-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aruba Product Security Advisory
===============================
Advisory ID: ARUBA-PSA-2023-003
CVE: CVE-2023-25589, CVE-2023-25590, CVE-2023-25591,
     CVE-2023-25592, CVE-2023-25593, CVE-2023-25594,
     CVE-2023-25595, CVE-2023-25596
Publication Date: 2023-Mar-14
Last Update: 2023-Mar-23
Status: Confirmed
Severity: Critical
Revision: 2


Title
=====
ClearPass Policy Manager Multiple Vulnerabilities


Overview
========
Aruba has released updates to ClearPass Policy Manager that
address multiple security vulnerabilities.


Affected Products
=================
These vulnerabilities affect ClearPass Policy Manager running
the following software versions unless specifically noted
otherwise in the details section:

  - ClearPass Policy Manager 6.11.x: 6.11.1 and below
  - ClearPass Policy Manager 6.10.x: 6.10.8 and below
  - ClearPass Policy Manager 6.9.x:  6.9.13 and below

Versions of ClearPass Policy Manager that are end of life are
affected by these vulnerabilities unless otherwise indicated.


Unaffected Products
===================
Any other Aruba products not specifically listed above are not
affected by these vulnerabilities.


Details
=======

  Unauthenticated Arbitrary User Creation Leads to Complete
  System Compromise
  (CVE-2023-25589)
  ---------------------------------------------------------------------
    A vulnerability in the web-based management interface of
    ClearPass Policy Manager could allow an unauthenticated
    remote attacker to create arbitrary users on the platform.
    A successful exploit allows an attacker to achieve total
    cluster compromise.

    Internal references: ATLCP-229
    Severity: Critical
    CVSSv3 Overall Score: 9.8
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    Discovery: This vulnerability was discovered and reported by
    Daniel Jensen (@dozernz) via Aruba's Bug Bounty Program.


  Local Privilege Escalation in ClearPass OnGuard Linux Agent
  (CVE-2023-25590)
  ---------------------------------------------------------------------
    A vulnerability in the ClearPass OnGuard Linux agent could
    allow malicious users on a Linux instance to elevate their
    user privileges to those of a higher role. A successful
    exploit allows malicious users to execute arbitrary code
    with root level privileges on the Linux instance.

    Internal references: ATLCP-235
    Severity: High
    CVSSv3 Overall Score: 7.8
    CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Discovery: This vulnerability was discovered and reported
    by Luke Young (bugcrowd.com/bored_engineer) via Aruba's Bug
    Bounty Program.


  Authenticated Information Disclosure in ClearPass Policy
  Manager Web-Based Management Interface
  (CVE-2023-25591)
  ---------------------------------------------------------------------
    A vulnerability in the web-based management interface of
    ClearPass Policy Manager could allow a remote attacker
    authenticated with low privileges to access sensitive
    information. A successful exploit allows an attacker to
    retrieve information which could be used to potentially gain
    further privileges on the ClearPass instance.

    Internal Reference: ATLCP-224
    Severity: High
    CVSSv3.x Overall Score: 7.6
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

    Discovery: This vulnerability was discovered and reported
    by Luke Young (bugcrowd.com/bored_engineer) via Aruba's Bug
    Bounty program.


  Reflected Cross Site Scripting Vulnerabilities (XSS) in
  ClearPass Policy Manager Web-Based Management Interface
  (CVE-2023-25592, CVE-2023-25593)
  ---------------------------------------------------------------------
    Vulnerabilities within the web-based management interface
    of ClearPass Policy Manager could allow a remote attacker
    to conduct a reflected cross-site scripting (XSS) attack
    against a user of the interface. A successful exploit allows
    an attacker to execute arbitrary script code in a victim's
    browser in the context of the affected interface.

    Internal Reference: ATLCP-170, ATLCP-228
    Severity: High
    CVSSv3.x Overall Score: 7.1
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

    Discovery: These vulnerabilities were discovered and
    reported by the AT&T Security Team and Sicarius(@EIS1carius)
    of CBP.


  Authorization Bypass Leading to Privilege Escalation in
  ClearPass Policy Manager Web-Based Management Interface
  (CVE-2023-25594)
  ---------------------------------------------------------------------
    A vulnerability in the web-based management interface of
    ClearPass Policy Manager allows an attacker with read-only
    privileges to perform actions that change the state of the
    ClearPass Policy Manager instance. Successful exploitation
    of this vulnerability allows an attacker to complete
    state-changing actions in the web-based management interface
    that should not be allowed by their current level of
    authorization on the platform.

    Internal References: ATLCP-237
    Severity: Medium
    CVSSv3.x Overall Score: 6.3
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

    Discovery: This vulnerability was discovered and reported by
    the State Bank of India and ING Bank N.V.


  Sensitive Information Disclosure in ClearPass OnGuard Ubuntu
  Agent
  (CVE-2023-25595)
  ---------------------------------------------------------------------
    A vulnerability exists in the ClearPass OnGuard Ubuntu agent
    that allows for an attacker with local Ubuntu instance
    access to potentially obtain sensitive information.
    Successful Exploitation of this vulnerability allows an
    attacker to retrieve information that is of a sensitive
    nature to the ClearPass/OnGuard environment.

    Internal Reference: ATLCP-231
    Severity: Medium
    CVSSv3.x Overall Score: 5.5
    CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

    Discovery: This vulnerability was discovered and reported by
    the security team at Airowire Networks.


  Authenticated Sensitive Information Disclosure in ClearPass
  Policy Manager
  (CVE-2023-25596)
  ---------------------------------------------------------------------
    A vulnerability exists in ClearPass Policy Manager that
    allows for an attacker with administrative privileges
    to access sensitive information in a cleartext format.
    A successful exploit allows an attacker to retrieve
    information which could be used to potentially gain further
    access to network services supported by ClearPass Policy
    Manager.

    Internal Reference: ATLCP-236
    Severity: Medium
    CVSSv3.x Overall Score: 4.5
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

    Discovery: This vulnerability was discovered and reported by
    the Aruba ClearPass Policy Manager engineering team.


Resolution
==========
Upgrade ClearPass Policy Manager to one of the following
versions with the fixes to resolve all issues noted in the
details section.

  - ClearPass Policy Manager 6.11.x: 6.11.2 and above
  - ClearPass Policy Manager 6.10.x: 6.10.8 Hotfix 1 for Security
    Issues and above
  - ClearPass Policy Manager 6.9.x: 6.9.13 Hotfix 1 for Security
    Issues and above

Aruba does not evaluate or patch ClearPass Policy Manager
versions that have reached their End of Support (EoS) milestone.

Supported versions as of the publication date of this advisory
are:
  - ClearPass Policy Manager 6.11.x
  - ClearPass Policy Manager 6.10.x
  - ClearPass Policy Manager 6.9.x

For more information about Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/


Workaround
==========
To minimize the likelihood of an attacker exploiting these
vulnerabilities, Aruba recommends that the CLI and web-based
management interfaces for ClearPass Policy Manager be restricted
to a dedicated layer 2 segment/VLAN and/or controlled by
firewall policies at layer 3 and above.


ClearPass Policy Manager Security Hardening
===========================================
For general information on hardening ClearPass Policy Manager
instances against security threats please see the ClearPass
Policy Manager Hardening Guide.

For ClearPass 6.11.x, the ClearPass Policy
Manager Hardening guide is available at
https://www.arubanetworks.com/techdocs/ClearPass/6.11/PolicyManager/Content/home.htm

For ClearPass 6.10.x, the ClearPass Policy
Manager Hardening Guide is available at
https://www.arubanetworks.com/techdocs/ClearPass/6.10/PolicyManager/Content/home.htm

For ClearPass 6.9.x and earlier, the ClearPass
Policy Manager Hardening Guide is available
at https://support.hpe.com/hpesc/public/docDisplay?docId=a00091066en_us


Exploitation and Public Discussion
==================================
Aruba is not aware of any public discussion or exploit code that
target these specific vulnerabilities as of the release date of
the advisory.


Revision History
================
Revision 1 / 2023-Mar-14 / Initial release
Revision 2 / 2023-Mar-23 / Updated Discovery information for
                           CVE-2023-25594 based on feedback
                           from ClearPass engineering.


Aruba SIRT Security Procedures
==============================
Complete information on reporting security vulnerabilities in
Aruba Networks products and obtaining assistance with security
incidents is available at:

https://www.arubanetworks.com/support-services/security-bulletins/


For reporting *NEW* Aruba Networks security issues, email can
be sent to aruba-sirt(at)hpe.com. For sensitive information we
encourage the use of PGP encryption. Our public keys can be
found at:

https://www.arubanetworks.com/support-services/security-bulletins/


(c) Copyright 2023 by Aruba, a Hewlett Packard Enterprise
company. This advisory may be redistributed freely after the
release date given at the top of the text, provided that the
redistributed copies are complete and unmodified, including all
data and version information.
-----BEGIN PGP SIGNATURE-----

iQFLBAEBCAA1FiEEMd5pP5EnbG7Y0fo5mP4JykWFhtkFAmQSFF8XHHNpcnRAYXJ1
YmFuZXR3b3Jrcy5jb20ACgkQmP4JykWFhtmHJAgAoWa1fA3YiiGoyWIQueVuXZ4o
NofA0IzOF3n/HebkijEzO0DWZvyTpm1LWiwyMn74fEiINyMm29mH4wofMhWjd+pc
UPOhLI0VJVoxSCL66AdO0eLz6f+KI1WzJRLLKh7n7gSR7HEJ4DGNXw6Lg5QzLOCp
RdQK2cd8YH2nfg+H2wOlQ1gIxOYTQQrSRoNcDUYHu4iEyCO8uYwM1B04kisefQeJ
9fpCiKp9XO3jNS6DdK/GccvskfedKfG0ABy5H+DMMDUFJxnJtsHOG4Bg+Md7qsZu
dFphX3iX14POVzznu8EgAJ/gsk0fHAVn3lp5DyeVOwz7OuvgkVn4i3jxNFrFFw==
=dyiC
-----END PGP SIGNATURE-----