FYI: If you're running HP Device Manager, anyone on your network can get admin on your server via backdoor

Hidden database account discovered, patches finally available as well as mitigations


HP Device Manager, software that allows IT administrators to manage HP Thin Client devices, comes with a backdoor database user account that undermines network security, a UK-based consultant has warned.

Nicky Bloor, founder of Cognitous Cyber Security, reports that an HP Inc programmer appears to have set up an insecure user account in a database within HP Device Manager (HPDM). He found that the account can be exploited to achieve privilege escalation and, in conjunction with other flaws, gain unauthorized remote command execution as SYSTEM.

This is bad: if you can reach a vulnerable installation of this device manager on a network, you can gain admin-level control over its machine and the thin clients it controls. HPDM typically runs on a Windows-powered server, and directs multiple Windows clients.

Bloor told The Reg on Tuesday he had been looking into the security of HPDM and spotted a series of weaknesses he was able to exploit. The most concerning of these, he said, was a backdoor database user account, which he identified by examining a log file included with the software. It appears this log file details operations performed on the device manager's PostgreSQL database during the software's development, revealing the existence of the hidden user account.

Anyone with access to a server where HP Device Manager is installed could use this user account to gain complete control over the server

"This was a privileged user account with a password consisting of a single space character," Bloor said. "The only reference to the user account was in a database log file included with the HP Device Manager software where log entries can be seen dating before I even installed the software."

Bloor told us the log entries reveal a failed attempt to authenticate as the database user account used by HPDM. That's followed by a log entry associated with a new user account and what looks like the HP programmer trying to limit the backdoor user account from being used to create other new accounts, he said, as if the developer were trying to limit the security consequences of accessing the backdoor account.

"Anyone with access to a server where HP Device Manager is installed could use this user account to gain complete control over the server," said Bloor, noting that this would qualify as local privilege escalation.

HP admits to backdoors in storage products

READ MORE

"However, I managed to find additional vulnerabilities in HP Device Manager's default configuration that mean the vulnerability can be exploited remotely so that anyone who can connect to a server that's running HPDM can gain complete control of that server," he said. "From there, HPDM provides full administrative control over the HP thin clients in the environment."

Bloor said this vulnerability is present in current versions of the HPDM software, and he's not sure which previous versions of software might be affected.

He added that he contacted HP on August 3, 2020, to disclose details about the vulnerabilities, and asked the IT giant to confirm it understood the implications of the flaw, to propose how it intended to resolve the issue, and to provide a reasonable timeframe to implement the fix.

HP was unresponsive, he said, until he explained that he planned to publish details in 30 days if the corporation continued to stonewall. At that point, he said, HP replied to say the industry standard for coordinated disclosure of vulnerabilities is 90 days and to ask for that much time to produce a fix, without answering any of Bloor's questions.

That was on August 19, 2020. At that point, Bloor said, HP hadn't confirmed it had reviewed and understood the vulnerability reports, and hadn't proposed any mitigation nor resolution timeline.

Bloor was not inclined to just wait around for HP. "I'm paid to help people secure their IT environments and applications, but I also don't have the time to waste chasing HP and hoping that someday in '90+ days' they will produce a patch that will help me to secure my clients' environments," he said. "The fix for the most severe part of the issue is trivial so 90+ days is a joke."

To underscore how easy the issue is to fix, he described the process in a series of tweets.

In an email to The Register on Tuesday night, HP acknowledged the security blunder – assigning it multiple vulnerability IDs: CVE-2020-6925 (weak cipher), CVE-2020-6926 (remote method invocation), and CVE-2020-6927 (elevation of privilege) – and said it has now published an advisory to alert customers. That CVE-2020-6926 bug is a 9.9 out of 10 in terms of CVSS severity, by the way.

Sysadmins are urged to update to HP Device Manager 5.0.4, or HP Device Manager 4.7 Service Pack 13 when it is available, to address the vulnerabilities.

All versions of HP Device Manager are affected by the weak cipher and remote invocation holes, and 5.0.0 to 5.0.3 suffer from the privilege-escalation flaw. ®


Keep Reading

HP CEO talks up HP-ink-only print hardware and higher upfront costs for machines that use other cartridges

'These actions will help us to optimize the business by reducing the number of unprofitable customers'

HP loses attempt to deny colossal commission to star sales staffer

Contract was clear and trying to backdate changes was naughty, rules Australian court

Former HP CEO and Republican Meg Whitman – who split HP with mixed success – says Donald Trump can't run a business

Vows to vote for Democrat Joe Biden instead - as will ex-HP chief Carly Fiorina

HP bows to pressure, reinstates free monthly ink plan... for existing customers

Is this the spirit of Xmas we've heard of? Well, new customers will have to pay to print 15 pages per month

Something to consider in case Dell freezes over: HP unfolds 2-in-1 laptop with Intel Tiger Lake brains, bigger screen

Refresh dukes it out with gear from rival

HP: That print-free-for-life deal we promised you? Well, now it's pay-per-month to continue using your printer ink

EFF on the attack as IT giant tries to claim free supplies during 'device lifetime' just an introductory offer

If you suddenly can't print to your HP Printer from your Mac, you're not alone: Code security cert snafu blamed

Updated Driver software snubbed by macOS 10.15, 10.14, Amazon Music, too

What's in HP's sack? Pre-built Ubuntu machines for the little data scientists in your life

Certain ZBook Studio G7 and Book Create G7 models ready to get number crunching out of the box

Biting the hand that feeds IT © 1998–2021