0Bs1Ozo2YfvX+x4xAL2fsa
z0PxKWDMeCUqt13MJjUM+39vHaegp/SWIuURgfkMCE/u3FdpOCl1lT052SyweTM+
7LXijMnBVk9jcuaB6XiRX21d/yWiZE/zfAlmdS9yCk2JiEb0chPoXX3nw7DPa1bE
gZdMjBz8RJw7+K/ulPh1vNGj0rVSzLId7hlGo+hmn3xkfr6713wd7C7eGl54PJTs
Uk0p8ST3KARZFV7X+Mw+AWpkivcXDA/ZUFdvkeIPTgl482c7YUw6IrTFRmV+ajd7
bf1PP9sVGQvmJoBuTlM24LFP3GUgHc9OxWIvnCbVFjJ4lv9NVF5SREAQUhviqgKE
pRgQKLfrD4ZuEi/6f3jl3miwWEEpJxIR8k4c+M3Mxud6nkIJNytck/8tPGFRaWgA
JSREmdJZKZlez1XTt5BfD7ZwHxoxP1NKdavrnVSP/eGM6cbQ23U=
=ViEB
-----END PGP SIGNATURE-----