Description
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
BMC Server Automation RSCD Agent NSH Remote Command Execution
exploit/multi/misc/bmc_server_automation_rscd_nsh_rce
Exploit-DB 2
- BMC Server Automation RSCD Agent - NSH Remote Command Execution (Metasploit) EDB-43939 · remote · Feb 1, 2018 · verified
- BMC BladeLogic 8.3.00.64 - Remote Command Execution EDB-43902 · remote · Jan 26, 2018
GitHub 2 repositories
-
bao7uo/bmc_bladelogic ★ 20 · Jan 24, 2018
BMC Bladelogic RSCD exploits including remote code execution - CVE-2016-1542, CVE-2016-1543, CVE-2016-5063
-
patriknordlen/bladelogic_bmc-cve-2016-1542 ★ 0 · Apr 27, 2017
A rebuilt version of the exploit for CVE-2016-1542 and CVE-2016-1543 from insinuator.net
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://packetstormsecurity.com/files/136461/BMC-Server-Automation-BSA-RSCD-Agent-User-Enumeration.html
- https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/
- 20160328 BMC-2015-0010: User enumeration vulnerability in BMC Server Automation (BSA) Unix/Linux RSCD Agent (CVE-2016-1542) mailing-list
- 43902 exploit
- 43939 exploit
- https://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solution