Thursday, June 16, 2016

HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities

HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities

Confirmed on firmware version 4.10
HPE PSRT response: Upgrade to MSL6480 is 4.90 (current version)

Weak Credentials Management
The device comes with weak, default login credentials - security/security - and the application does not enforce a mandatory, password change from default to strong password values.

Access Control Issues
An unauthenticated user can download system configuration archive. Archive Filename can be guessed with a bit of scripting.
Filename format is as follows:
/syslog-MSL6480-A60A80-<v.er>-YYYY-MM-DD_HH-MM-SS-SSS_<AM_or_PM>.zip
For example, anyone can download the config by requesting the url:

Vulnerable to Cross-Site Request Forgery
There is no CSRF Token generated per page and / or per (sensitive) function. Successful exploitation of this vulnerability may allow silent execution of unauthorized actions on the device such as password change, configuration parameter changes, generating system configuration archive, saving modified configuration, & device reboot.


+++++
Cheers!

No comments:

Post a Comment

Disclaimer

The views, information & opinions expressed in this blog are my own and do not reflect the views of my current or former employers or employees or colleagues.