CVE-2021-38137

Vulnerability

Corero SecureWatch Managed Services version 9.7.2.0020 does not correctly enforce role-based authorization for users with the swa-monitor or cns-monitor roles. A swa-monitor user can access privileged API endpoints such as get_snapshot_list, get_snapshot, get_packages, get_settings, and settings, which should be restricted to higher-privilege roles. Similarly, a cns-monitor user can reach the /system/diagnostics endpoint to manage log files [1].

Exploitation

An attacker must first obtain valid credentials for a swa-monitor or cns-monitor account. With network access to the SecureWatch Management interface on the target host (typically port 8000), the attacker can make HTTP requests to the vulnerable API endpoints. The reference demonstrates logging in with a swa-monitor account and then retrieving the list of available snapshots via https://$host:8000/it-IT/splunkd/__raw/services/get_snapshot_list [1]. No additional authentication bypass or user interaction is required beyond possessing the low-privilege credentials.

Impact

Successful exploitation allows an attacker with a low-privilege swa-monitor role to download sensitive system snapshots, view installed packages and versions, and read network and Splunk configuration details. A cns-monitor user can manage log files. These actions disclose confidential operational information and system internals, violating confidentiality and potentially aiding further attacks. The attacker does not gain administrative privileges but can access data intended for more trusted roles [1].

Mitigation

Corero has addressed the issue in SecureWatch Managed Services version 9.7.5 or later. Users should upgrade to at least version 9.7.5 as soon as possible. If immediate upgrade is not feasible, restrict network access to the management interface and monitor for unauthorized API calls. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].