Cisco IOS XE REST API Virtual Service Container HTTP Requests improper authentication

Summaryinfo

A vulnerability was found in Cisco IOS XE. It has been rated as critical. This vulnerability affects unknown code of the component REST API Virtual Service Container. This manipulation as part of HTTP Requests causes improper authentication. This vulnerability is handled as CVE-2019-12643. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cisco IOS XE (Router Operating System) (version unknown). It has been declared as critical. Affected by this vulnerability is an unknown function of the component REST API Virtual Service Container. The manipulation as part of a HTTP Requests leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on the managed Cisco IOS XE device. The vulnerability is due to an improper check performed by the area of code that manages the REST API authentication service. An attacker could exploit this vulnerability by submitting malicious HTTP requests to the targeted device. A successful exploit could allow the attacker to obtain the token-id of an authenticated user. This token-id could be used to bypass authentication and execute privileged actions through the interface of the REST API virtual service container on the affected Cisco IOS XE device. The REST API interface is not enabled by default and must be installed and activated separately on IOS XE devices. See the Details section for more information.

The weakness was released 08/28/2019 as cisco-sa-20190828-iosxe-rest-a as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2019-12643 since 06/04/2019. The exploitation appears to be easy. The attack can be launched remotely. The successful exploitation requires a single authentication. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion