1 min read

A Red Team Perspective on the Device42 Asset Management Appliance

Bitdefender

August 10, 2022

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
A Red Team Perspective on the Device42 Asset Management Appliance

Modern IT environments rely on automatic discovery, asset management, and dependency mapping.

Whether based on agents or completely agentless, these tools allow IT infrastructure managers to create a complete inventory of networked devices, servers and hypervisors, applications, and more.

While investigating the Device42 platform, we found multiple severe security issues exploitable by attackers with any level of access within the host network.

By exploiting these issues, an attacker could impersonate other users, obtain admin-level access in the application (by leaking session with an LFI) or obtain full access to the appliance files and database (through remote code execution).

By daisy-chaining multiple vulnerabilities, an attacker can achieve remote code execution with root privileges starting from an unauthenticated session:

  • Authentication bypass with an unauthenticated local file inclusion vulnerability discovered in the Exago reports component by extracting valid session IDs of authenticated users
  • Remote code execution by creating an autodiscovery task (*nix/CISCO NX-OS) with crafted RCE payload as username

Besides these critical vulnerabilities, we also identified a remote code execution vulnerability in the appliance manager component.

The full research paper is available for download below:

Download the Whitepaper

Mitigation

Part of our mission to keep customers safe is to identify vulnerabilities in applications and IoT devices and then to responsible disclose our findings to the affected vendors so they can work on fixes. Once these fixes become available, they should be immediately deployed by organizations already running vulnerable versions of the app. Vulnerable instances of the Device42 appliance should be updated to version 18.01.00 to prevent exploitation.

We would like to extend our thanks to the Device42 team for working with us and quickly making a fix available.

tags


Author



Right now

Top posts

A Red Team Perspective on the Device42 Asset Management Appliance

A Red Team Perspective on the Device42 Asset Management Appliance

August 10, 2022

1 min read
Vulnerabilities Identified in Wyze Cam IoT Device

Vulnerabilities Identified in Wyze Cam IoT Device

March 29, 2022

1 min read
New FluBot and TeaBot Global Malware Campaigns Discovered

New FluBot and TeaBot Global Malware Campaigns Discovered

January 26, 2022

10 min read
Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately

Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately

December 10, 2021

2 min read
Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand

Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand

November 08, 2021

2 min read
Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware

Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware

September 16, 2021

2 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

A Red Team Perspective on the Device42 Asset Management Appliance A Red Team Perspective on the Device42 Asset Management Appliance
Bitdefender

August 10, 2022

1 min read
RedLine Stealer Resurfaces in Fresh RIG Exploit Kit Campaign RedLine Stealer Resurfaces in Fresh RIG Exploit Kit Campaign
Mihai NEAGU

April 27, 2022

1 min read
FIN8 Threat Actor Spotted Once Again with New "Sardonic" Backdoor FIN8 Threat Actor Spotted Once Again with New "Sardonic" Backdoor
Eduard BUDACAVictor VRABIECristina VATAMANUBogdan BOTEZATU
2 min read