Cisco Web Security Appliance Command-Line Interface input validation

Summaryinfo

A vulnerability, which was classified as critical, was found in Cisco Web Security Appliance. The affected element is an unknown function of the component Command-Line Interface. Such manipulation leads to input validation. This vulnerability is referenced as CVE-2019-1816. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in Cisco Web Security Appliance (Anti-Malware Software) (affected version not known). It has been rated as critical. Affected by this issue is some unknown functionality of the component Command-Line Interface. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the log subscription subsystem of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The vulnerability is due to insufficient validation of user-supplied input on the web and command-line interface. An attacker could exploit this vulnerability by authenticating to the affected device and injecting scripting commands in the scope of the log subscription subsystem. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.

The bug was discovered 05/01/2019. The weakness was published 05/03/2019 as cisco-sa-20190501-wsa-privesc as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2019-1816 since 12/06/2018. The attack needs to be approached locally. A simple authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/12/2023).

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316435 (Cisco Web Security Appliance Privilege Escalation Vulnerability(cisco-sa-20190501-wsa-privesc)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-134361. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Anti-Malware Software

Vendor

• Cisco

Name

• Web Security Appliance

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion