Vulnerability

CERT-In Vulnerability Note CIVN-2024-0335
Multiple Vulnerabilities in HPE Aruba Networking Products

Original Issue Date:November 12, 2024

Severity Rating: CRITICAL

Systems Affected

Affected Software Versions:

AOS-10.4.x.x: 10.4.1.4 and below
Instant AOS-8.12.x.x: 8.12.0.2 and below
Instant AOS-8.10.x.x: 8.10.0.13 and below

End of Maintenance (EoM) software versions

AOS-10.6.x.x: all
AOS-10.5.x.x: all
AOS-10.3.x.x: all
Instant AOS-8.11.x.x: all
Instant AOS-8.9.x.x: all
Instant AOS-8.8.x.x: all
Instant AOS-8.7.x.x: all
Instant AOS-8.6.x.x: all
Instant AOS-8.5.x.x: all
Instant AOS-8.4.x.x: all
Instant AOS-6.5.x.x: all
Instant AOS-6.4.x.x: all

Overview

Multiple vulnerabilities have been reported in Aruba products, which could be exploited by a remote attacker to execute arbitrary code or access sensitive information on the targeted system.

Target Audience
All end-user organizations and individuals of HPE Aruba Networking Products

Risk Assessment
High risk of unauthorized data access and potential system takeovers.

Impact Assessment
Potential for Unauthorized Information Disclosure or Arbitrary Command Execution.

Description

Hewlett Packard Enterprise (HPE) Aruba Networking is a provider of networking solutions. AOS stands for Aruba Operating System, which is the software that runs on Arubas access points, controllers, and switches.

1. Command Injection Vulnerabilities ( CVE-2024-42509   CVE-2024-47460   )

Two Command injection vulnerabilities exist in the CLI service of Aruba Access Points. A remote attacker could exploit these vulnerabilities by sending specially crafted packets to Arubas PAPI UDP port (8211) on targeted system.
Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system, potentially leading to unauthorized access or system compromise.

2. Authenticated Arbitrary Remote Command Execution (RCE) Vulnerability ( CVE-2024-47461   )

An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands with privileged user access on the underlying operating system, potentially leading to fully compromise.

3. Arbitrary File Creation Vulnerability ( CVE-2024-47462   CVE-2024-47463   )

Multiple arbitrary file creation vulnerabilities exist in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, resulting in remote command execution on the underlying operating system.

4. Path Traversal Vulnerability ( CVE-2024-47464   )

An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a location readable by users from the command line interface of the underlying operating system, resulting in unauthorized remote access to files.

Workaround

Enabling cluster security via the cluster-security command in devices running Instant AOS-8 code.
AOS 10 devices port UDP/8211 must be blocked from all untrusted networks.
To minimize the likelihood of an attacker exploiting vulnerabilities, CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.

Solution

Apply appropriate fixes as mentioned in Aruba Network Security Advisory:
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US

Vendor Information

Aruba Network
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US

References

https://www.bleepingcomputer.com/news/security/hpe-warns-of-critical-rce-flaws-in-aruba-networking-access-points/
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US

CVE Name
CVE-2024-42509
CVE-2024-47460
CVE-2024-47461
CVE-2024-47462
CVE-2024-47463
CVE-2024-47464

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India