( , ) (,
. '.' ) ('. ',
). , ('. ( ) (
(_,) .'), ) _ _,
/ _____/ / _ \ ____ ____ _____
\____ \==/ /_\ \ _/ ___\/ _ \ / \
/ \/ | \\ \__( <_> ) Y Y \
/______ /\___|__ / \___ >____/|__|_| /
\/ \/.-. \/ \/:wq
(x.0)
'=.|w|.='
_=''"''=.
presents..
Aerohive Hive Manager and Hive OS Multiple Vulnerabilities
Affected Versions: Aerohive Hive Manager (Stand-alone and Cloud) >= 6.1R3 and HiveOS 6.1R3
PDF: http://www.security-
+-------------+
| Description |
+-------------+
This document details multiple vulnerabilities found within the Aerohive Hive Manager and HiveOS software. These
vulnerabilities have been disclosed to the vendor on or before the 24th of April 2014.
-- Hive Manager Arbitrary File Disclosure --
Leveraging directory traversal, a malicious user can retrieve arbitrary files from the Hive Manager file system. As the
Tomcat instance serving the Hive Manager software runs as the root user, this vulnerability can be used to read any
file off the file system, including sensitive files such as /etc/shadow.
-- Hive Manager Arbitrary File Upload --
An authenticated malicious user may send a crafted post to the ‘upload’ servlet and upload arbitrary files. As the
upload servlet is protected by HTTP basic authentication, this requires the knowledge of the scpuser’s password.
-- Hive Manager Debugserver Code Execution --
It was discovered that an authenticated user may send a crafted request to the Hive Manager ‘debugserver’ servlet
and execute arbitrary commands on the Hive Manager server.
-- Hive Manager Multiple Password Disclosure --
Multiple methods within the Hive Manager web interface were found to expose sensitive information such as
usernames and passwords. A malicious entity may leverage these disclosures to further compromise the Hive
Manager.
-- Hive Manager Reflected Cross Site Scripting --
Multiple Reflected Cross Site Scripting vulnerabilities were found within the Hive Manager software. These
vulnerabilities allow a malicious entity to potentially gain JavaScript execution within a legitimate user’s browser.
This is done with the aim of harming the user’s browser or hijacking their session.
-- Hive Manager SSH Keys Lacking Passphrase --
An SSH key was found on the Hive Manager file system without any passphrase set. This allows a malicious user
with access to the file system to gain unauthorised access to the system with root user privileges.
-- Hive Manager Subshell Bypass --
By using a crafted SSH command, a malicious user may gain root access to the Hive Manager with a fully functional
bash terminal, effectively bypassing the Aerohive subshell. This allows the malicious user to perform tasks on the
underlying CentOS Linux operating system, including the retrieval of private keys, passwords and other sensitive
information
-- Hive Manager Unauthenticated Arbitrary File Upload --
The Hive Manager HHMUploadServlet was found to suffer from an Unauthenticated Arbitrary File Upload
vulnerability. By sending a crafted packet to the servlet, a malicious entity is able to gain arbitrary code execution on
the Hive Manager server.
-- HiveOS Local File Inclusion --
Aerohive HiveOS was found to contain a Local File Inclusion Vulnerability within the web administrative interface.
The Local File Inclusion allows a malicious entity to control what files are included by the vulnerable PHP page. In
the event that the malicious entity is able to control an element on the file system, this results in arbitrary code
execution. As user controlled information is present within the log-files of the application, this is easily achievable.
-- HiveOS Password Disclosure --
Log files within the HiveOS operating system were found to disclose sensitive information such as usernames and
password. A malicious user may leverage this information to further compromise the Aerohive deployment or its
users.
-- HiveOS Unauthenticated Firmware Upload --
Insufficient authorisation checking was found to be being performed on certain firmware upload functions. This
allows for the upload of a backdoored or otherwise malicious firmware by an attacker.
+--------------+
| Exploitation |
+--------------+
Detailed exploitation information and code will be released in December 2014.
+------------+
| Workaround |
+------------+
Update to the latest version of Hive Manager and HiveOS software including the cloud solutions.
+--------+
| Credit |
+--------+
Denis Andzakovic, Scott Bell, Nick Freeman, Thomas Hibbert, Carl Purvis, Pedro Worcel.
+-----------------------------
|About Security-Assessment.com|
+-----------------------------
Security-Assessment.com is a New Zealand based world
leader in web application testing, network security
and penetration testing. Security-Assessment.com
services organisations across New Zealand, Australia,
Asia Pacific, the United States and the United
Kingdom.
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information
. '.' ) ('. ',
). , ('. ( ) (
(_,) .'), ) _ _,
/ _____/ / _ \ ____ ____ _____
\____ \==/ /_\ \ _/ ___\/ _ \ / \
/ \/ | \\ \__( <_> ) Y Y \
/______ /\___|__ / \___ >____/|__|_| /
\/ \/.-. \/ \/:wq
(x.0)
'=.|w|.='
_=''"''=.
presents..
Aerohive Hive Manager and Hive OS Multiple Vulnerabilities
Affected Versions: Aerohive Hive Manager (Stand-alone and Cloud) >= 6.1R3 and HiveOS 6.1R3
PDF: http://www.security-
+-------------+
| Description |
+-------------+
This document details multiple vulnerabilities found within the Aerohive Hive Manager and HiveOS software. These
vulnerabilities have been disclosed to the vendor on or before the 24th of April 2014.
-- Hive Manager Arbitrary File Disclosure --
Leveraging directory traversal, a malicious user can retrieve arbitrary files from the Hive Manager file system. As the
Tomcat instance serving the Hive Manager software runs as the root user, this vulnerability can be used to read any
file off the file system, including sensitive files such as /etc/shadow.
-- Hive Manager Arbitrary File Upload --
An authenticated malicious user may send a crafted post to the ‘upload’ servlet and upload arbitrary files. As the
upload servlet is protected by HTTP basic authentication, this requires the knowledge of the scpuser’s password.
-- Hive Manager Debugserver Code Execution --
It was discovered that an authenticated user may send a crafted request to the Hive Manager ‘debugserver’ servlet
and execute arbitrary commands on the Hive Manager server.
-- Hive Manager Multiple Password Disclosure --
Multiple methods within the Hive Manager web interface were found to expose sensitive information such as
usernames and passwords. A malicious entity may leverage these disclosures to further compromise the Hive
Manager.
-- Hive Manager Reflected Cross Site Scripting --
Multiple Reflected Cross Site Scripting vulnerabilities were found within the Hive Manager software. These
vulnerabilities allow a malicious entity to potentially gain JavaScript execution within a legitimate user’s browser.
This is done with the aim of harming the user’s browser or hijacking their session.
-- Hive Manager SSH Keys Lacking Passphrase --
An SSH key was found on the Hive Manager file system without any passphrase set. This allows a malicious user
with access to the file system to gain unauthorised access to the system with root user privileges.
-- Hive Manager Subshell Bypass --
By using a crafted SSH command, a malicious user may gain root access to the Hive Manager with a fully functional
bash terminal, effectively bypassing the Aerohive subshell. This allows the malicious user to perform tasks on the
underlying CentOS Linux operating system, including the retrieval of private keys, passwords and other sensitive
information
-- Hive Manager Unauthenticated Arbitrary File Upload --
The Hive Manager HHMUploadServlet was found to suffer from an Unauthenticated Arbitrary File Upload
vulnerability. By sending a crafted packet to the servlet, a malicious entity is able to gain arbitrary code execution on
the Hive Manager server.
-- HiveOS Local File Inclusion --
Aerohive HiveOS was found to contain a Local File Inclusion Vulnerability within the web administrative interface.
The Local File Inclusion allows a malicious entity to control what files are included by the vulnerable PHP page. In
the event that the malicious entity is able to control an element on the file system, this results in arbitrary code
execution. As user controlled information is present within the log-files of the application, this is easily achievable.
-- HiveOS Password Disclosure --
Log files within the HiveOS operating system were found to disclose sensitive information such as usernames and
password. A malicious user may leverage this information to further compromise the Aerohive deployment or its
users.
-- HiveOS Unauthenticated Firmware Upload --
Insufficient authorisation checking was found to be being performed on certain firmware upload functions. This
allows for the upload of a backdoored or otherwise malicious firmware by an attacker.
+--------------+
| Exploitation |
+--------------+
Detailed exploitation information and code will be released in December 2014.
+------------+
| Workaround |
+------------+
Update to the latest version of Hive Manager and HiveOS software including the cloud solutions.
+--------+
| Credit |
+--------+
Denis Andzakovic, Scott Bell, Nick Freeman, Thomas Hibbert, Carl Purvis, Pedro Worcel.
+-----------------------------
|About Security-Assessment.com|
+-----------------------------
Security-Assessment.com is a New Zealand based world
leader in web application testing, network security
and penetration testing. Security-Assessment.com
services organisations across New Zealand, Australia,
Asia Pacific, the United States and the United
Kingdom.
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information