Cisco Integrated Management Controller Web-based Management Interface Request Header improper authentication

Summaryinfo

A vulnerability was found in Cisco Integrated Management Controller, UCS Director and UCS Director Express for Big Data. It has been rated as critical. This impacts an unknown function of the component Web-based Management Interface. The manipulation as part of Request Header leads to improper authentication. This vulnerability is uniquely identified as CVE-2019-1937. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cisco Integrated Management Controller, UCS Director and UCS Director Express for Big Data (Virtualization Software) (version unknown) and classified as critical. This issue affects an unknown function of the component Web-based Management Interface. The manipulation as part of a Request Header leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.

The weakness was disclosed 08/21/2019 as cisco-sa-20190821-imcs-ucs-aut as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. The identification of this vulnerability is CVE-2019-1937 since 12/06/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51589). The entry VDB-140570 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• Integrated Management Controller
• UCS Director
• UCS Director Express for Big Data

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion