Pre-Auth

Smurf amplification requires three weaknesses simultaneously: no uRPF allows IP source spoofing, directed broadcast forwarding delivers the packet to all VLAN hosts, hosts reply to broadcast ICMP Echo. RFC 2644 fixed router-level directed broadcast. L2 broadcast domains are unaffected — the packet never crosses a router. Enterprise wireless VLANs with 50-100 APs and controllers become 50-100x amplifiers. ICMP processing is pre-authentication: no credentials, no session. Two-machine verification: attacker sends spoofed src=victim to broadcast, victim captures unsolicited Echo Replies. pcap-level proof included.

Three compounding weaknesses in ArubaOS 8.13.2.0 ICMP handler: IP Total Length over-read reads 18 bytes past actual frame data into Ethernet padding (CWE-126); TTL=0 packets are processed and replied to in RFC 791 violation (CWE-1284); ICMP checksums are never validated (CWE-354). TTL=0 makes extraction invisible — routers don’t forward, IDS ignores, firewalls don’t log. 27/27 crafted probes confirmed. On physical AOS-8 hardware with active management traffic, the 18-byte DMA region contains previous frame fragments. CVE-2003-0001 and CVE-2021-3031 accepted on identical mechanism without physical hardware PoC.

ArubaOS 8.13.2.0 ships default-xml-api AAA profile on port 32000/TCP with no authentication. The XML parser processes SYSTEM entity declarations and resolves them outbound. Four independent evidence items: wire-level pcap confirms controller TCP connection to attacker listener, target sshd log shows 127.0.0.1-sourced GET request impossible to produce externally, attacker HTTP server logged three DTD fetches at 02:33/02:36/02:38, nine internal ports confirmed open via dialog success responses. CWE-611. CVSS 9.3 Critical. Bugcrowd closed as theoretical. No fix issued.

ArubaOS 8.13.2.0 does not validate ICMP Echo Request source IPs against MAC/IP bindings or apply uRPF — attacker MAC with victim IP is accepted and replied to (CWE-290). Broadcast source IP (192.168.56.255) causes the controller to reply to ff:ff:ff:ff:ff:ff, delivering the reply to every host on the L2 segment (CWE-406). Two-machine evidence: Parrot OS attacker sends spoofed request, Windows victim receives unsolicited Echo Reply id=0xc101 confirmed in independent pcap. No ICMP request was sent from the victim. RFC 1122 §3.2.2.6 violation. Bugcrowd closed as expected behavior. No fix issued.