Cisco HyperFlex Software Static Signing Key Vulnerability

Vulnerability

The vulnerability resides in Cisco HyperFlex Software, where a static signing key is used to generate session tokens for the HyperFlex Web UI. This key is identical across all Cisco HyperFlex systems. An attacker can derive the key from one system and forge valid signed tokens for another. All versions of Cisco HyperFlex Software prior to the fixed releases are affected [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by first obtaining the static signing key from any accessible HyperFlex system (e.g., a compromised or misconfigured instance). Using this key, the attacker can generate valid signed session tokens for a target HyperFlex system without any authentication. The attacker then presents these tokens to the target system's Web UI, gaining unauthorized access [1].

Impact

Successful exploitation allows the attacker to access the HyperFlex Web UI of a system for which they are not authorized. This could lead to unauthorized disclosure of sensitive information, configuration changes, or further compromise of the affected system, depending on the privileges available through the Web UI [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to the fixed versions specified in the Cisco Security Advisory. No workarounds are available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of publication [1].