Tenable found an authentication bypass vulnerability in HPE Edgeline Infrastructure Manager (EIM) version 1.21.
When the user logs in to the web application for the first time with the default password for the existing Administrator account, the user is prompted to change the password for the account. The password change is carried out by sending a request to URL /redfish/v1/SessionService/ResetPassword/1. However, after the password change, an unauthenticated remote attacker can use the same URL to reset the password for the Administrator account.
After the password reset, the attacker can login to the web application with the new/correct Administrator password by sending a request to URL /redfish/v1/SessionService/Sessions. The attacker can then change the password of the OS root account by sending a request to URL /redfish/v1/AccountService/Accounts/1. This allows the attacker to SSH to the EIM host as root.
The following shows the attack steps:
Update (May 25, 2021):
The version 1.22 fix for the vulnerability (CVE-2021-29203) is incomplete as the mitigation can be bypassed. Users are encouraged to upgrade to the 1.23 version in order to mitigate this issue. The initial patch attempts to fix the vulnerability by ensuring only the console user can reset the Administrator password by checking whether the Origin header in the HTTP request has the value of 'https://127.0.0.1':
However, an unauthenticated remote attacker can set the Origin header to 'https://127.0.0.1', thus bypassing the mitigation:
The attacker can then login to the EIM GUI using the newly reset Administrator password. From the GUI, he resets the Administrator password again, this time the URL to reset the Administrator password is /redfish/v1/AccountService/Accounts/1, which is different than /redfish/v1/SessionService/ResetPassword/1. This operation resets the password for both the Administrator webapp user and the OS root user. This allows the attacker to SSH to the EIM host as root.
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]