How to remediate – HP Diagnostics Server Default Credentials

1. Introduction

The HP Diagnostics Server Default Credentials vulnerability allows unauthorized access to the web application due to the use of default login credentials. This poses a risk to the confidentiality, integrity and availability of systems running this server as attackers can gain control over sensitive data or system functions. Systems commonly affected are those running the HP Diagnostics Server web interface. A successful exploit could lead to full compromise of the server.

2. Technical Explanation

The vulnerability occurs because the HP Diagnostics Server is shipped with pre-defined usernames and passwords that are easily guessable. An attacker can leverage these default credentials to gain access to the web interface without legitimate authentication. This allows them to perform actions as if they were an authorized user, potentially leading to system compromise. The root cause of this issue is a weak security configuration.

• Root cause: Use of known default credentials for built-in accounts.
• Exploit mechanism: An attacker attempts to log in using the default username and password combination. For example, logging into the web interface with common defaults like ‘admin’/’password’.
• Scope: HP Diagnostics Server web application.

3. Detection and Assessment

To confirm vulnerability, check if the server is accessible via a web browser and attempt to log in using default credentials. A thorough assessment involves attempting multiple common default username/password combinations.

• Quick checks: Access the HP Diagnostics Server web interface through a web browser.
• Scanning: Nessus vulnerability ID 484d615c can be used to detect this issue, but results should be verified manually.
• Logs and evidence: Check server logs for successful login attempts using default credentials.

# No command available as the check is performed through a web interface login attempt.

4. Solution / Remediation Steps

The following steps outline how to fix this issue by changing the default password for built-in accounts. These steps should be small, testable and safe to roll back.

4.1 Preparation

• No services need to be stopped. A rollback plan involves restoring the backed-up configuration if needed.
• Change window needs may apply depending on internal policies, and approval from system owners may be required.

4.2 Implementation

1. Step 1: Log in to the HP Diagnostics Server web interface using existing credentials (if available) or default credentials if no other access exists.
2. Step 2: Navigate to the user account management section of the web interface.
3. Step 3: Locate the built-in accounts with default passwords.
4. Step 4: Change the password for each built-in account to a strong, unique password.
5. Step 5: Log out and verify that you can no longer log in using the old default credentials.

4.3 Config or Code Example

Before

# Default username: admin, Default password: password

After

# Username: admin, Password: [Strong Unique Password]

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege reduces the impact if an account is compromised. Safe defaults ensure systems are configured securely out-of-the-box. A patch cadence ensures timely updates and fixes for known vulnerabilities.

• Practice 1: Implement least privilege to limit access rights of accounts, reducing potential damage from compromise.
• Practice 2: Enforce strong password policies requiring complex passwords and regular changes.

4.5 Automation (Optional)

Automation is not recommended for this vulnerability due to the complexity of web interface interactions. Manual configuration change is preferred.

5. Verification / Validation

• Post-fix check: Attempt to log in with the original default username and password; it should fail.
• Re-test: Re-run the initial detection method (attempting login with default credentials) which should now be unsuccessful.
• Smoke test: Verify that authorized users can still access the web interface using their new passwords.

# No command available as the check is performed through a web interface login attempt.

6. Preventive Measures and Monitoring

• Baselines: Update a security baseline to require changing default passwords on new system deployments.
• Pipelines: Add automated checks during the build process to scan for hardcoded default credentials in configuration files.
• Asset and patch process: Implement a monthly review of systems to ensure all default passwords have been changed.

7. Risks, Side Effects, and Roll Back

Changing passwords may temporarily disrupt access if the new password is forgotten or incorrectly entered. Ensure users are aware of the change and have a recovery process in place. To roll back, restore the backed-up configuration.

• Risk or side effect 1: Temporary loss of access if the new password is lost; ensure a documented reset procedure exists.

8. References and Resources

Links to official advisories and trusted documentation related to this vulnerability.

• Vendor advisory or bulletin: http://www.nessus.org/u?484d615c