CVE-2015-2805 in OmniSwitch
Summary
by MITRE
Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 with firmware 6.4.5.R02, 6.4.6.R01, 6.6.4.R01, 6.6.5.R02, 7.3.2.R01, 7.3.3.R01, 7.3.4.R01, and 8.1.1.R01 allows remote attackers to hijack the authentication of administrators for requests that create users via a crafted request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2024
The CVE-2015-2805 vulnerability represents a critical cross-site request forgery flaw in the web-based management interface of Alcatel-Lucent OmniSwitch series network devices. This vulnerability exists within the specific HTML page sec/content/sec_asa_users_local_db_add.html which handles user creation functionality in the device's administrative web interface. The flaw affects multiple high-end network switches including the 6450, 6250, 6850E, 9000E, 6400, 6855, 6900, 10K, and 6860 models across several firmware versions. The vulnerability stems from the absence of proper CSRF protection mechanisms in the user management endpoint, allowing malicious actors to craft specially designed requests that can be executed without the administrator's knowledge or consent.
The technical implementation of this vulnerability exploits the fundamental weakness in the web application's security model where the system fails to validate the origin of requests made to the user creation endpoint. When an administrator accesses the web interface and performs legitimate administrative tasks, the system typically maintains authentication state through session cookies or tokens. However, the CSRF vulnerability occurs because the application does not implement anti-CSRF tokens or other validation mechanisms to ensure that requests originate from the legitimate web interface rather than from malicious third-party websites or applications. This allows attackers to construct HTTP requests that, when triggered by an authenticated administrator, will execute with the administrator's privileges.
The operational impact of this vulnerability is severe and potentially catastrophic for network security. An attacker who successfully exploits this CSRF vulnerability can create new administrative user accounts within the switch's local database without the knowledge or consent of legitimate administrators. This unauthorized account creation capability provides persistent access to the network device's management interface, enabling attackers to perform various malicious activities including modifying network configurations, creating backdoor access points, disabling security features, or conducting man-in-the-middle attacks against network traffic. The vulnerability essentially allows attackers to establish a foothold within the network infrastructure that can persist even after the initial attack vector is closed, creating long-term security risks for the organization.
This vulnerability maps directly to CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in web applications. The ATT&CK framework categorizes this as a privilege escalation technique under T1078, where adversaries gain access to systems through valid accounts. The impact aligns with T1566, which covers the use of malicious web content to gain access to systems. Organizations should implement comprehensive mitigations including the immediate deployment of firmware updates from Alcatel-Lucent addressing this vulnerability, implementing web application firewalls to detect and block CSRF attacks, and establishing robust monitoring for unauthorized user account creation activities. Network segmentation and least-privilege access controls should also be reinforced to limit the potential damage from successful exploitation. Additionally, administrators should be trained to recognize and report suspicious administrative activities that might indicate unauthorized account creation attempts.