Full Report
HPE security advisory (AV26-185)
Analysis Summary
# Vulnerability: HPE AutoPass License Server (APLS) Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2024-52055
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication)
## Affected Systems
- **Products:** HPE AutoPass License Server (APLS)
- **Versions:** All versions prior to v9.19
- **Configurations:** Systems running the license management service accessible via the network.
## Vulnerability Description
A critical vulnerability exists in the HPE AutoPass License Server (APLS) that could allow for remote authentication bypass. The flaw is rooted in improper verification of credentials or session tokens, allowing an unauthenticated remote attacker to gain administrative access to the license server. Once bypassed, the attacker can manage licenses, modify configurations, or potentially leverage the server for further lateral movement within the network environment.
## Exploitation
- **Status:** Not currently reported as exploited in the wild (PoC status: Private/Not publicly released at time of advisory).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to license data and server configuration)
- **Integrity:** High (Modification of licenses and system settings)
- **Availability:** High (Potential to revoke licenses or shut down the service)
## Remediation
### Patches
HPE recommends upgrading to the following version or newer:
- **HPE AutoPass License Server (APLS) v9.19**
### Workarounds
No specific functional workaround has been provided by the vendor. It is highly recommended to restrict network access to the APLS management interface to authorized IP addresses only via firewall rules or ACLs until the patch is applied.
## Detection
- **Indicators of Compromise:** Monitor audit logs for unusual administrative logins from unexpected IP addresses or unauthorized license modifications.
- **Detection methods and tools:** Vulnerability scanners (Nessus, Qualys) updated with the latest plugins for HPE products can identify outdated APLS versions.
## References
- **Vendor Advisory:** hxxps[://]support[.]hpe[.]com/hpesc/public/docDisplay?docId=hpesbgn05003en_us&docLocale=en_US
- **HPE Security Bulletin Library:** hxxps[://]support[.]hpe[.]com/connect/s/securitybulletinlibrary?language=en_US
- **Canadian Centre for Cyber Security Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/hpe-security-advisory-av26-185