CVE-2019-12127
📋 TL;DR
CVE-2019-12127 is an authentication bypass vulnerability in ONAP Operations Manager (OOM) that allows unauthenticated attackers to gain full access to ONAP services by connecting to specific ports. All ONAP OOM setups through the Dublin release are affected, enabling complete compromise of the management platform.
💻 Affected Systems
- ONAP Operations Manager (OOM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of ONAP infrastructure allowing data exfiltration, service disruption, and lateral movement to connected systems.
Likely Case
Unauthorized access to ONAP management services leading to configuration changes, service manipulation, and potential data exposure.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to vulnerable ports.
🎯 Exploit Status
Exploitation requires only network access to vulnerable ports - no authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after Dublin release
Vendor Advisory: https://jira.onap.org/browse/OJSI-27
Restart Required: Yes
Instructions:
1. Upgrade ONAP OOM to version after Dublin release. 2. Apply all security patches from ONAP security advisories. 3. Restart all ONAP services after upgrade.
🔧 Temporary Workarounds
Network Access Control
linuxBlock external access to vulnerable ports using firewall rules
iptables -A INPUT -p tcp --dport 30234 -j DROP
iptables -A INPUT -p tcp --dport 30290 -j DROP
iptables -A INPUT -p tcp --dport 32010 -j DROP
iptables -A INPUT -p tcp --dport 30270 -j DROP
iptables -A INPUT -p tcp --dport 30224 -j DROP
iptables -A INPUT -p tcp --dport 30281 -j DROP
iptables -A INPUT -p tcp --dport 30254 -j DROP
iptables -A INPUT -p tcp --dport 30285 -j DROP
iptables -A INPUT -p tcp --dport 30271 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ONAP systems from untrusted networks
- Deploy network-based intrusion detection to monitor for unauthorized access attempts to vulnerable ports
🔍 How to Verify
Check if Vulnerable:
Test if you can connect to any of the vulnerable ports (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, 30271) without authentication using telnet or ncCheck Version:
Check ONAP documentation or deployment manifests for version informationVerify Fix Applied:
Verify ONAP version is post-Dublin release and test that authentication is required when connecting to previously vulnerable ports📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to ONAP service ports
- Failed authentication attempts followed by successful access
Network Indicators:
- External connections to ports 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, 30271 without prior authentication
SIEM Query:
source_ip=external AND (dest_port=30234 OR dest_port=30290 OR dest_port=32010 OR dest_port=30270 OR dest_port=30224 OR dest_port=30281 OR dest_port=30254 OR dest_port=30285 OR dest_port=30271) AND auth_success=true