Aruba ClearPass API xml external entity reference

Summaryinfo

A vulnerability classified as critical has been found in Aruba ClearPass. This vulnerability affects unknown code of the component API. This manipulation causes xml external entity reference. This vulnerability is registered as CVE-2018-7063. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Aruba ClearPass (version now known). It has been declared as critical. Affected by this vulnerability is some unknown processing of the component API. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This can lead to unauthorized access to the API and complete compromise of the ClearPass instance if an attacker knows of the existence of these accounts.

The bug was discovered 11/07/2018. The weakness was published 12/07/2018 (Website). It is possible to read the advisory at arubanetworks.com. This vulnerability is known as CVE-2018-7063 since 02/15/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/19/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 30 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-127736, VDB-127737, VDB-127738 and VDB-127739. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Aruba

Name

• ClearPass

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion