Unpacking CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation

Unpacking CVE-2023-20198: Cisco IOS XE Web UI Privilege Escalation

Unpacking CVE-2023-20198 reveals a critical privilege escalation vulnerability impacting Cisco IOS XE Software. This flaw resides within the web user interface (Web UI) and allows unauthenticated attackers to gain full administrative control over affected devices. This security issue carries a CVSS score of 10.0, indicating its maximum severity. The vulnerability affects all Cisco IOS XE Software versions where the Web UI feature, enabled via `ip http server` or `ip http secure-server` commands, is exposed to the internet or untrusted networks.

Technical Root Cause Analysis

The core of CVE-2023-20198 is an authentication bypass within the Cisco IOS XE Web UI. This Web UI leverages an embedded HTTP/HTTPS server and exposes SOAP endpoints, such as `urn:cisco:wsma-exec`, which process CLI commands wrapped in XML. The vulnerability stems from a flaw in the Web UI's request-validation logic. This flaw permits a remote, unauthenticated attacker to bypass authentication entirely by presenting a syntactically valid session token, even without legitimate credentials. This initial authentication bypass grants the attacker privilege level 15 access. Privilege level 15 signifies the highest administrative privileges on a Cisco IOS XE device. With this elevated access, the attacker can then create a new local user account. This newly established account serves as a persistent entry point. Following this, attackers exploit a second vulnerability, CVE-2023-20273, which is a command injection flaw. CVE-2023-20273 exists due to insufficient input validation in another component of the Web UI feature. This secondary exploitation allows the attacker to inject arbitrary commands with root privileges and deploy a Lua-based implant to the device's file system. CVE-2023-20273 holds a CVSS score of 7.2.

Exploitation Mechanics

Exploiting this vulnerability chain begins with identifying an internet-facing Cisco IOS XE device running the Web UI. Attackers send crafted SOAP XML requests to the exposed Web UI. These requests exploit the authentication bypass in CVE-2023-20198. A successful request grants the attacker privilege level 15 access. The attacker then issues a command to create a new local user account with full administrative privileges. For example, a command similar to `username privilege 15 secret ` is executed. This establishes a persistent backdoor. Next, the attacker logs in using the newly created credentials and exploits CVE-2023-20273. This involves sending further crafted input to the Web UI, bypassing input validation to achieve command injection. The injected commands write a Lua-based implant to the file system, often found in locations like `/usr/binos/conf/nginx-conf/cisco_service.conf`. This implant, also known as "BadCandy", is a web shell that enables arbitrary command execution with root privileges. A device reload is necessary for the implant to become active, but the created user accounts remain active even after reboots. This detailed process demonstrates the technical steps without providing weaponized code.

Detection: How to Check If You're Affected

Detecting the Cisco IOS XE Web UI vulnerability requires vigilance and specific checks. Look for unexpected local user accounts with privilege level 15. Examples include `cisco_tac_admin` or `cisco_support`, which were observed in real-world exploitation. Review device configuration for any unknown or unauthorized user entries. Examine the file system for suspicious files. The presence of implant files, such as `_webui_wsma_http.conf`, `_webui_wsma_action_wsma.lua`, or `cisco_service.conf` containing hexadecimal strings, indicates compromise. Administrators should investigate unusual HTTP requests to the Web UI, particularly `POST` requests to `/webui/logout.html` or other anomalous `POST /webui/` traffic. Unexplained configuration changes or device reloads also serve as strong indicators.

show users
show running-config | include username
show file systems
more /usr/binos/conf/nginx-conf/cisco_service.conf

Cisco provided specific Snort rules to aid in detection. Rule ID 3:50118 alerts for initial implant injection (CVE-2023-20273), while 3:62527, 3:62528, and 3:62529 detect implant interaction. Rules 3:62541 and 3:62542 detect attempted exploitation for initial access (CVE-2023-20198). Network traffic analysis for these patterns is critical. Secably offers tools to assist with detection. Utilize Secably's free website vulnerability scanner to identify exposed Web UIs and potential misconfigurations. Our free port scanner can pinpoint open ports 80 and 443, indicating Web UI exposure. For continuous monitoring and attack surface management, Secably provides paid plans starting at $19/month. These plans help detect new exposures and suspicious activities proactively.

Remediation Steps

Immediate action is necessary to mitigate risks associated with Unpacking CVE-2023-20198. First, disable the HTTP Server feature on all internet-facing Cisco IOS XE devices if the Web UI is not essential for operations. Use the global configuration commands `no ip http server` and `no ip http secure-server`. This removes the direct attack vector. Apply Cisco's official software updates for both CVE-2023-20198 and CVE-2023-20273 without delay. Cisco began rolling out these fixes on October 22, 2023. Post-compromise, remove any unauthorized user accounts immediately. Reload the affected device to eliminate the non-persistent Lua implant. Restore the device from a known-good configuration backup to ensure complete removal of malicious changes. Implement strict access control lists (ACLs) to restrict Web UI access to trusted management networks only. Change all administrative passwords across affected and related systems. Finally, establish and regularly review system logs for any further suspicious activity.

Timeline of Disclosure

The discovery and disclosure of these Cisco IOS XE vulnerabilities unfolded rapidly. Suspicious activity, specifically the creation of a user named `cisco_tac_admin`, was first observed on September 18, 2023. A new cluster of activity, involving the creation of a `cisco_support` user and implant deployment, began on October 12, 2023. Cisco Talos discovered this suspicious activity on October 13, 2023. Cisco published a security advisory for CVE-2023-20198 on October 16, 2023, detailing active exploitation of the critical vulnerability. On October 20, 2023, Cisco identified and disclosed a second vulnerability, CVE-2023-20273, which was used for implant deployment. Software fixes for both CVE-2023-20198 and CVE-2023-20273 started rolling out on October 22, 2023. Cisco continues to provide ongoing updates and enhanced detection methods. This rapid response highlights the severity and active exploitation observed in the wild.