HPE Fixes Critical Zero-Day in Server Management Software

[silversurfer]

Hewlett Packard Enterprise (HPE) has fixed a critical zero-day remote code execution (RCE) flaw in its HPE Systems Insight Manager (SIM) software for Windows that it originally disclosed in December.
 
HPE SIM is a tool that enables remote support automation and management for a variety of HPE servers, including the HPE ProLiant Gen10 and HPE ProLiant Gen9, as well as for storage and networking products.
 
The company updated its initial security advisory on Thursday. More than a month ago, on April 20, HPE had issued an earlier SIM hotfix update kit that resolves the vulnerability.
 
This is an extremely high-risk flaw that can enable attackers with no privileges to remotely execute code: Tracked as CVE-2020-7200, it’s rated 9.8 out of a maximum 10. It’s found in the latest versions (7.6.x) of HPE’s SIM software and only affects the Windows version.
 
This bug allows low-complexity attacks that don’t require user interaction. As Packet Storm has explained, it allows attackers to execute code within the context of HPE SIM’s hpsimsvc.exe process, which runs with administrative privileges.
 
The problem stems from a failure to validate data during the deserialization process when a user submits a POST request to the /simsearch/messagebroker/amfsecure page. “This module exploits this vulnerability by leveraging an outdated copy of Commons Collection, namely 3.2.2, that ships with HPE SIM, to gain remote code execution as the administrative user running HPE SIM,” according to Packet Storm. The lack of proper validation of user-supplied data can lead to the deserialization of untrusted data, enabling attackers to execute code on servers running vulnerable SIM software.

Read more: HPE Fixes Critical Zero-Day in SIM | Threatpost