Corporate VPN Security Breach Exposed Sensitive Data

Critical CVSS 10.0 Flaws in B. Braun OnlineSuite Threaten Healthcare Infrastructure

Estimated reading time: 10 minutes

Key Takeaways:

• Critical vulnerabilities in B. Braun’s OnlineSuite AP 3.0 pose significant risks to healthcare infrastructure.
• These vulnerabilities include Remote Code Execution (RCE), Relative Path Traversal, and a Hardcoded Administrative Account.
• Immediate patching and implementation of security best practices are crucial to mitigate these risks.

Table of Contents:

• Understanding the Critical CVSS 10.0 Flaws in B. Braun OnlineSuite
• Vulnerability Details
• Impacted Systems and Scope
• Technical Analysis of the Vulnerabilities
• CVE-2025-3322 – Remote Code Execution via Expression Injection
• CVE-2025-3365 – Relative Path Traversal
• CVE-2025-3321 – Hardcoded Administrative Account
• Mitigation Strategies and Best Practices
• Actionable Advice
• For Technical Readers
• For Non-Technical Readers
• How PurpleOps Can Help
• FAQ

A critical vulnerability has been identified in B. Braun’s OnlineSuite AP 3.0, posing a significant risk to healthcare infrastructure. This blog post will detail the nature of these vulnerabilities, their potential impact, and recommended mitigation strategies. Understanding the severity and scope of these flaws is crucial for maintaining the integrity of hospital IT systems and protecting sensitive medical data.

Understanding the Critical CVSS 10.0 Flaws in B. Braun OnlineSuite

B. Braun Melsungen AG recently issued a security advisory regarding three severe vulnerabilities affecting its OnlineSuite AP 3.0 and earlier versions. One of these vulnerabilities has been assigned a maximum CVSS score of 10.0, indicating its critical nature. While there is no indication that patient safety has been compromised, these flaws present a serious risk to hospital IT infrastructure and the confidentiality, integrity, and availability of medical data.

Vulnerability Details

The vulnerabilities identified in B. Braun OnlineSuite AP 3.0 include:

1. CVE-2025-3322 (CVSS 10.0) – Remote Code Execution (RCE) via Expression Injection: This vulnerability allows an attacker to execute arbitrary code on the server with the highest privileges. The root cause is improper sanitization of inputs used in Expression Language statements. An attacker can inject malicious code through an improperly neutralized input field, gaining full control of the server.
2. CVE-2025-3365 (CVSS 9.8) – Relative Path Traversal: This vulnerability enables attackers to read any file on the server due to the absence of proper path validation. This can lead to the exposure of sensitive information and system files.
3. CVE-2025-3321 (CVSS 9.3) – Hardcoded Administrative Account: A non-removable, undocumented administrative account exists on the affected servers. Although not remotely exploitable, any local user with server access can leverage this account for privilege escalation.

Impacted Systems and Scope

The vulnerabilities affect OnlineSuite AP 3.0 and earlier, which are deployed across critical healthcare infrastructure globally. While the vulnerabilities do not directly impact infusion pumps or other patient-facing devices, they reside in backend systems that manage configuration, data transfer, and user access. These systems support healthcare and public health sectors, making them attractive targets for sophisticated cyberattacks. Compromising these systems can lead to severe consequences, including:

• Data Breaches: Attackers can gain access to sensitive patient data, leading to privacy violations and regulatory penalties.
• System Disruption: Remote code execution can allow attackers to disrupt critical healthcare operations, potentially affecting patient care.
• Privilege Escalation: Unauthorized access to administrative accounts can enable attackers to further compromise the network.

Technical Analysis of the Vulnerabilities

A deeper dive into each vulnerability reveals the technical specifics that allow for exploitation.

CVE-2025-3322 – Remote Code Execution via Expression Injection

The root cause of this vulnerability lies in the improper sanitization of input fields that are used in Expression Language statements. Expression Languages are used to perform computations and logic within applications. If an application does not properly validate or sanitize input to these expressions, an attacker can inject malicious code that will be executed by the server.

For instance, consider a scenario where the OnlineSuite AP 3.0 uses an expression language to calculate a value based on user input. If an attacker can inject a malicious expression, such as one that executes a system command, they can gain control of the server.

Example:

    // Vulnerable Code
    String userInput = request.getParameter("expression");
    Object result = ExpressionEvaluator.evaluate(userInput); // UNSAFE

In this example, if the userInput is not properly sanitized, an attacker can inject code like "Runtime.getRuntime().exec('malicious_command')", leading to remote code execution.

CVE-2025-3365 – Relative Path Traversal

Path traversal vulnerabilities occur when an application allows users to input file paths without proper validation. This enables an attacker to access files and directories outside of the intended scope, potentially leading to the exposure of sensitive information.

In the context of OnlineSuite AP 3.0, if the application does not properly validate file paths provided by users, an attacker can use relative paths (e.g., ../) to navigate the file system and access arbitrary files.

Example:

    // Vulnerable Code
    String filePath = request.getParameter("file");
    File file = new File("/var/www/data/" + filePath); // UNSAFE
    FileInputStream fis = new FileInputStream(file);

If the filePath is "../../../../etc/passwd", the attacker can read the system’s password file.

CVE-2025-3321 – Hardcoded Administrative Account

A hardcoded administrative account represents a significant security flaw. If an application contains an account with fixed credentials that cannot be changed or removed, any user with local access to the server can exploit this account to gain elevated privileges.

In the case of OnlineSuite AP 3.0, the existence of an undocumented admin account allows a local attacker to easily escalate their privileges and perform administrative tasks, potentially compromising the entire system.

Mitigation Strategies and Best Practices

B. Braun has released FSI 14-25 “OnlineSuite AP3.0 – Security Fix” to address these vulnerabilities. Immediate implementation of this patch is crucial. In addition to patching, the following security best practices are recommended:

• Network Segmentation: Use firewalls to isolate medical devices from business networks, limiting the potential impact of a breach.
• Access Control: Restrict server access to essential personnel only, reducing the attack surface.
• Dedicated Server Deployment: Deploy OnlineSuite on a dedicated server with no additional services to minimize the risk of interference.
• Regular Monitoring and Threat Detection: Implement monitoring solutions to detect unusual activity, such as large-scale data exports or unauthorized access attempts. Consider deploying a cyber threat intelligence platform to stay informed about emerging threats.
• Principle of Least Privilege: Apply the principle of least privilege to limit who has access to powerful tools like Data Loader, ensuring only authorized users have the necessary permissions.
• Application Approval Process: Manage connected apps meticulously, ensuring any new app undergoes a formal approval process before being granted access to Salesforce.
• IP Restriction: Restrict logins and app authorizations to trusted IP ranges to prevent unauthorized access, particularly from attackers using VPNs.
• Multi-Factor Authentication (MFA): Enforce MFA for all accounts to add an extra layer of security, especially against phishing attempts.
• Implement a comprehensive breach detection system to identify and respond to unauthorized access attempts swiftly.
• Utilize a dark web monitoring service to detect any mention of your organization’s data or credentials on underground forums.
• Integrate a live ransomware API to stay updated on the latest ransomware threats targeting the healthcare sector.
• Monitor telegram threat monitoring channels for early warnings about potential attacks.
• Implement supply-chain risk monitoring to assess the security posture of third-party vendors and partners.
• Leverage underground forum intelligence to understand attacker tactics and motivations.
• Set up brand leak alerting to get notified of any exposed credentials or sensitive information.