CVE-2022-26484: InfoScale VIOM Security Advisory | Veritas™

Revision History

• 1.0: February 28, 2022: Initial version

Summary

As part of a privately reported vulnerability, Veritas has discovered security vulnerabilities with Veritas InfoScale Operations Manager (VIOM) as described below.

Issue

Description

Severity

Fixed Versions

1

Improper Neutralization of Input During Web Page Generation (‘Reflected Cross-site Scripting’)

Medium

7.4.2, 8.0

2

Absolute Path Traversal

Medium

7.4.2, 8.0

Issue #1

A reflected cross-site scripting (XSS) vulnerability allows a malicious VIOM user to inject malicious script into another user’s browser. (CWE-79)

• CVE ID: To be announced
• Severity: Medium
• CVSS v3.1 Base Score 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

Summary
Cross-site scripting Reflected (XSS) vulnerability affects the Veritas Operations Manager application, which allows authenticated remote attackers to inject arbitrary web script or HTML into HTTP/GET parameter which reflect the user input without sanitization.
The Veritas Operations Manager web application does not properly check parameters sent via GET methods which are included in the server response.

Prerequisites
It is required to have access to the web application as a user with administrative/root role.

Affected Endpoints

• http://hostname:5634/admin/cgi-bin/listdir.pl

Security Impact
By exploiting this vulnerability it is possible to conduct phishing attacks against users of the Veritas Operations Manager web application.

Affected Versions
Veritas InfoScale Operations Manager (VIOM) Management Server and Managed Hosts/Agents 8.0, 7.4.2, 7.4, 7.3.1, 7.3, 7.2, 7.1, 7.0. Earlier unsupported versions may be affected as well.

Issue #2

An absolute path traversal vulnerability allows a user to gain unauthorized access to resources on the server (CWE-36).

• CVE ID: To be announced
• Severity: Medium
• CVSS v3.1 Base Score 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Summary
The web server fails to sanitize the input data allowing a remote authenticated attacker to read arbitrary files on the system. By manipulating the resource name in the GET requests referring to files with absolute paths, it is possible to access arbitrary files stored on the filesystem, including application source code, configuration files and critical system files.

Prerequisites
It is required to have access to the web application as a user with administrative/root role.

Affected Endpoints

• http://hostname:5634/admin/cgi-bin/rulemgr.pl/getfile/

Security Impact
By exploiting this vulnerability on the web server it was possible to read any file on the filesystem, being the web application running with the privileges of the root user.

Affected Versions
Veritas InfoScale Operations Manager (VIOM) Management Server and Managed Hosts/Agents 8.0, 7.4.2, 7.4, 7.3.1, 7.3, 7.2, 7.1, 7.0. Earlier unsupported versions may be affected as well

Acknowledgement

Veritas would like to thank Luca Carbone, Antonio Papa, Vincenzo Nigro, and Massimiliano Brolli with TIM Security Red Team Research for notifying us of these vulnerabilities.

Disclaimer

THE SECURITY ADVISORY IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. VERITAS TECHNOLOGIES LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

Veritas Technologies LLC
2625 Augustine Drive
Santa Clara, CA 95054