Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability

Vulnerability

The web-based management interface of Cisco HyperFlex Software, in releases earlier than 4.0(2a), contains insufficient cross-site request forgery (CSRF) protections [1]. This allows an unauthenticated, remote attacker to craft a malicious link that, when followed by an authenticated user, can trigger unauthorized actions on the affected system.

Exploitation

An attacker must persuade a user who is currently authenticated to the Cisco HyperFlex web interface to click a specially crafted link [1]. No additional authentication or network access is required beyond the ability to deliver the link (e.g., via email, chat, or a compromised website). The attack does not require any user interaction beyond the initial click.

Impact

Successful exploitation enables the attacker to perform arbitrary actions with the privilege level of the victim user [1]. This could include modifying configuration, creating or deleting accounts, or accessing sensitive data, depending on the user's permissions. The attack does not escalate privileges beyond those of the targeted user.

Mitigation

Cisco released a fixed version, 4.0(2a), to address this vulnerability [1]. Users should upgrade to this release or later. No workarounds are available [1]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.