{"id":13520,"date":"2018-10-04T14:19:12","date_gmt":"2018-10-04T22:19:12","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/10\/04\/news-7287\/"},"modified":"2018-10-04T14:19:12","modified_gmt":"2018-10-04T22:19:12","slug":"news-7287","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2018\/10\/04\/news-7287\/","title":{"rendered":"SSD Advisory \u2013 Cisco Prime Infrastructure File Inclusion and Remote Command Execution to Privileges Escalation"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Thu, 04 Oct 2018 05:12:22 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
Cisco Prime Infrastructure (CPI) contains two vulnerabilities that when exploited allow an unauthenticated attacker to achieve root privileges and execute code remotely. The first vulnerability is a file upload vulnerability that allows the attacker to upload and execute JSP files as the Apache Tomcat user. The second vulnerability is a privilege escalation to root by bypassing execution restrictions in a SUID binary.<\/p>\n

Vendor Response<\/strong>
Cisco has issued an advisory, https:\/\/tools.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-20181003-pi-tftp, which provides a workaround and a fix for the vulnerability. From our assessment the provided fix only addresses the file uploading part of the exploit, not the file inclusion, the ability to execute arbitrary code through it or the privileges escalation issue that the product has.<\/p>\n

CVE<\/strong>
CVE-2018-15379<\/p>\n

Credit<\/strong>
An independent security researcher, Pedro Ribeiro, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
<\/span>
Affected systems<\/strong>
Cisco Prime Infrastructure 3.2 and newer<\/p>\n

Vulnerability Details<\/strong>
First Vulnerability: Arbitrary file upload and execution via tftp and Apache Tomcat<\/em>
Attack Vector: Remote
Constraints: None<\/p>\n

Most web applications running on the CPI virtual appliance are deployed under \/opt\/CSCOlumos\/apache-tomcat-<VERSION>\/webapps. One of these applications is “swimtemp”, which symlinks to \/localdisk\/tftp:<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n

Shell<\/span><\/div>\n<\/div>\n

<\/div>\n