full-disclosure - [FD] HP StoreEver MSL6480 Tape Library v4.10

Open Source and information security mailing list archives

Message-ID: <CAB8+WF1ie5rqF24CB8k2EiA6y3qy4uuEgrZz3WFfTiuWG+_8Dw@mail.gmail.com>
Date: Wed, 15 Jun 2016 20:40:17 +0000
From: Karn Ganeshen <karnganeshen@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] HP StoreEver MSL6480 Tape Library v4.10 - Multiple
	Vulnerabilities

*HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities*

*Confirmed on firmware version 4.10*

*HPE PSRT response*: Upgrade to MSL6480 is 4.90 (current version)

*Weak Credentials Management*

The device comes with weak, default login credentials - security/security -
and the application does not enforce a mandatory, password change from
default to strong password values.

*Access Control Issues*

An unauthenticated user can download system configuration archive. Archive
Filename can be guessed with a bit of scripting.

Filename format is as follows:

/syslog-MSL6480-A60A80-<v.er>-YYYY-MM-DD_HH-MM-SS-SSS_<AM_or_PM>.zip

For example, anyone can download the config by requesting the url:

http://IP/tmp/syslog-MSL6480-A60A80-4.10-2016-06-15_01-01-01-001_PM.zip

*Vulnerable to Cross-Site Request Forgery*

There is no CSRF Token generated per page and / or per (sensitive)
function. Successful exploitation of this vulnerability may allow silent
execution of unauthorized actions on the device such as password change,
configuration parameter changes, generating system configuration archive,
saving modified configuration, & device reboot.

+++++

-- 
Best Regards,
Karn Ganeshen

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives