IBM System Networking Switch Center Local Privilege Escalation Vulnerability
6 Feb. 2016
The administration-panel web service in IBM System Networking Switch Center (SNSC) before 18.104.22.168 and Lenovo Switch Center before 22.214.171.124 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file.
The information has been provided by rgod.
* IBM System Networking Switch Center (SNSC) before 126.96.36.199 and Lenovo Switch Center before 188.8.131.52
* IBM System Networking Switch Center (SNSC) after 184.108.40.206 and Lenovo Switch Center after 220.127.116.11
This vulnerability allows local unprivileged attackers to execute arbitrary code on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability.The specific flaw exists within the IBM SNSC Web Service, which listens by default on ports 40080 (HTTP) or 40443 (HTTPS) for requests to the administration panel. Because this service offers access to the Apache Axis AdminService, an unprivileged local attacker can publish arbitrary classes with the deployment method. An attacker can leverage this access to install arbitrary .jsp files on the server, which will by default run under the context of SYSTEM.