In the VN 2018-003 disclosure, it is unclear to me if the attacker would have to be authenticated within the web GUI (as an administrator or otherwise) in order to conduct the arbitrary file write from CVE-2018-5795. Can you please let me know what your investigation found on this?
Thank you for the response, I was attempting to NOT have to make assumptions. You understand my confusion given the difference in wording between the two CVEs. Did the team doing analysis of the IOActive research CONFIRM no GUI authentication is necessary?
Restricting GUI access via ACL is a given, however it only reduces the attack surface. ACL + strong GUI password policy would be better... if the authentication matters.
as per the VN description I assume attacker does NOT have to be authenticated
Following are the noted vulnerabilities:
Remote and unauthenticated XML entity expansion vulnerability can cause denial of service (CVE-2018-5789)CVSS base score: 7.5 (High) (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Arbitrary file write from WebGUI (CVE-2018-5795)CVSS base score: 2.6 (Low) (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N)
Attack: To launch this attack, a malicious user needs access to the management interface of the WiNG AP / Controller. An attack consists of sending specially crafted XML entities that could lead to AP / Controller crash