Cisco HyperFlex Arbitrary Statistics Write Vulnerability

Vulnerability

The Graphite interface in Cisco HyperFlex software versions prior to 3.5(2a) is vulnerable to an arbitrary data write due to insufficient authorization controls. An authenticated, local attacker can connect to the Graphite service and send arbitrary data to it [1].

Exploitation

The attacker must have local access and valid authentication to the HyperFlex system. No user interaction is required beyond initiating the connection. The attacker can then send crafted data directly to the Graphite interface, bypassing proper authorization checks [1].

Impact

Successful exploitation allows the attacker to write arbitrary data to the Graphite interface. This results in invalid or falsified statistics being presented in the interface, potentially misleading administrators about system health and performance. The vulnerability does not lead to remote code execution or data exfiltration, but undermines the integrity of monitoring data [1].

Mitigation

Cisco has addressed this vulnerability in software release 3.5(2a) and later. No workarounds are available. Affected customers should upgrade to a fixed release. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].