Add Cisco Prime Infrastructure Health Monitor TarArchive Remote Code Execution

[wchen-r7]

Description

This module exploits a vulnerability found in Cisco Prime Infrastructure. The issue is that the TarArchive Java class the HA Health Monitor component uses does not check for any directory traversals while unpacking a Tar file, which can be abused by a remote user leveraging the UploadServlet class to upload a JSP payload to the Apache Tomcat's web apps directory, and gain arbitrary remote code execution. Note that authentication is not required to exploit this vulnerability.

Special thanks to mr_me!

Vulnerable Setup:

There are two machines you want to set up using the same ISO, the first is called the "primary" server, and the other is "secondary" (High Availability) server. They both require the same hardware:

• 4 CPU Cores.
• 12288 MB of RAM (12GB).
• 350GB of hard drive space, but you may still run out of it in days.
• Both VMs should be on the same network.

Pcap

A pcap is available. Just ask me!

Demo

[wchen-r7]

Good call. I will fix them up tomorrow. Thank you for reviewing @bcoles.

[wchen-r7]

Updated. Thanks again!

[wvu]

LGTM.

[wchen-r7]

Release Notes

This module exploits a vulnerability found in Cisco Prime Infrastructure. The TarArchive Java class that the HA Health Monitor component uses does not check for any directory traversals while unpacking a Tar file, which remote user can abuse by leveraging the UploadServlet class to upload a JSP payload to the Apache Tomcat's web apps directory. This allows them to gain arbitrary remote code execution. Authentication is not required to exploit this vulnerability.