CVE-2023-20198 Software Web UI Privilege Escalation Vulnerability

[Thomas Obbekaer Thomsen]

This seems bad. - "I'm fuzzy on the whole good/bad thing. What do you mean, "bad"? "........

LWA, and basically also CWA, uses the webservice of the 9800.

Should we all just shut down our guest networks until a workaround / patch can be found ?

Currently that is what Im thinking.

Can anyone shed some light on my concern ?

[Rich R]

@RoadRunner4k no, that does not currently include "all" - specifically it does not mention the current extended support releases 17.9.x (17.9.4 is the current TAC recommended and gold star release) and 17.12.1.

And it mentions 17.6.5 but not 17.6.6 even though I'm sure 17.6.6 is not fixed.  So I would say that list is only the releases they have tested or customers have reported/observed it on so far - which has always been the case on most bugs.

The Check Bug Applicability feature on the bug does seem to work (although sometimes gives an error so you might need to try it more than once to get a result).  I tried it with 17.9.4 and it confirmed vulnerable.

The Known Affected Releases on the bug has now been updated with "all" - took them a while but they got there in the end.  Could have saved themselves hundreds of queries if they had just put that there from the start!

[usernick]

Cisco Talos has provided the following command to check for the presence of the implant where systemip is the IP address of the system to check. This command should be issued from a workstation with access to the system in question:

curl -k -X POST "https://systemip/webui/logoutconfirm.html?logon_hash=1"

If the request returns a hexadecimal string, the implant is present.

Note: If the system is configured for HTTP access only, use the HTTP scheme in the command example.

[JPavonM]

Weirdly enough, Cisco is discovering new impacted releases every day.
I checked the current code 17.9.3 I'm running for this vulnerability the last week an it was not impacted, now it is:

[Rich R]

Indeed!

What I find interesting about that is: FIRST FIXED OR NOT AFFECTED:

17.9.5 (Expected availability: Oct 2023),17.9.4a (Expected availability: Oct 2023)
So that's saying we should have patched version of 17.9.4 and 17.9.5 by end of month!

[JPavonM]

In your case it is also recommending 17.9.5 (the one I'm looking for as next step forward), but in my case only recommends 17.9.4a.

[Rich R]

Maybe because I ran it for 17.9.4

[marce1000]

 - Strange remark I feel , these threads with these Subject-types  have the habit of ending up in total chaos, let's put a break on that , 

 M.

[Thomas Obbekaer Thomsen]

I have been sick for a couple of days ( still is ), so I have not kept up to date with this thread. This is just a quick update , from what I have heard fixes for both CVEs mentioned should be made available Sunday ( fingers crossed ).

[Thomas Obbekaer Thomsen]

I see the PSIRT have been updated with fixed software release versions ... bascially the version is  "take your current recommended software and add an "a" to the end"

17.9.4a it says is available, but I cant find it on CCO. ?

The other releases are still TBD.

[Rich R]

I have this on good authority from EU Wireless TAC escalation team this morning - can't believe it's taken a week to get a clear answer.  Even our account team has been struggling to get a clear answer from anywhere in Cisco!

"Webauth does "not" use the same web server context as the management UI, so, any webauth/guest user, can't reach the management endpoint that was part of the vulnerability
The ACL, in fact, prevents the active exploit… so using access class for HTTP access, allows webauth to still work, and will prevent the attack, so this constitutes valid prevention mechanism for both wireless and switching guest access scenarios.
This has been validated, so before I posted my information, it was already confirmed in lab. There was no guessing here.
Wireless and switching product images should be posted soon (EoBD). Postings were done by product types"

When Cisco says EoBD they mean US West Coast time so that could be any time up to 07:00 UTC on Tuesday 24th Feb.

ps: 17.9.4a is already released for some platforms like ASR1K and ISR4K.

[marce1000]

 - Ref : https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-dublin-17121/221128-software-fix-availability-for-cisco-ios.html
              Courtesy and tx to Nicolas Darchis on X mentioning that the mentioned fixes will be posted throughout this week , 

 M.

[JPavonM]

I can confirm that disabling HTTP server in WLC breaks Guest wireless as it doesn't redirect when using CWA and Captive Portal.

[Rich R]

Yes but note https://community.cisco.com/t5/wireless/cve-2023-20198-software-web-ui-privilege-escalation/m-p/4944766/highlight/true#M261926

[Thomas Obbekaer Thomsen]

New software is now on CCO.

(and lets just ignore the release date).

But the wording on that warning is strange.

So i cannot install the "a" version if I have a APSP/SMU installed on 17.9.4 ? Or is it just not recommended because it takes longer to install a full version then a SMU ? - Please clarify it Cisco ... CLARIFY !!!!!

[Rich R]

> So i cannot install the "a" version if I have a APSP/SMU installed on 17.9.4 ?
Correct

That means if you upgrade to 17.9.4a you will lose the 17.9.4 SMU and APSP fixes.
There will be a new 17.9.4 SMU with the fix which you can use if you already have SMU and/or APSP installed.