HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities

[Karn Ganeshen <karnganeshen () gmail com>]

*HP StoreEver MSL6480 Tape Library v4.10 - Multiple Vulnerabilities*

*Confirmed on firmware version 4.10*

*HPE PSRT response*: Upgrade to MSL6480 is 4.90 (current version)


*Weak Credentials Management*

The device comes with weak, default login credentials - security/security -
and the application does not enforce a mandatory, password change from
default to strong password values.


*Access Control Issues*

An unauthenticated user can download system configuration archive. Archive
Filename can be guessed with a bit of scripting.

Filename format is as follows:

/syslog-MSL6480-A60A80-<v.er>-YYYY-MM-DD_HH-MM-SS-SSS_<AM_or_PM>.zip

For example, anyone can download the config by requesting the url:

http://IP/tmp/syslog-MSL6480-A60A80-4.10-2016-06-15_01-01-01-001_PM.zip


*Vulnerable to Cross-Site Request Forgery*

There is no CSRF Token generated per page and / or per (sensitive)
function. Successful exploitation of this vulnerability may allow silent
execution of unauthorized actions on the device such as password change,
configuration parameter changes, generating system configuration archive,
saving modified configuration, & device reboot.


+++++


-- 
Best Regards,
Karn Ganeshen

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/