SB2024100316 - Multiple vulnerabilities in Intel RAID Web Console software

Description

This security bulletin contains information about 30 vulnerabilities.

1) Sensitive cookie with improper SameSite attribute (CVE-ID: CVE-2023-4329)

CWE-ID: CWE-1275 - Sensitive Cookie with Improper SameSite Attribute

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the web interface does not set the SameSite attribute for the SESSIONID cookie. A remote attacker with ability to perform XSS attack can obtain session identifier of another user.

2) Improper Authorization (CVE-ID: CVE-2023-4345)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to usage of client-side controls to limit access to sensitive functionality. A remote user can bypass implemented security restriction and gain access to sensitive information.

3) Predictable Seed in Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2023-4344)

CWE-ID: CWE-337 - Predictable Seed in Pseudo-Random Number Generator (PRNG)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to usage of insufficiently random values cause by improper use of ssl.rnd to setup CIM connection. A remote attacker can perform MitM attack.

4) Information disclosure (CVE-ID: CVE-2023-4343)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the application exposes sensitive password information in the URL passed as URL search parameter. A remote attacker can gain access to sensitive information.

5) Unprotected Transport of Credentials (CVE-ID: CVE-2023-4342)

CWE-ID: CWE-523 - Unprotected Transport of Credentials

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to a missing strict-transport-security policy. A remote attacker can perform MitM attack.

6) Incorrect default permissions (CVE-ID: CVE-2023-4341)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for folders that are set by the WebGUI. A remote user can escalate privileges to root.

7) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-4340)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files, such as session identifiers. A local user can read the log files and escalate privileges within the application.

8) Information disclosure (CVE-ID: CVE-2023-4339)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to exposure of private keys used for CIM stored with insecure file permissions. A remote user can gain unauthorized access to sensitive information.

9) Configuration (CVE-ID: CVE-2023-4338)

CWE-ID: CWE-16 - Configuration

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The issue may allow a remote attacker to bypass implemented security restrictions.

The issue exists due a missing X-Content-Type-Options header in the web server configuration. A remote attacker can gain access to potentially sensitive information.

10) Session Fixation (CVE-ID: CVE-2023-4337)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exists due to improper session handling of managed servers on Gateway installation. A remote attacker can gain unauthorized access to the system.

11) Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CVE-ID: CVE-2023-4336)

CWE-ID: CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the web interface does not set the Secure attribute for cookies. A remote attacker with ability to perform XSS attack can obtain session identifier of another user.

12) Missing Authorization (CVE-ID: CVE-2023-4334)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing authorization when accessing private files. A remote attacker can request files directly from the server and gain access to sensitive information.

13) Inadequate Encryption Strength (CVE-ID: CVE-2023-4333)

CWE-ID: CWE-326 - Inadequate Encryption Strength

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the web interface does not enforce SSL cipher order. A remote attacker can perform MitM attack.

14) Incorrect default permissions (CVE-ID: CVE-2023-4332)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for log files. A local user with access to the system can view contents of files and directories or modify them.

15) Inadequate Encryption Strength (CVE-ID: CVE-2023-4331)

CWE-ID: CWE-326 - Inadequate Encryption Strength

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to usage of an insecure default TLS configuration that support obsolete and vulnerable TLS protocols. A remote attacker can perform MitM attack.

16) Improper access control (CVE-ID: CVE-2024-34543)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A local user can escalate privileges on the system.

17) Untrusted search path (CVE-ID: CVE-2024-34153)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.

18) Improper access control (CVE-ID: CVE-2024-32940)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions. A remote attacker can send specially crafted packets to the application and perform a denial of service (DoS) attack.

19) Uncaught Exception (CVE-ID: CVE-2024-33848)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling. A local user can perform a denial of service (DoS) attack.

20) Input validation error (CVE-ID: CVE-2024-34545)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote authenticated user can send specially crafted input to the application and perform a denial of service (DoS) attack.

21) NULL pointer dereference (CVE-ID: CVE-2024-32666)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.9 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote user can send specially crafted input to the application and perform a denial of service (DoS) attack.

22) Improper access control (CVE-ID: CVE-2024-36247)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions. A remote user can send specially crafted input to the application and perform a denial of service (DoS) attack.

23) Improper access control (CVE-ID: CVE-2024-36261)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions. A remote user can send specially crafted input to the application and perform a denial of service (DoS) attack.

24) Improper access control (CVE-ID: CVE-2024-28170)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper access restrictions. A local user can gain access to sensitive information.

25) Insufficient Session Expiration (CVE-ID: CVE-2023-4323)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 7.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue. A remote non-authenticated attacker can obtain or guess session token and gain unauthorized access to session that belongs to another user.

26) Protection Mechanism Failure (CVE-ID: CVE-2023-4324)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing HTTP Content-Security-Policy header. A remote attacker can bypass implemented security restrictions and perform XSS or spoofing attacks.

27) Dependency on vulnerable third-party component (CVE-ID: CVE-2023-4325)

CWE-ID: CWE-1395 - Dependency on Vulnerable Third-Party Component

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of a vulnerable libcurl library. A remote attacker can bypass implemented security restrictions.

28) Configuration (CVE-ID: CVE-2023-4326)

CWE-ID: CWE-16 - Configuration

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The issue may allow a remote attacker to perform MitM attack.

The issue exists due to presence of an insecure default TLS configuration. A remote attacker can perform MitM attack.

29) Incorrect default permissions (CVE-ID: CVE-2023-4327)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions. A local user with access to the system can obtain keys used for encryption.

30) Incorrect default permissions (CVE-ID: CVE-2023-4328)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions. A local user with access to the system can obtain keys used for encryption and other sensitive information.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html