module

HPE Systems Insight Manager AMF Deserialization RCE

Try Surface Command
Back to search
Disclosed
2020-12-15
Created
2021-03-09

Description

A remotely exploitable vulnerability exists within HPE System Insight Manager (SIM) version 7.6.x that can be
leveraged by a remote unauthenticated attacker to execute code within the context of HPE System Insight
Manager's hpsimsvc.exe process, which runs with administrative privileges. The vulnerability occurs due
to a failure to validate data during the deserialization process when a user submits a POST request to
the /simsearch/messagebroker/amfsecure page. This module exploits this vulnerability by leveraging an
outdated copy of Commons Collection, namely 3.2.2, that ships with HPE SIM, to gain
RCE as the administrative user running HPE SIM.

Authors

Harrison Neal
Jang
Grant Willcox

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/http/hpe_sim_76_amf_deserialization
    msf exploit(hpe_sim_76_amf_deserialization) > show targets
        ...targets...
    msf exploit(hpe_sim_76_amf_deserialization) > set TARGET < target-id >
    msf exploit(hpe_sim_76_amf_deserialization) > show options
        ...show and set options...
    msf exploit(hpe_sim_76_amf_deserialization) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today