A critical security vulnerability in the Cisco IOS XE environment was discovered on October 16, 2023, on the Web UI protocol.

What is this about?

This vulnerability allows an unauthenticated remote attacker to create an account on the system. This account would have privilege level 15 access, granting full control over the compromised device.

The attacker could then use this account to gain control of the affected system. The vulnerability has been publicly acknowledged by Cisco and is tracked as CVE-2023-20198.

Affected Products:
Devices running Cisco IOS XE if the WEB UI feature is enabled. This feature can be enabled with the following two commands:
– ip http server
– ip http secure-server

Potential impacts:

– Full takeover of the compromised device by the attacker

Checking these devices for vulnerability:

Enter the following in the CLI of your Cisco IOS XE device:
show running-config | include ip http server | secure | active

If the command output returns the following:
– ip http server
– ip http secure-server
Then your machine is vulnerable to this CVE.

ITrust recommends investigating the presence of the following Indicators of Compromise (IoCs):

To determine if the device is compromised, check the logs for the presence of users unknown to the network administrator:

%SYS-5-CONFIG_P: Configured programmatically by process SEP_webui_wsma_http from console as user on line%SEC_LOGIN-5-WEBLOGIN_SUCCESS: Login Success [user: user] [Source: source_IP_address] at 03:42:13 UTC Wed Oct 11 2023

The message “%SYS-5-CONFIG_P” will be present for each instance where a user accessed the Web interface.

Check the logs for the following message, where the file name is unknown and inconsistent with authorized network actions:
%WEBUI-6-INSTALL_OPERATION_INFO: User: username, Install Operation: ADD filename

A command can be used to check for the presence of an implant deployed by the attacker:
curl -k -X POST « https://systemip/webui/logoutconfirm.html?logon_hash=1« 

systemip is the IP address of the target machine to be checked.

Remediation:

  • At this time, no patch has been released.
    If your devices are running Cisco IOS XE and “ip http server” or “ip http secure-server” is configured.

    If you do not require the HTTP Server feature, disable it.
    If this service is required, restrict access as much as possible.

    Restrict access to the Web server exclusively to trusted networks.

Additional recommendations:

Use IS security mechanisms: SIEM, EDR, or contact your cybersecurity monitoring provider (managed SOC).

> Do not leave these types of services exposed and unprotected. ITrust provides tools to detect cyberthreats, ransomware, viruses, and anomalous behavior within your IS, such as our Reveelium UEBA SIEM.

> Regularly scan your network to detect security vulnerabilities and patches to apply. Our vulnerability scanner IKare, available as a free trial, enables the detection of new security flaws.

If you need assistance in remediating these vulnerabilities, call us. (+33 5 67 34 67 80)

*Sources:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4zhttps://vulncheck.com/blog/cisco-implants