Critical HPE 3PAR Vulnerability Discovery Details
This blog covers a recent security vulnerability found by a team of Pen Testers at MindPoint Group during a customer engagement. We'll walk through the issue descriptions, steps to reproduce the vulnerability, and our recommendations for remediating.
Common Vulnerability Exploit (CVE):
Difficulty to Exploit: Easy
Hewlett Packard Enterprise (HPE)
HPE 3PAR Service Processor prior to 126.96.36.199
Elwood Buck, Nolan Kennedy, and Dorian Aylward
Authentication bypass and stored XSS vulnerability in HPE 3PAR Service Processor prior to 188.8.131.52 allows remote unauthenticated attackers to extract sensitive information and embed malicious content into the appliance.
- Transmitting private data (cookie & session information),
- Redirecting the victim to attacker-controlled web content, and
- Performing malicious operations on the user’s machine.
Steps to Reproduce:
Since this finding was identified in the last hour of the last day of an engagement it is not the most thorough PoC. However, it should still provide an overview of the substantive issues while also reminding us to never give up on time-constrained penetration tests. It can be helpful to walk into engagements thinking that there is a vulnerability, and we just have to turn over the right stone to find it. This reminder may be particularly helpful when you’re testing the same application 2-3 times over the course of a year or two, and you think that there is nothing left to find.
After manually reviewing the application GUI as an unauthenticated user, we switched on burp and noticed the application was displaying sensitive information when making calls to the preferences service endpoint. Specifically, we noticed that the responses included HREFs to what appeared to be valid user email addresses and the corresponding user preferences. We ran the HREF URLs through burp and received passwords to an SMTP server and other sensitive information: names, locations, addresses, etc.
We collected the displayed information and decided it would be worthwhile to attempt to change the values. We replicated the syntax provided to us when querying the preferences URLs for the banner message value (sensitive information sanitized):
We switched the request from GET to POST, added the Content-Length, Content-Type, and our JSON payload and fired it off. We re-navigated to the login page where the banner message was displayed, and it worked!
In addition to collecting sensitive information that could be used for further exploitation, we were planning on using the stored XSS to capture usernames and passwords after legitimate users logged into the appliance. Stored XSS is always bad, but being vulnerable on your login page can be especially detrimental.
Thanks to HPE for the quick turnaround and responsiveness to addressing the vulnerabilities we reported to them. They also gave us recognition on their security advisory!
We were unable to get to the root of the authentication issue but it appeared that the API portion of the application did not perform user validation through session tokens, credentials, or an API key.
Follow OWASP's guidance on authentication and XSS mitigation.
6/4/2019 – Vendor notified and ticket assigned
7/9/2019 – Patch released
8/1/2019 – Security advisory published
MindPoint Group's Pen Testing Services:
The vulnerability listed above was an unknown vulnerability, found during one of our pen testing engagements. MindPoint Group offers a variety of Security Operations services (like pen testing) to help your organization identify and mitigate risk and defend against ever-growing threats. Contact us to learn more.