ISE vulnerability CSCvd49829 (Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability )

[fechao]

Hi expert,

I got an query from our ISE end user on the below vulerability:  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170310-struts2

but there are some quesitons I need to confirm with you:

1. in the vulnerability, I can see it listed as "Exposure is not configuration dependent.", so even the customer didn't configure guest portal/MyDevice portal, it is still vulnerable, right?

2. customer said they didn't want to install the patch as a permanent fix, instead, they want to check if there is anything they can do on their Firewall to block the attack to ISE on this vulerability, for example, to block the HTTP request to our ISE, for example, port 443/8443, is that OK? if it is OK, which ports we need to block?

Thank you very much!

[jonatwoo]

It looks like it only affects the portals. This includes guest, byod, client provisioning, certificate provisioning, sponsor, etc, etc. Since those portals (configured *default* or not) operate on different ports (i.e.: guest generally runs default on 8443), you could just verify what ports are open on the box (CLI: "show ports"), and block the IP:port at the L3 SVI/firewall, etc. It's certainly an option.

Short of that, I'm not sure. The patch should be used to fix, and that's the recommended way. As the bug/release states, it is *NOT* configuration dependent. So even then, perhaps the Admin portal could be exploited as well?

[fechao · Accepted solution]

Hi Jonathan,

Thanks for your kind reply, I checked the show ports on local ISE, do you mean we need to block all these ports? Thank you very much!

ise21b/admin# show ports

Process : mongod (28135)

tcp: 0.0.0.0:27019

Process : redis-server (22454)

tcp: 127.0.0.1:6379

Process : nginx: (29981)

tcp: 0.0.0.0:9103

Process : Decap_main (25432)

tcp: 0.0.0.0:2000

udp: 0.0.0.0:9993

Process : jsvc.exec (25288)

tcp: 172.17.0.1:49, 10.70.82.54:49, 172.17.0.1:50, 10.70.82.54:50, 172.17.0

.1:51, 10.70.82.54:51, 172.17.0.1:52, 10.70.82.54:52, 127.0.0.1:8888, :::5514, :

::9002, :::1099, :::8910, :::61616, :::80, :::9080, 10.70.82.54:8443, :::443, 10

.70.82.54:8444, :::9085, :::9090, 127.0.0.1:2020, :::9060, :::9061, :::32775, ::

:8905, :::8009

udp: 172.17.0.1:1645, 10.70.82.54:1645, 127.0.0.1:1645, 172.17.0.1:1646, 10

.70.82.54:1646, 127.0.0.1:1646, 172.17.0.1:1700, 10.70.82.54:1700, 127.0.0.1:170

0, 172.17.0.1:1812, 10.70.82.54:1812, 127.0.0.1:1812, 172.17.0.1:1813, 10.70.82.

54:1813, 127.0.0.1:1813, 172.17.0.1:63455, 172.17.0.1:2083, 10.70.82.54:2083, 12

7.0.0.1:2083, 0.0.0.0:51694, 0.0.0.0:10917, 172.17.0.1:10967, 10.70.82.54:27793,

0.0.0.0:60641, 10.70.82.54:44379, 172.17.0.1:3799, 10.70.82.54:3799, 127.0.0.1:

3799, :::35036

Process : vault (28278)

tcp: 127.0.0.1:9105

Process : monit (28110)

tcp: 127.0.0.1:9106

Process : timestensubd (22366)

tcp: 127.0.0.1:32308

Process : timestend (22362)

tcp: 0.0.0.0:53396

Process : sshd (12954)

tcp: 0.0.0.0:22, :::22

Process : ttcserver (22371)

tcp: 127.0.0.1:34585, 0.0.0.0:53385

Process : master (770)

tcp: 127.0.0.1:25, ::1:25

Process : monit (28401)

tcp: 127.0.0.1:2812

Process : timestensubd (22367)

tcp: 127.0.0.1:12062

Process : timestensubd (22368)

tcp: 127.0.0.1:30206

Process : timestensubd (22369)

tcp: 127.0.0.1:12233

Process : java (29094)

tcp: :::9102

Process : java (28760)

tcp: :::9104

Process : java (26546)

tcp: ::1:9200, 127.0.0.1:9200, 10.70.82.54:9300

Process : tnslsnr (20789)

tcp: :::1521, :::1528

Process : java (25341)

tcp: :::6514, 127.0.0.1:7634, :::20514, :::19970, 127.0.0.1:20515

udp: 0.0.0.0:20514, :::62573

Process : ./WLCAgent (29463)

tcp: :::9107

Process : java (23077)

tcp: :::9086

Process : ora_d000_cpm1 (20924)

tcp: :::10692

udp: ::1:12144

Process : ntpd (13464)

udp: 172.17.0.1:123, 10.70.82.54:123, 127.0.0.1:123, 0.0.0.0:123, fe80::250

:56ff:fe98:123, ::1:123, :::123

Process : ora_lreg_cpm1 (20916)

udp: ::1:20630

Process : ora_s000_cpm1 (20926)

udp: ::1:41256

Cheers,

Chao Feng

ENGINEER.CUSTOMER SUPPORT

Phone: +86 10 8515 5705

Cisco Hot Line:

China 800-810-8886 400-810-8886, pin 1819.

Hong Kong 30775555

Tai Wan 0 080 1 611206

[jonatwoo]

Nope! Just the ones related to the portals. *Most* of them are in the 84** range. (Admin runs on 443) My default guest portal runs on 8443, and I have some others on 8444, and a client provisioning portal 8445. So those are the ranges I would check for all portals.

From your output I see under jvec.exec: 8443 and 8444

However, as I mentioned, the recommended fix is to install the patch on each node. Additionally, I don't work for the BU (Devs etc), so I can't concede that blocking access to these ports would make it less vulnerable (especially at Layer 2).

Also, of you deny access to those ports, the portals themselves (and the associated features/services) will be unavailable from external networks (Layer 3).

Cheers!

[fechao]

Hi Jonathan,

Thanks for your kind reply, I will need to consult BU for a confirmation as customer insist that they don’t prefer the patch and want to do it by policy on FW, I need to verify this action is valid for this vulnerability, thank you very much.

Cheers,

Chao Feng

ENGINEER.CUSTOMER SUPPORT

Phone: +86 10 8515 5705

Cisco Hot Line:

China 800-810-8886 400-810-8886, pin 1819.

Hong Kong 30775555

Tai Wan 0 080 1 611206