Vulnerabilities > CVE-2015-6435 - OS Command Injection vulnerability in Cisco products

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
cisco
CWE-78
critical
nessus
NVD
Published: 2016-01-22
Updated: 2021-01-30

Summary

An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request, aka Bug ID CSCur90888.

Vulnerable Configurations

Part Description Count
OS
Cisco
3
Application
Cisco
83

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Command Delimiters
    An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or a blacklist input validation, as opposed to whitelist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or blacklist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
  • Exploiting Multiple Input Interpretation Layers
    An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
  • Argument Injection
    An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
  • OS Command Injection
    In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.

Nessus

  • NASL familyCGI abuses
    NASL idCISCO_UCS_MANAGER_CSCUR90888.NASL
    descriptionThe Cisco Unified Computing System (UCS) Manager running on the remote device is affected by a remote command execution vulnerability due to unprotected calling of shell commands in the /ucsm/getkvmurl.cgi CGI script. An unauthenticated, remote attacker can exploit this, via a crafted HTTP request, to execute arbitrary commands.
    last seen2020-06-01
    modified2020-06-02
    plugin id88589
    published2016-02-05
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88589
    titleCisco Unified Computing System Manager CGI RCE (CSCur90888) (remote check)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(88589);
  script_version("1.7");
  script_cvs_date("Date: 2019/11/20");

  script_cve_id("CVE-2015-6435");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20160120-ucsm");
  script_xref(name:"CISCO-BUG-ID", value:"CSCur90888");

  script_name(english:"Cisco Unified Computing System Manager CGI RCE (CSCur90888) (remote check)");
  script_summary(english:"Checks response from the UCS manager.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a remote command execution
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Cisco Unified Computing System (UCS) Manager running on the remote
device is affected by a remote command execution vulnerability due to
unprotected calling of shell commands in the /ucsm/getkvmurl.cgi CGI
script. An unauthenticated, remote attacker can exploit this, via a
crafted HTTP request, to execute arbitrary commands.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-ucsm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b19d728f");
  script_set_attribute(attribute:"solution", value:
"Refer to Cisco bug ID CSCur90888 for any available patches, or contact
the vendor for a fix.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:ND");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-6435");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/01/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/02/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_computing_system");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ucs_manager_version.nasl");
  script_require_keys("installed_sw/cisco_ucs_manager");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("install_func.inc");

app = "Cisco UCS Manager";
get_install_count(app_name:"cisco_ucs_manager", exit_if_zero:TRUE);

port = get_http_port(default:80);
install = get_single_install(app_name:"cisco_ucs_manager", port:port);

url = build_url(qs:install["path"], port:port);

# Inject an echo command to cause a vulnerable and a patched UCSM 
# to send back a different string in the response 
data = 'username="A"&password="B\' http://localhost/; echo outCookie= ; #"';

res = http_send_recv3(
  port            : port,
  method          : "POST",
  item            : "/ucsm/getkvmurl.cgi",
  data            : data,
  content_type    : "application/x-www-form-urlencoded",
  exit_on_fail    : TRUE
);

if(res[0] =~ "^HTTP/[0-9.]+ 200") 
{
  if(res[2])
  {
    # Vulnerable
    if("GetKVMLaunchUrl:" >< res[2])
    {
      security_hole(port:port);   
    }
    # Patched
    else if ("UCSM cluster IP is inaccessible. Error Code:" >< res[2])
    {
      audit(AUDIT_WEB_APP_NOT_AFFECTED, "Cisco UCS Manager", url);
    }
    # Unexpected response body
    else
    {
      body = res[2];
      if(strlen(res[2]) > 128)
      {
        body = substr(res[2], 0, 127) + '...(truncated)'; 
      } 
      audit(AUDIT_RESP_BAD, port, 'a POST request, unexpected response body:\n' + body);
    }
  }
  else
    audit(AUDIT_RESP_BAD, port, "a POST request: no response body");
}
# UCSM versions 2.1 and earlier do not have getkvmurl.cgi
else if(res[0] =~ "^HTTP/[0-9.]+ 404") 
  audit(AUDIT_WEB_APP_NOT_AFFECTED, 'Cisco UCS Manager', url);
# Unexpected response status
else
  audit(AUDIT_RESP_BAD, port, 'a POST request, unexpected response status: \n' + res[0]);
  • NASL familyCISCO
    NASL idCISCO-SA-20160120-UCSM.NASL
    descriptionThe Cisco Unified Computing System (UCS) Manager running on the remote device is affected by a remote command execution vulnerability due to unprotected calling of shell commands in the /ucsm/getkvmurl.cgi CGI script. An unauthenticated, remote attacker can exploit this, via a crafted HTTP request, to execute arbitrary commands.
    last seen2020-06-01
    modified2020-06-02
    plugin id88488
    published2016-01-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88488
    titleCisco Unified Computing System Manager CGI RCE (CSCur90888)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(88488);
  script_version("1.7");
  script_cvs_date("Date: 2019/11/20");

  script_cve_id("CVE-2015-6435");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20160120-ucsm");
  script_xref(name:"CISCO-BUG-ID", value:"CSCur90888");

  script_name(english:"Cisco Unified Computing System Manager CGI RCE (CSCur90888)");
  script_summary(english:"Checks the UCS version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a remote command execution
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Cisco Unified Computing System (UCS) Manager running on the remote
device is affected by a remote command execution vulnerability due to
unprotected calling of shell commands in the /ucsm/getkvmurl.cgi CGI
script. An unauthenticated, remote attacker can exploit this, via a
crafted HTTP request, to execute arbitrary commands.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-ucsm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b19d728f");
  script_set_attribute(attribute:"solution", value:
"Refer to Cisco bug ID CSCur90888 for any available patches, or contact
the vendor for a fix or workaround.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-6435");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/01/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/01/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_computing_system");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ucs_manager_version.nasl");
  script_require_keys("installed_sw/cisco_ucs_manager");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("install_func.inc");

app = "Cisco UCS Manager";
get_install_count(app_name:'cisco_ucs_manager', exit_if_zero:TRUE);

port = get_http_port(default:80);
install = get_single_install(app_name:'cisco_ucs_manager', port:port, exit_if_unknown_ver:TRUE);

url = build_url(qs:install['path'], port:port);
version = install['version'];

# Oddball version 2.2(2c)A has extra conditions
match = eregmatch(pattern:"^([0-9.]+)(\(([^)]+)\)|$)([A-Z])?", string:version);
if (isnull(match)) audit(AUDIT_VER_NOT_GRANULAR, app, port, version);

major = match[1];
build = "";
if (!empty_or_null(match[3]))
 build = match[3];

# Oddball version 2.2(2c)A has extra conditions
rev = "";
if (!empty_or_null(match[4]))
  rev = match[4];

vuln = FALSE;
if (
  (major == '3.1' && build =~ '1[abcd]T?') ||
  (major == '3.0' && build =~ '(1[a-z]|2[abcd])') ||
  (major == '2.2' && build =~ '(1[a-z]|2[a-z]|3[a-z]|4a)') ||
  (major == '2.2' && build == "" && rev == "") ||
  (major == '2.2' && build == "2c" && rev == "A")
)
{

  if (report_verbosity > 0)
  {
    report =
      '\n  URL               : ' + url +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : See vendor.' +
      '\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(0);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, 'Cisco UCS Manager', url, version);

References