Fujitsu Infrastructure Manager 2.8.0.060 ismsnap FirmwareManagement.log improper authorization

Summaryinfo

A vulnerability was found in Fujitsu Infrastructure Manager and classified as critical. This issue affects some unknown processing of the file /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log of the component ismsnap. Such manipulation leads to improper authorization. This vulnerability is referenced as CVE-2023-39903. The attack can only be performed from a local environment. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Fujitsu Infrastructure Manager. It has been rated as problematic. Affected by this issue is an unknown code of the file /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log of the component ismsnap. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. That occurs when users perform any ISM Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured remote firmware repository site, as set up in ISM Firmware Repository Address. A privileged attacker is therefore able to potentially gather the associated ismsnap maintenance data, in the same manner as a trusted party allowed to export ismsnap data from ISM. The preconditions for an ISM installation to be generally vulnerable are that the Download Firmware (Firmware Repository Server) function is enabled and configured, and that the character \ (backslash) is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: this may overlap CVE-2023-39379.

The weakness was published 08/07/2023. The advisory is shared for download at security.ts.fujitsu.com. This vulnerability is handled as CVE-2023-39903 since 08/07/2023. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

By approaching the search of inurl:var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.8.0.061 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-43603). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Fujitsu

Name

• Infrastructure Manager

Version

• 2.8.0.060

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion