CVE-2019-12125
📋 TL;DR
CVE-2019-12125 is an authentication bypass vulnerability in ONAP Logging services that allows unauthenticated attackers to gain full administrative access to affected ONAP services by connecting to specific ports. All ONAP Operations Manager (OOM) deployments through the Dublin release are affected, making this a critical infrastructure vulnerability.
💻 Affected Systems
- ONAP (Open Network Automation Platform)
- ONAP Operations Manager (OOM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of ONAP infrastructure, allowing attackers to manipulate orchestration, access sensitive data, disrupt services, or pivot to other systems.
Likely Case
Unauthorized access to logging and monitoring systems, potential data exfiltration, and service disruption through configuration changes.
If Mitigated
Limited to attempted connection logs if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Exploitation requires only network access to vulnerable ports (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, 30271) with no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after Dublin release
Vendor Advisory: https://jira.onap.org/browse/OJSI-27
Restart Required: Yes
Instructions:
1. Upgrade ONAP to a version after Dublin release. 2. Apply security patches from ONAP security advisories. 3. Restart affected ONAP services after patching.
🔧 Temporary Workarounds
Network Access Control
linuxBlock external access to vulnerable ports using firewall rules
iptables -A INPUT -p tcp --dport 30234 -j DROP
iptables -A INPUT -p tcp --dport 30290 -j DROP
iptables -A INPUT -p tcp --dport 32010 -j DROP
iptables -A INPUT -p tcp --dport 30270 -j DROP
iptables -A INPUT -p tcp --dport 30224 -j DROP
iptables -A INPUT -p tcp --dport 30281 -j DROP
iptables -A INPUT -p tcp --dport 30254 -j DROP
iptables -A INPUT -p tcp --dport 30285 -j DROP
iptables -A INPUT -p tcp --dport 30271 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ONAP services from untrusted networks
- Deploy intrusion detection systems to monitor for unauthorized access attempts to the vulnerable ports
🔍 How to Verify
Check if Vulnerable:
Check if ONAP services are listening on vulnerable ports: netstat -tulpn | grep -E ':30234|:30290|:32010|:30270|:30224|:30281|:30254|:30285|:30271'Check Version:
Check ONAP release version in deployment configuration or via ONAP CLIVerify Fix Applied:
Verify ports are no longer accessible without authentication and check ONAP version is post-Dublin📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to ONAP logging ports
- Unexpected administrative actions from unauthenticated sources
Network Indicators:
- Connection attempts to ports 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, 30271 from unauthorized sources
SIEM Query:
source_port IN (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, 30271) AND auth_status='failed'