CVE-2021-1497

What is Cisco HyperFlex HX?

Cisco HyperFlex is Cisco's hyperconverged infrastructure (HCI) platform, combining compute, storage, and networking into a single integrated system managed through a centralized software-defined fabric. HyperFlex clusters are deployed in enterprise data centers as an alternative to traditional three-tier infrastructure, managing virtual machines and workloads across all cluster nodes. The Installer Virtual Machine (Installer VM) is a temporary deployment appliance used during HyperFlex cluster setup and expansion — it provides a web-based workflow for configuring new nodes. Even though the Installer VM is intended for temporary use, many deployments leave it running after initial setup. See also CVE-2021-1498 for the companion vulnerability in the HyperFlex HX Data Platform management web service.

Overview

CVE-2021-1497 is an OS command injection vulnerability (CWE-78) in the web-based management service of the Cisco HyperFlex HX Installer Virtual Machine. The Installer VM's web service accepts POST parameters for cluster configuration that are passed to OS commands without adequate sanitization. An unauthenticated remote attacker can inject arbitrary OS commands via these parameters, achieving code execution as root on the Installer VM. Cisco addressed this vulnerability alongside the companion CVE-2021-1498 in Security Advisory cisco-sa-hyperflex-rce-TjjNrkpR in May 2021.

Affected Versions

Technical Details

The Cisco HyperFlex Installer VM provides a REST/web API for cluster installation and node configuration tasks. Input parameters submitted to these installation endpoints are processed by underlying shell scripts:

• Root cause: OS command injection (CWE-78) — the Installer VM web service passes user-supplied configuration parameters (such as hostnames, IP addresses, or configuration values) to shell commands without filtering metacharacters
• Injection vector: Specially crafted POST parameters containing shell metacharacters (;, &&, |, $(...)) cause the web service to execute additional attacker-controlled commands
• Authentication required: None — the Installer VM web service is accessible without authentication since it is designed to function before cluster authentication is established
• Execution context: Commands execute as root on the Installer VM operating system, giving full control of the appliance
• Distinction from CVE-2021-1498: CVE-2021-1497 affects the Installer VM specifically; CVE-2021-1498 affects the HX Data Platform web service and runs as the tomcat8 user rather than root

Discovery

Reported to Cisco by external security researchers. Cisco PSIRT coordinated disclosure and released patches in May 2021 covering both CVE-2021-1497 and CVE-2021-1498 simultaneously.

Exploitation Context

HyperFlex Installer VMs left running after initial cluster deployment represent an unnecessary and highly-privileged attack surface. Root access to the Installer VM provides access to HyperFlex cluster credentials and configuration data stored during the installation process, which can be used for further lateral movement into the HyperFlex cluster and connected infrastructure. Cisco HyperFlex clusters in enterprise data centers often manage production workloads across many virtual machines — an attacker with cluster-level access can affect all managed VMs.

Remediation

1. Apply patches per Cisco Security Advisory cisco-sa-hyperflex-rce-TjjNrkpR — update HyperFlex HX Data Platform to 4.0(2b), 4.5(1a), or later
2. Power off or decommission the Installer VM if HyperFlex cluster installation is complete — the Installer VM should not remain running in production environments
3. If the Installer VM must remain running for administrative purposes, restrict network access to it via ACLs or firewall rules — it should only be reachable from authorized administrator workstations
4. Verify that no internet-facing network path exists to the Installer VM's web service
5. Review Installer VM logs for unexpected POST requests to the cluster configuration API from unauthorized sources
6. After patching, audit HyperFlex cluster credentials and rotate any credentials that may have been accessible via the Installer VM