CVE-2015-1950

Unauthenticated access to IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 allows discovery of PowerVC credentials and access bypass for KVM guest OS users

• CVSS 4.6
• CWE-255
• Authentication, Authorization, and Session Management
• Remote

IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code.

CVE

CVE-2015-1950

CWE

CWE-255

CVSS base score

4.6

Published

2015-07-01

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update IBM PowerVC Standard Edition to version 1.2.2.3 or higher.

from flask import Flask

app = Flask(__name__)

@app.route('/endpoint', methods=['POST'])
def function():
    exec(request.form['code'])
    return "Code executed."

if __name__ == '__main__':
    app.run()

from flask import Flask, request, abort

app = Flask(__name__)

def check_auth(username, password):
    return username == 'admin' and password == 'secret'

def require_auth(f):
    def decorated(*args, **kwargs):
        auth = request.authorization
        if not auth or not check_auth(auth.username, auth.password):
            abort(401)
        return f(*args, **kwargs)
    return decorated

@app.route('/endpoint', methods=['POST'])
@require_auth
def function():
    return "Access granted to secure function."

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve20151950,
  title        = {{Unauthenticated access to IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 allows discovery of PowerVC credentials and access bypass for KVM guest OS users}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2015},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-1950},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-1950/}}
}