Privilege Escalation Flaw Discovered in the Cisco Adaptive Security Appliance
Tenable has discovered a privilege escalation flaw in the Cisco Adaptive Security Appliance that allows low-level users to run higher-level commands when certain configuration settings are set.
- What you need to know: An authenticated remote unprivileged user can change or download the running configuration or replace the appliance firmware where they shouldn’t.
- What’s the attack vector? HTTP Requests
- What’s the business impact? Attackers could read or write files on the system, overwrite firmware and create new users.
- What’s the solution? Update to the latest version of Cisco IOS.
Background
Tenable has discovered privilege escalation flaws in the Cisco Adaptive Security Appliance (ASAv) 9.9.2. Cisco has assigned this issue CVE-2018-15465. This flaw would allow users with the lowest privilege level of 1 to potentially overwrite the system's firmware, request the full configuration file, and create new users with privilege level 15. It requires the HTTP interface for IOS to be enabled, and the “aaa” authentication scheme needs to be set, which is not part of the ASAv default configuration.
Cisco’s ASAv is a virtual machine (VM) with nearly identical features to the company’s physical ASA, which are network security devices that provide firewall, intrusion prevention and private network (VPN) capabilities. The ASAv has additional features for clustering and multiple contexts. The ASAv is primarily deployed to manage VPN and network switching in cloud or other environments.
Analysis
When command authorization is not enabled, an authenticated remote unprivileged (level 0 or 1) user can change or download the running configuration as well as upload or replace the appliance firmware. Downgrading appliance firmware to an older version would allow an attacker to leverage known vulnerabilities that have been well researched or have publicly available exploit modules.
A simple proof of concept for downloading the running configuration follows:
curl --basic -u notadmin -p -k http://<ip>/admin/system/running-config
The following proof of concept allows an unprivileged user to add a new privileged user to the running configuration:
curl --basic -u notadmin -p -k -X “POST” --data-binary “username fourthuser password backdoor privilege 15” “http://<ip>/admin/config”
According to Cisco “This vulnerability affects Cisco ASA Software that is running on any Cisco product that has web management access enabled.”
Vendor response
Cisco released an advisory, “Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability,” with details on the vulnerability and patch information. Customers can download the update here.
Solution
Cisco has released an advisory and patches. You can find full details linked below. Cisco also notes “for the fix to be effective, customers who have web management access enabled must ensure that the AAA configuration is accurate and complete. In particular, the aaa authentication http console {LOCAL | <aaa-server>} command must be present.”
Additional information
- Advisory: Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability
- Tenable Advisory
Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Related Articles
Volt Typhoon: U.S. Critical Infrastructure Targeted by State-Sponsored Actors
November 19, 2024Volt Typhoon, a state-sponsored actor linked to the People’s Republic of China, has consistently targeted U.S. critical infrastructure with the intent to maintain persistent access. Tenable Research examines the tactics, techniques and procedures of this threat actor.
CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild
November 18, 2024Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
- Vulnerability Management