SecBoard
Zurück zur CVE-Übersicht

CVE-2022-20759

HIGH(8.8)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score31/100 — MITTEL
  • CVSS 8.8 — Hoch

EPSS-Score

29.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.8

Technische Schwere

Beschreibung

A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit this vulnerability by sending crafted HTTPS messages to the web services interface of an affected device. A successful exploit could allow the attacker to gain privilege level 15 access to the web management interface of the device. This includes privilege level 15 access to the device using management tools like the Cisco Adaptive Security Device Manager (ASDM) or the Cisco Security Manager (CSM). Note: With Cisco FTD Software, the impact is lower than the CVSS score suggests because the affected web management interface allows for read access only.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 9.8.4.43
  • 9.12.4.38
  • 9.14.4
  • 9.15.1.21
  • 9.16.2.14
  • 9.17.7

Threat-Hunting-Queries

Die Erkennung basiert auf dem spezifischen User-Agent 'ASDM/' und dem Cookie 'tg' in HTTP POST-Anfragen an die Web-Services-Schnittstelle von Cisco ASA/FTD-Geräten. Dies deutet auf Versuche hin, die ASDM-Authentifizierung zu umgehen.

Sentinel/Defender KQL

HttpRawEvent
| where Url contains "/+webvpn+/index.html"
| where HttpRequestMethod == "POST"
| where RequestHeaders contains "User-Agent: ASDM/"
| where RequestHeaders contains "Cookie: webvpnlogin=1; tg="
| project TimeGenerated, SourceIp, DestinationIp, Url, RequestHeaders, HttpRequestBody

Splunk SPL

sourcetype=cisco:asa (uri_path="/+webvpn+/index.html" OR uri="/+webvpn+/index.html") method="POST" http_user_agent="ASDM/*" http_cookie="*webvpnlogin=1; tg=*"

Sigma

title: Cisco ASA ASDM Privilege Escalation Attempt
author: SecBoard
date: 2023/10/27
logsource:
  product: webserver
  service: access_log
detection:
  selection:
    http_method: 'POST'
    uri|contains: '/+webvpn+/index.html'
    user_agent|startswith: 'ASDM/'
    cookie|contains: 'webvpnlogin=1; tg='
  condition: selection
level: high

Elastic ES|QL

FROM logs-*-* 
| WHERE http.request.method == 'POST' 
| WHERE url.path == '/+webvpn+/index.html' 
| WHERE http.request.user_agent.original LIKE 'ASDM/%' 
| WHERE http.request.headers.cookie LIKE '%webvpnlogin=1; tg=%'

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • vpn.example.com

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:*:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:secure_firewall_threat_defense:7.1.0:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*

Referenzen