Vulnerability

BD Kiestra lab automation lets privileged accounts issue SQL commands that can corrupt data

MedDevice Cyber Staff · May 22 · 2 min read · Via CISA ICSMA-18-142-01

CISA published advisory ICSMA-18-142-01 on May 22, 2018, for BD Kiestra TLA, WCA and InoqulA+ specimen processing systems. Two CVEs are listed, both CWE-356 (product UI does not warn user of unsafe actions). CVE-2018-10593 (CVSS v3 5.6) affects DB Manager 3.0.1.0 and PerformA 3.0.0.0 and earlier; CVE-2018-10595 (CVSS v3 6.3) affects ReadA Overview 1.1.0.2 and earlier. BD reported the issues itself.

In both cases an authorized user with a privileged account on a Kiestra system can issue SQL commands, which may corrupt data or, in ReadA's case, lose it. The CVSS vectors require adjacent network access, high privileges and user interaction, which keeps the scores moderate. The integrity and availability impacts are rated high anyway, because a lab automation database holds the state of specimens moving through the line.

BD's mitigation stops privileged users from triggering SQL functions. It also closes a limited exposure of ePHI patient data that a privileged user could see by running a select statement in ReadA Overview. BD said it was deploying the fix remotely or on premise depending on customer preference, with compensating controls to use in the meantime.

Privileged accounts on lab systems tend to be shared by many technicians. A UI that hands those accounts a raw SQL path makes every shared login a data integrity risk.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Schedule BD's Kiestra mitigation, delivered remotely or on site, for DB Manager, PerformA and ReadA Overview. Until it is applied, follow BD's compensating controls from its product security bulletin. Limit who holds privileged Kiestra accounts and review their use.

Book the BD mitigation. Contact BD lab automation support to schedule the remote or on-premise deployment for each Kiestra system.
Cut privileged accounts. Reduce the number of people holding privileged Kiestra logins and stop sharing them across shifts.
Check data integrity. Reconcile Kiestra database records against instrument and LIS records to spot corruption.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database

Contributing

Role-based access Handles patient data

Kiestra TLA, WCA and InoqulA+

Patient or study database Role-based access Handles patient data

Fix the class in your product

Input reaches the database as query text. As the maker, parameterize every query so input is never concatenated into SQL, run on a least-privilege database account, and enforce it with a static-analysis gate so a concatenated query fails the build.

Parameterize every query. No exceptions for internal or trusted callers; bind inputs, never build statement text from them.
Least-privilege the database role. The app account cannot alter schema or reach unrelated tables.
Gate it in CI/CD. Static analysis fails a build that concatenates a query.

Mapped EMB3D mitigations

Questions & Answers

What are CVE-2018-10593 and CVE-2018-10595 in BD Kiestra?

They are two CWE-356 vulnerabilities, scored CVSS v3 5.6 and 6.3, disclosed in CISA advisory ICSMA-18-142-01 on May 22, 2018. They let a privileged user on a BD Kiestra TLA, WCA or InoqulA+ system issue SQL commands through DB Manager 3.0.1.0, PerformA 3.0.0.0 and earlier, or ReadA Overview 1.1.0.2 and earlier, which may corrupt or lose data.

How is BD fixing the Kiestra SQL command vulnerability?

BD developed a mitigation that prevents privileged users from triggering SQL functions on BD Kiestra systems and closes a limited ePHI exposure in ReadA Overview. Per CISA advisory ICSMA-18-142-01, BD deploys it remotely or on premise depending on user preference.

← Back to Vulnerabilities

Sources

BD: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: BD