ArubaOS-Switch web management interface: Unauthenticated stored cross-site scripting against the ArubaOS-Switch web UI

Impact

Unauthenticated stored cross-site scripting against the ArubaOS-Switch web UI. Stored XSS in a switch management interface is a credential-theft and config-change path aimed at your network operators: an attacker plants the payload without logging in, and it fires the next time an admin opens the page.

Who can reach it

Unauthenticated, remote to the switch's web management interface; the payload executes in an administrator's browser session.

What to do

ArubaOS-Switch firmware upgrade plus reload. Immediate mitigation is a config change: disable the web management interface and manage via SSH/CLI, which most datacenter operators should be doing anyway. Related ArubaOS issue: CVE-2023-35971.

References

Related entries

• Supermicro BMC (IPMI web interface, XSS): Stored/reflected script injection in the BMC web UICVE-2023-40284 · Supermicro BMC (IPMI web interface, XSS)High
• Supermicro BMC (IPMI web interface, XSS): Script injection in the BMC management UI, scope-changing becauseCVE-2023-40287 · Supermicro BMC (IPMI web interface, XSS)High
• Supermicro BMC (IPMI web interface, XSS): Further injection point in the same BMC web stackCVE-2023-40288 · Supermicro BMC (IPMI web interface, XSS)High
• Supermicro BMC (IPMI web interface, XSS via IE11): Injection that fires specifically through Internet Explorer 11CVE-2023-40290 · Supermicro BMC (IPMI web interface, XSS via IE11)High
• shim (HTTP boot): Out-of-bounds write from a crafted HTTP response during network bootCVE-2023-40547 · shim (HTTP boot)High
• AMI AptioV UEFI BIOS (EDK II network stack, DHCPv6 client): Buffer overflow in the firmware's DHCPv6 client, triggeredCVE-2023-45230 · AMI AptioV UEFI BIOS (EDK II network stack, DHCPv6 client)High