[R1] HPE Intelligent Management Center SOM Module Remote File Disclosure

While Tenable was analyzing CVE-2017-5797 we realized that HPE did not completely fix the issue. Their attempted patch:

1. Updated the application to require authentication to access the fileDownload endpoint.
2. Added logic to restrict some files from being downloaded.

However, there is nothing in the patch that prevents path traversal. An authenticated user can download arbitrary files from the remote target. Here is an example of a URL that would download win.ini as somefile from a vulnerable host:

http://[target]:8080/servicedesk/servicedesk/fileDownload?OperType=2&fileName=c29tZWZpbGU=&filePath=c2VydmljZWRlc2tcV0VCLUlORlxwcm9jZXNzXC4uXC4uXC4uXC4uXC4uXC4uXC4uXC4uXC4uXC4uXC4uXC4uXFdpbmRvd3Ncd2luLmluaQ==

Oddly, HPE's advisory scores this vulnerability as a CVSSv2 9.4. We believe they erroneously indicate authentication is not required and that the remote attacker can modify files. Our own scoring flags this as a 6.8.