CVE-2022-28169

Vulnerability

Brocade Webtools component in Brocade Fabric OS versions before v9.1.1, v9.0.1e, and v8.2.3c allows a low-privilege Webtools user to gain admin rights. The flaw stems from the transmission of unencrypted admin and operator authorization headers, which can be intercepted and reused to create a new user with an admin role. [1]

Exploitation

An attacker with low-privilege Webtools access must be positioned to intercept network traffic (e.g., man-in-the-middle) to capture the unencrypted authorization headers. Using the captured operator session ID, the attacker can then craft a user-addition request that substitutes their own authorization header with the operator's header, thereby creating an admin account. [1]

Impact

Successful exploitation grants the attacker full administrative privileges on the Brocade Fabric OS switch, enabling complete control over the device and its managed fabric. [1]

Mitigation

Broadcom released fixes in Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c that introduce a configurable option to disable Webtools access for non-admin users. This option is not enabled by default and must be activated by an admin using the configurechassis CLI command. In version v9.2.0, architectural changes eliminate the vulnerability entirely. [1]