Description

A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege level, potentially leading to further unauthorized access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-01T20:17:18.817Z",
  "pubdate": "2026-09-01T20:17:18.817Z",
  "executiveSummary": "HPE Networking Fabric Composer is susceptible to a sensitive information disclosure vulnerability stemming from improper authorization controls within the API.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR) or Broken Access Control issue.\nSuccessful exploitation permits an authenticated user with low-privilege operator access to bypass intended authorization constraints, facilitating unauthorized retrieval of sensitive data beyond their designated scope.\nThe primary risk involves the unauthorized exposure of configuration data, network topologies, or security-sensitive metadata managed by the Fabric Composer.\nAttackers require valid, low-privilege authentication credentials to the system to initiate the exploit.\nThe exploit does not require administrative privileges, significantly lowering the barrier for internal threat actors or compromised low-privilege accounts to escalate information gathering and reconnaissance activities within the network management plane.",
  "technicalDetails": "The vulnerability resides within the API request handling logic of HPE Networking Fabric Composer. The root cause is a failure to consistently enforce server-side authorization checks when processing requests for specific API endpoints.\nTypically, the application relies on client-provided identifiers—such as object IDs or resource handles—without strictly validating whether the requesting session possesses the necessary permission mapping to access the targeted object.\nExploitation involves an authenticated low-privilege operator user manipulating request parameters (e.g., modifying UUIDs or integer identifiers in a RESTful API URI or within a JSON payload) to reference resources that are outside of their authorized scope.\nThe attack flow proceeds as follows: First, the attacker establishes a valid session with the Fabric Composer API using standard low-privilege credentials. Second, the attacker interacts with legitimate endpoints to identify the request structure and parameter format. Third, the attacker systematically iterates through resource identifiers or targets specific high-value identifiers that should be inaccessible to their role. Because the application logic fails to re-verify the ownership or access rights of the requested object, the API returns the requested sensitive data in the HTTP response body.\nThis behavior indicates a failure in the application's access control layer, likely at the controller or service level, where object-level authorization is missing or improperly implemented after the initial session authentication has been performed.\nThe post-exploitation impact includes the potential for full unauthorized disclosure of network configuration data. By accessing restricted API objects, an attacker can obtain detailed information about the fabric architecture, integrated devices, and management policies. This information facilitates lateral movement planning, identification of further attack surfaces, and potential exposure of credentials or sensitive tokens if they are inadvertently logged or exposed within the fabric's metadata. The vulnerability effectively allows an attacker to map the managed environment comprehensively, undermining the security posture of the entire software-defined networking fabric."
}