iLO4 <= 2.73 reveals HW serial and model unauthenticated via /upnp/BasicDevice.xml about ilo4_toolbox

[robert-scheck]

After reminding HPE PSRT, the HPE Product Security Response Team case PSRT111155 was today opened for this issue and assigned to the iLO 4 product engineering team.

[alexgzt]

Hi Robert,

Indeed I've been able to reproduce your findings here as well. As far as I remember we did not encountered this endpoint. My opinion would be to report it to HPE PSRT just to make sure they are aware of this one as well (and possibly get more insight if a remediation is possible).

Checking into the code, this upnp/BasicDevice.xml endpoint is handled by the webserver. I have not been able either to find a configuration option to disable it.

Still, the "Level of Data Returned" option from "Administration" => "Management" => "Insight Management Integration", is useful to prevent the information leak from the http://…/xmldata?item=all endpoint when set to "Disabled (No Response to Request)".

alex.

[robert-scheck]

Thank you very much for following up this. I've reported my findings on Mon, 6 Aug 2018 22:59:47 +0200 to HPE PSRT.

[robert-scheck]

As per iLO4 2.73, this information leak still exists and the HPE PSRT never came up with any real reply regarding my report. Note that I can't treat a "I will engage the teams ASAP" but never being followed up as a something serious. Not sure if HPE is interested in (product) security. Nevertheless I tried to warm up the old e-mail tread with HPE PSRT.

[alexgzt]

Thank you for your determination and perseverance on this issue Robert.

[robert-scheck]

Today, HPE PSRT let me know that they are pleased to report that HPE Security Bulletin HPESBHF04069 rev. 1 has been published and is available at https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04069en_us

The iLO information disclosure vulnerability that I reported has been assigned CVE-2020-7202, HPE PSRT will request at MITRE that above HPE Security Bulletin gets linked with the CVE.

In general, affected/vulnerable are the following iLO versions:

• HPE Integrated Lights-Out 5 (iLO 5) - Prior to v2.31
• HPE Integrated Lights-Out 4 (iLO 4) - Prior to v2.76

[0xf4b]

\o/
Congratulations for finally getting it fixed, Robert!