PT-2017-6617 · Hexis · Hexis Hawkeye G

Hyp3Rlinx + 1 · Published 2017-10-23 · Updated 2018-10-09 · CVE-2015-2878

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hexis HawkEye G version 3.0.1.4912

Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This can be achieved through multiple cross-site request forgery (CSRF) vulnerabilities. Specifically, attackers can add arbitrary accounts via the name parameter to the "interface/rest/accounts/json" API endpoint. They can also turn off certain sensors, such as Url matching, DNS Inject, or IP Redirect Sensor, in a request to "interface/rest/dpi/setEnabled/1". Furthermore, attackers can perform whitelisting of malware MD5 hash IDs via the id parameter to "interface/rest/md5-threats/whitelist".

Recommendations For Hexis HawkEye G version 3.0.1.4912, consider disabling access to the "interface/rest/accounts/json", "interface/rest/dpi/setEnabled/1", and "interface/rest/md5-threats/whitelist" API endpoints until a patch is available. Restrict the use of the name and id parameters in these endpoints to minimize the risk of exploitation. Additionally, restrict access to the Url matching, DNS Inject, and IP Redirect Sensor features to prevent them from being turned off by unauthorized requests.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-2878

Affected Products

Hexis Hawkeye G

References · 4

• 🔥 https://exploit-db.com/exploits/37686 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2878 · Security Note
• http://securityfocus.com/archive/1/536074/100/0/threaded · Note
• http://securityfocus.com/archive/1/536076/100/0/threaded · Note