A critical unauthenticated remote code execution vulnerability (CVE-2024-13804) has been discovered in HPE Insight Cluster Management Utility (CMU) v8.2, enabling attackers to bypass authentication mechanisms and execute commands with root privileges on the backend server. By weaponizing the Java client application against the server, attackers can modify client-side code to bypass security restrictions and gain administrative access. The researcher discovered that by decompiling the application’s JAR file and modifying key authorization checks, the client can be weaponized to send privileged commands to the server via Remote Method Invocation (RMI). After recompiling the modified client, it can be used to execute arbitrary commands on the server with root privileges via the ModelDispatcher.getRMIModel().executeCmdLine() method, where the attacker successfully executes the “ifconfig” command. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The vulnerability was initially reported to HPE in May 2023 but only received the CVE identifier in January 2025 after extensive follow-up with multiple security organizations, highlighting challenges in the vulnerability disclosure process. Navigating The Shadows (0xbad53c) analyst/researcher observed the vulnerability exists within the application’s Java Network Launch Protocol (JNLP) client architecture. The exploitation process begins with downloading and decompiling the CMU client application (cmugui_standalone.jar), which connects to the backend server over port 1099. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. This high-severity vulnerability affects a tool designed for managing high-performance computing clusters, potentially giving attackers complete control over entire computing environments. The vulnerability stems from fundamental design flaws in how the CMU application implements client-side authorization checks without proper server-side validation.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 31 Mar 2025 13:30:11 +0000