HP StoreEver MSL6480 Tape Library 4.10 Weak Credentials / CSRF / Access Control
Posted on 17 June 2016
*HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities* *Confirmed on firmware version 4.10* *HPE PSRT response*: Upgrade to MSL6480 is 4.90 (current version) *Weak Credentials Management* The device comes with weak, default login credentials - security/security - and the application does not enforce a mandatory, password change from default to strong password values. *Access Control Issues* An unauthenticated user can download system configuration archive. Archive Filename can be guessed with a bit of scripting. Filename format is as follows: /syslog-MSL6480-A60A80-<v.er>-YYYY-MM-DD_HH-MM-SS-SSS_<AM_or_PM>.zip For example, anyone can download the config by requesting the url: http://IP/tmp/syslog-MSL6480-A60A80-4.10-2016-06-15_01-01-01-001_PM.zip *Vulnerable to Cross-Site Request Forgery* There is no CSRF Token generated per page and / or per (sensitive) function. Successful exploitation of this vulnerability may allow silent execution of unauthorized actions on the device such as password change, configuration parameter changes, generating system configuration archive, saving modified configuration, & device reboot. +++++ -- Best Regards, Karn Ganeshen
