Privilege Escalation Flaw Discovered in the Cisco Adaptive Security Appliance

save
Share and earn Cybytes
Facebook Twitter LinkedIn Email

Tenable has discovered a privilege escalation flaw in the Cisco Adaptive Security Appliance that allows low-level users to run higher-level commands when certain configuration settings are set.

  • What you need to know: An authenticated remote unprivileged user can change or download the running configuration or replace the appliance firmware where they shouldn’t.
  • What’s the attack vector? HTTP Requests
  • What’s the business impact? Attackers could read or write files on the system, overwrite firmware and create new users.
  • What’s the solution? Update to the latest version of Cisco IOS.

Background

Tenable has discovered privilege escalation flaws in the Cisco Adaptive Security Appliance (ASAv) 9.9.2. Cisco has assigned this issue CVE-2018-15465. This flaw would allow users with the lowest privilege level of 1 to potentially overwrite the system’s firmware, request the full configuration file, and create new users with privilege level 15. It requires the HTTP interface for IOS to be enabled, and the “aaa” authentication scheme needs to be set, which is not part of the ASAv default configuration.

Cisco’s ASAv is a virtual machine (VM) with nearly identical features to the company’s physical ASA, which are network security devices that provide firewall, intrusion prevention and private network (VPN) capabilities. The ASAv has additional features for clustering and multiple contexts. The ASAv is primarily deployed to manage VPN and network switching in cloud or other environments.

Analysis

When command authorization is not enabled, an authenticated remote unprivileged (level 0 or 1) user can change or download the running configuration as well as upload or replace the appliance firmware. Downgrading appliance firmware to an older version would allow an attacker to leverage known vulnerabilities that have been well researched or have publicly available exploit modules.

A simple proof of concept for downloading the running configuration follows:

curl --basic -u notadmin -p -k http://<ip>/admin/system/running-config

The following proof of concept allows an unprivileged user to add a new privileged user to the running configuration:

curl --basic -u notadmin -p -k -X “POST” --data-binary “username fourthuser password backdoor privilege 15” “http://<ip>/admin/config”

According to Cisco “This vulnerability affects Cisco ASA Software that is running on any Cisco product that has web management access enabled.”

Vendor response

Cisco released an advisory, “Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability,” with details on the vulnerability and patch information. Customers can download the update here.

Solution

Cisco has released an advisory and patches. You can find full details linked below. Cisco also notes “for the fix to be effective, customers who have web management access enabled must ensure that the AAA configuration is accurate and complete. In particular, the aaa authentication http console {LOCAL | <aaa-server>} command must be present.”

Additional information

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Share this post and earn Cybytes
Facebook Twitter LinkedIn Email
Follow
1612 Followers
About Tenable
Tenable™, Inc. is the Cyber Exposure company. Over 24,000 organizations of all sizes around the globe rely on Tenable to manage and measure their modern attack surface to accurately understand and reduce cyber risk. As the creator of Nessus®, Tenable built its platform from the ground up to deeply understand assets, networks and vulnerabilities, extending this knowledge and expertise into Tenable.io™ to deliver the world’s first platform to provide live visibility into any asset on any computing platform. Tenable customers include over 50 percent of the Fortune 500, large government agencies and organizations across the private and public sectors. Learn more at tenable.com.
Promoted Content
Five Steps to Building a Successful Vulnerability Management Program
Is your vulnerability management program struggling? Despite proven technology solutions and the best efforts of IT teams, unresolved vulnerabilities remain an ongoing source of friction and frustration in many organizations. Regardless of how many vulnerabilities are fixed, there will always be vulnerabilities that can’t easily be remediated – and too often, finger-pointing between IT teams and business groups can ensue.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel