CVE-2022-20956: Unauthorized Access to System Files in Cisco ISE's Web-based Management Interface

A vulnerability (CVE-2022-20956) has been discovered in the web-based management interface of Cisco Identity Services Engine (ISE) that could expose users to potential attacks. Under certain circumstances, an authenticated, remote attacker may be able to bypass authorization controls and access system files. This issue stems from improper access control in the web-based management interface of the affected device. By sending a carefully crafted HTTP request to the targeted device, attackers can exploit this vulnerability to gain access to certain files that they shouldn't be able to view.

To better understand the risks associated with this vulnerability, let's take a look at how the exploit might work:

1. The attacker logs into the web-based management interface of the Cisco ISE device, using valid credentials.
2. The attacker uses a tool, such as curl, to send a specially crafted HTTP request to the vulnerable device:

curl -X POST -H "Content-Type: application/json" \
  -d @exploit_payload.json \
  --user "attacker_username:attacker_password" \
  "https://vulnerable-device.example.com/vulnerable_endpoint";

The exploit payload JSON file exploit_payload.json could be something similar to

{
  "file_id": "../../../etc/passwd"
}

4. In response, the vulnerable device sends the content of the /etc/passwd file, which provides the attacker with an unauthorized list of users and information about their accounts.
5. With this information, the attacker can further compromise the affected system by downloading, deleting, or tampering with sensitive files.

Original references about this vulnerability can be found on Cisco's Security Advisory page: Cisco Security Advisory - Cisco Identity Services Engine Access Control Bypass Vulnerability (cisco-sa-ise-access-contol-EeufSUCx)

To protect against this vulnerability, Cisco is planning to release software updates to address the issue. In the meantime, users should exercise caution when using the web-based management interface of Cisco ISE devices and monitor their networks for suspicious activity. In addition, users should ensure that access to the management interface is restricted to trusted individuals and follow best practices for strong password policies and multi-factor authentication.

If you suspect your device may be affected by this vulnerability, we recommend visiting the Cisco Security Advisory page for the latest information on available patches and mitigation measures. The security of your network and data should always be a top priority, and staying informed is the first step in safeguarding your assets.

Timeline

Published on: 11/04/2022 18:15:00 UTC
Last modified on: 11/08/2022 15:54:00 UTC