HPE SimpliVity 380 API path traversal

Summaryinfo

A vulnerability marked as critical has been reported in HPE SimpliVity 380, SimpliVity 2600, SimpliVity OmniCube and SimpliVity OmniStack. The impacted element is an unknown function of the component API. This manipulation causes path traversal. This vulnerability appears as CVE-2019-11994. The attacker needs to be present on the local network. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in HPE SimpliVity 380, SimpliVity 2600, SimpliVity OmniCube and SimpliVity OmniStack (the affected version is unknown) and classified as critical. Affected by this vulnerability is an unknown code of the component API. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. An API is used to execute a command manifest file during upgrade does not correctly prevent directory traversal and so can be used to execute manifest files in arbitrary locations on the node. The API does not require user authentication and is accessible over the management network, resulting in the potential for unauthenticated remote execution of manifest files. For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061901&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.

The weakness was presented 01/03/2020. This vulnerability is known as CVE-2019-11994 since 05/13/2019. The attack needs to be initiated within the local network. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

See VDB-148242 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• HPE

Name

• SimpliVity 380
• SimpliVity 2600
• SimpliVity OmniCube
• SimpliVity OmniStack

License

• commercial

Website

• Vendor: https://www.hpe.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion