CVE-2022-33174 in PDU
Summary
by MITRE • 06/13/2022
Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface (/cgi/get_param.cgi) with the tmpToken cookie set to an empty string followed by a semicolon. This bypasses an active session authorization check. This can be then used to fetch the values of protected sys.passwd and sys.su.name fields that contain the username and password in cleartext.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/14/2022
This vulnerability exists in Power Distribution Units (PDUs) utilizing Powertek firmware across multiple vendor implementations, affecting versions prior to 3.30.30. The flaw represents a critical authorization bypass issue that undermines the web interface security controls designed to protect administrative access to these critical infrastructure devices. The vulnerability specifically targets the session validation mechanism within the web application layer, exploiting a weakness in how the system processes authentication tokens. The affected devices typically serve as essential components in data center and server room environments, managing power distribution to critical computing infrastructure, making their compromise particularly dangerous from a cybersecurity perspective.
The technical exploitation mechanism involves crafting a specific HTTP request to the data retrieval interface at /cgi/get_param.cgi with a malformed tmpToken cookie value consisting of an empty string followed by a semicolon. This particular cookie manipulation bypasses the active session authorization check that should validate user credentials before granting access to protected system parameters. The vulnerability stems from insufficient input validation and improper session handling within the firmware's web server implementation, creating a path for unauthenticated attackers to access sensitive system information. This flaw allows attackers to escalate their privileges without proper authentication, effectively circumventing the security controls that should prevent unauthorized access to administrative functions.
The operational impact of this vulnerability is severe and multifaceted, particularly in environments where PDUs control power distribution to critical systems. An attacker who successfully exploits this vulnerability gains access to cleartext credentials stored in the sys.passwd and sys.su.name fields, which contain the administrative username and password necessary for full system control. This access enables attackers to perform complete administrative operations including changing passwords, modifying system configurations, and potentially gaining access to other systems within the network through the compromised PDU. The vulnerability affects not just individual devices but entire data center infrastructures where multiple PDUs may be interconnected, creating opportunities for lateral movement and extended compromise. The cleartext credential exposure represents a significant risk since these passwords can be immediately used to gain unauthorized access to the affected systems without additional exploitation steps.
Mitigation strategies for this vulnerability should focus on immediate firmware updates to version 3.30.30 or later, which contain patches addressing the authorization bypass flaw. Organizations should implement network segmentation to limit access to PDU management interfaces, restricting access to authorized administrative networks only. Additional protective measures include disabling unnecessary web interfaces when not required for operation, implementing strong access controls through firewalls, and monitoring network traffic for suspicious requests to the affected endpoint. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and represents a technique consistent with ATT&CK tactic TA0006 (Credential Access) and technique T1550.001 (Use of stolen credentials) in the MITRE ATT&CK framework. Security teams should also consider implementing network-based intrusion detection systems to monitor for the specific pattern of the malicious tmpToken cookie value and establish incident response procedures for potential exploitation attempts.