Vulnerability Resolution

[macgyver0099_1]

Hello, I have a Cisco CBS350-48T-4X switch stack running software version Version: 3.2.1.1.  A vulnerability scan was recently run on our network and identified the below vulnerabilities.  Does anyone know how to remediate them?

* SSL Self-Signed Certificate

* SSL/TLS Recommended Cipher Suites - The remote host has open SSL/TLS ports which advertise discouraged cipher suites. It is recommended to only enable support for the following cipher suites:

TLSv1.3:

• 0x13,0x01 TLS13_AES_128_GCM_SHA256
• 0x13,0x02 TLS13_AES_256_GCM_SHA384
• 0x13,0x03 TLS13_CHACHA20_POLY1305_SHA256

TLSv1.2:

• 0xC0,0x2B ECDHE-ECDSA-AES128-GCM-SHA256
• 0xC0,0x2F ECDHE-RSA-AES128-GCM-SHA256
• 0xC0,0x2C ECDHE-ECDSA-AES256-GCM-SHA384
• 0xC0,0x30 ECDHE-RSA-AES256-GCM-SHA384
• 0xCC,0xA9 ECDHE-ECDSA-CHACHA20-POLY1305
• 0xCC,0xA8 ECDHE-RSA-CHACHA20-POLY1305

This is the recommended configuration for the vast majority of services, as it is highly secure and compatible with nearly every client released in the last five (or more) years.

* Missing Referer-Policy Header - "Referer header is a request header that indicates the site which the traffic originated from. If there is no adequate prevention in place, the  URL itself, and even sensitive information contained in the URL will be leaked to the cross-site.  The lack of Referrer-Policy header might affect privacy of the users and site's itself.  For this vulnerability, only the response and request of the first instance found on each asset is reported. All additional findings only contain the additional paths affected.  Purported solution: "Ensure that user input is URL-encoded before it is embedded in a URL."

* Unencrypted communications -The application allows users to connect to it over unencrypted connections.  An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the application and obtain any information the user supplies. Furthermore, an attacker able to modify traffic could use the application as a platform for attacks against its users and third-party websites. Unencrypted connections have been exploited by ISPs and governments to track users, and to inject adverts and malicious JavaScript. Due to these concerns, web browser vendors are planning to visually flag unencrypted connections as hazardous.

To exploit this vulnerability, an attacker must be suitably positioned to eavesdrop on the victim's network traffic. This scenario typically occurs when a client communicates with the server over an insecure connection such as public Wi-Fi, or a corporate or home network that is shared with a compromised computer. Common defenses such as switched networks are not sufficient to prevent this. An attacker situated in the user's ISP or the application's hosting infrastructure could also perform this attack. Note that an advanced adversary could potentially target any connection made over the Internet's core infrastructure.

Please note that using a mixture of encrypted and unencrypted communications is an ineffective defense against active attackers, because they can easily remove references to encrypted resources when these references are transmitted over an unencrypted connection.

Purported resolution: Applications should use transport-level encryption (SSL/TLS) to protect all communications passing between the client and the server. The Strict-Transport-Security HTTP header should be used to ensure that clients refuse to access the server over an insecure connection.

* Link manipulation (DOM-based) - DOM-based vulnerabilities arise when a client-side script reads data from a controllable part of the DOM (for example, the URL) and processes this data in an unsafe way.

DOM-based link manipulation  arises when a script writes controllable data to a navigation target within the current page, such as a clickable link or the submission URL of a form. An attacker may be able to use the vulnerability to construct a URL that, if visited by another application user, will modify the target of links within the response. An attacker may be able to leverage this to perform various attacks, including:

• Causing the user to redirect to an arbitrary external URL, to facilitate a phishing attack.
• Causing the user to submit sensitive form data to a server controlled by the attacker.
• Causing the user to perform an unintended action within the application, by changing the file or query string associated with a link.
• Bypassing browser anti-XSS defenses by injecting on-site links containing XSS exploits, since browser anti-XSS defenses typically do not operate on on-site links.

Burp Suite automatically identifies this issue using dynamic and static code analysis. Static analysis can lead to false positives that are not actually exploitable. If Burp Scanner has not provided any evidence resulting from dynamic analysis, you should review the relevant code and execution paths  to determine whether this vulnerability is indeed present, or whether mitigations are in place that would prevent exploitation.

* Vulnerable JavaScript dependency - The use of third-party JavaScript libraries can introduce a range of DOM-based vulnerabilities, including some that can be used to hijack user accounts like DOM-XSS.

Common JavaScript libraries typically enjoy the benefit of being heavily audited. This may mean that bugs are quickly identified and patched upstream, resulting in a steady stream of security updates that need to be applied. Although it may be tempting to ignore updates, using a library with missing security patches can make your website exceptionally easy to exploit. Therefore, it's important to ensure that any available security updates are applied promptly.

Some library vulnerabilities expose every application that imports the library, but others only affect applications that use certain library features. Accurately identifying which library vulnerabilities apply to your website can be difficult, so we recommend applying all available security updates regardless.

[AshSe]

Hej @macgyver0099_1 

To address the vulnerabilities identified in your Cisco CBS350-48T-4X switch stack, here are the steps you can take to remediate each issue. Note that some of these vulnerabilities may not be fully resolvable on the switch itself due to its limited web interface capabilities, but you can mitigate them to the extent possible.

---

1. SSL Self-Signed Certificate

• Issue: The switch is using a self-signed SSL certificate, which is not trusted by browsers or scanning tools.
• Remediation:
  • Generate a Certificate Signing Request (CSR) on the switch.
  • Obtain a certificate from a trusted Certificate Authority (CA).
  • Upload the signed certificate to the switch.
  • Configure the switch to use the new certificate for HTTPS management.
  • Refer to the Cisco CBS350 documentation for instructions on generating and installing SSL certificates.

---

2. SSL/TLS Recommended Cipher Suites

• Issue: The switch is advertising weak or discouraged cipher suites.
• Remediation:
  • Log in to the switch's web interface or CLI.
  • Navigate to the SSL/TLS settings.
  • Disable weak cipher suites and enable only the recommended ones:
    • TLSv1.3:
      • TLS13_AES_128_GCM_SHA256
      • TLS13_AES_256_GCM_SHA384
      • TLS13_CHACHA20_POLY1305_SHA256
    • TLSv1.2:
      • ECDHE-ECDSA-AES128-GCM-SHA256
      • ECDHE-RSA-AES128-GCM-SHA256
      • ECDHE-ECDSA-AES256-GCM-SHA384
      • ECDHE-RSA-AES256-GCM-SHA384
      • ECDHE-ECDSA-CHACHA20-POLY1305
      • ECDHE-RSA-CHACHA20-POLY1305
  • Save the configuration and restart the HTTPS service.
  • Note: If the switch does not support fine-grained control over cipher suites, you may need to update the firmware to a newer version (if available) or contact Cisco support for guidance.

---

3. Missing Referer-Policy Header

• Issue: The switch's web interface does not include a Referer-Policy HTTP header, which can lead to privacy concerns.
• Remediation:
  • Unfortunately, most network switches (including the CBS350 series) do not allow customization of HTTP headers in their web interface. This issue is likely a limitation of the switch's firmware.
  • Check for a firmware update from Cisco that might address this issue.
  • If no update is available, consider restricting access to the web interface to trusted IPs or using a management VLAN to reduce exposure.

---

4. Unencrypted Communications

• Issue: The switch allows unencrypted HTTP connections, which can expose sensitive information.
• Remediation:
  • Disable HTTP access to the switch and enable HTTPS-only access.
    • In the web interface or CLI, navigate to the management settings and disable HTTP.
    • Ensure HTTPS is enabled and properly configured with a valid SSL certificate (see point 1).
  • Use SSH instead of Telnet for CLI management to ensure encrypted communications.
  • Restrict management access to trusted IPs or a dedicated management VLAN.

---

5. Link Manipulation (DOM-based)

• Issue: The switch's web interface may be vulnerable to DOM-based link manipulation.
• Remediation:
  • This vulnerability is likely due to the design of the switch's web interface and cannot be directly mitigated by configuration changes.
  • Check for a firmware update from Cisco that addresses this issue.
  • Limit access to the web interface to trusted IPs or a management VLAN to reduce exposure.

---

6. Vulnerable JavaScript Dependency

• Issue: The switch's web interface uses outdated JavaScript libraries with known vulnerabilities.
• Remediation:
  • Check for a firmware update from Cisco that includes updated JavaScript libraries.
  • If no update is available, limit access to the web interface to trusted IPs or a management VLAN to reduce exposure.

---

General Recommendations:

1. Update Firmware:

   • Ensure the switch is running the latest firmware version. The current version (3.2.1.1) may not address all these vulnerabilities. Check Cisco's support website for updates.
   • Follow Cisco's instructions for updating the firmware.

2. Restrict Management Access:

   • Use access control lists (ACLs) or a dedicated management VLAN to restrict access to the switch's management interface.
   • Disable remote management over the WAN unless absolutely necessary.

3. Use Strong Passwords:

   • Ensure that strong, unique passwords are used for all administrative accounts.

4. Monitor Cisco Security Advisories:

   1. Regularly check Cisco's security advisories for updates or patches related to your switch model.

---

Notes:

1. Some of these vulnerabilities (e.g., missing Referer-Policy header, DOM-based link manipulation, and vulnerable JavaScript dependencies) are common in embedded web interfaces and may not be fully resolvable without a firmware update.
2. If these vulnerabilities are flagged as critical by your security team, consider isolating the switch's management interface from the rest of the network to minimize risk.