HPE Aruba AOS-CX Pre-Auth REST API Bypass via nginx Version Smuggling (CVE-2026-23813)

Metadata

Affected Target

Summary

AOS-CX fronts its management REST API with nginx, which uses an over-permissive regular expression to route requests by API version/login path. By smuggling a login-flavored token into the request path, an unauthenticated attacker can reach REST endpoints that should only be accessible to authenticated sessions, exposing the OVSDB-backed device configuration — including the administrator’s password hash. On the 10.10.x branch specifically, this bypass can additionally be chained into creating a configuration checkpoint and reading it back in full via the unauthenticated path. The repository ships a non-destructive detector, an educational side-by-side demo of the routing bypass, and a full config-disclosure PoC scoped to 10.10.x.

Vulnerability Details

Root Cause

nginx’s reverse-proxy configuration in front of the AOS-CX REST API matches request paths using a version regex that is broad enough to also match a smuggled login token, causing requests intended to be gated behind authentication to be routed to the unauthenticated REST handlers instead.

Attack Vector

1. Send a crafted request containing the login-smuggled path segment to the AOS-CX management REST API without any credentials.
2. Confirm the bypass reaches endpoints normally requiring an authenticated session (bypass_demo.py compares response codes with/without the smuggle).
3. On AOS-CX 10.10.x, use the bypass to POST a configuration checkpoint via /rest/v1/config/copy/running-config/<name>.
4. GET the checkpoint back via /rest/v1/fullconfigs/<name>, exposing the full running configuration including the User table’s password hashes.

Impact

Unauthenticated disclosure of the complete device configuration and administrator credential hash on affected AOS-CX switches, which can be cracked or replayed to gain full administrative control of the network device.

Environment / Lab Setup

Target:   HPE Aruba AOS-CX switch/VSX running an affected firmware branch, REST API reachable over HTTPS
Attacker: Python 3.8+, `pip install requests`

Proof of Concept

PoC Script

See detect.py, bypass_demo.py, and exploit.py in this folder (plus docs/ and detection/ for root-cause notes and log signatures).

1
2
3

python3 detect.py <host[:port]>          # non-destructive patch-status check
python3 bypass_demo.py <host[:port]>     # side-by-side proof of the routing bypass
python3 exploit.py <host[:port]>         # AOS-CX 10.10.x: creates a checkpoint and dumps the admin hash

detect.py sends a single read-only GET and reports PATCHED/VULNERABLE/UNKNOWN. bypass_demo.py sends the same endpoint normally and with the smuggle, printing both response codes for comparison. exploit.py is 10.10.x-specific: it creates a config checkpoint through the unauthenticated path, reads it back, and prints the admin account’s password hash.

Detection & Indicators of Compromise

GET /rest/v1/...;login... 200

Signs of compromise:

• Unauthenticated REST requests to /rest/v1/config/copy/running-config/* or /rest/v1/fullconfigs/* with no prior login/session cookie.
• Unexpected configuration checkpoints (e.g. named loginpoc or similar) appearing on the device that no administrator created.
• Suricata alerts matching the smuggle URI shape (see detection/suricata.rules).

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/offseckit/CVE-2026-23813 on 2026-07-05.