Listen to this Post
A vulnerability in the Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service (DoS) condition on an affected device. This vulnerability, tracked as CVE-2024-20508 with a CVSS base score of 5.8 (Medium), stems from insufficient validation of HTTP requests when they are processed by the Cisco UTD Snort IPS Engine.
An attacker could exploit this vulnerability by sending a crafted HTTP request through an affected device. A successful exploit could trigger a reload of the Snort process. The impact depends on the configured fail policy: if the action in case of Cisco UTD Snort IPS Engine failure is set to the default “fail-open”, successful exploitation could allow the attacker to bypass configured security policies. If the action is set to “fail-close”, successful exploitation could cause traffic that is configured to be inspected by the Cisco UTD Snort IPS Engine to be dropped.
At the time of publication, this vulnerability affected Cisco products running a vulnerable release of Cisco UTD Snort IPS Engine for Cisco IOS XE Software with the Web Filtering feature, the Multi-Tenancy feature, or both enabled. Affected product families include 1000 Series Integrated Services Routers (ISRs), 4000 Series ISRs, Catalyst 8000V Edge Software, Catalyst 8200 Series Edge Platforms, Catalyst 8300 Series Edge Platforms, Catalyst 8500L Series Edge Platforms, and Catalyst IR8300 Rugged Series Routers.
To determine if a device is affected, administrators can use the `show utd engine standard status` command. If there is no output, Cisco UTD Snort IPS Engine is not enabled. If the output shows “Yes” under Running, the engine is enabled. Additionally, the `show utd engine standard config | include Multi-tenancy` command can determine if Multi-Tenancy is enabled, and `show utd engine standard config | include Web-Filter` can determine if Web Filtering is enabled. The configured fail policy can be checked with show platform software utd global | include Fail Policy. Cisco has released software updates that address this vulnerability, and there are no workarounds available.
DailyCVE Form:
Platform: Cisco IOS XE
Version: 17.2.1r – 17.18.2
Vulnerability: HTTP Validation Bypass
Severity: Medium (5.8)
date: 2024-09-25
Prediction: 2024-10-15
What Undercode Say:
Check if UTD Snort IPS Engine is enabled show utd engine standard status Check if Multi-Tenancy is enabled show utd engine standard config | include Multi-tenancy Check if Web Filtering is enabled show utd engine standard config | include Web-Filter Check the configured fail policy show platform software utd global | include Fail Policy Check the current Snort process status show process | include snort Verify the software version show version
Exploit: (Educational Purposes!)
An attacker could exploit this vulnerability by sending a crafted HTTP request through an affected device. The crafted request would be designed to trigger insufficient validation in the HTTP request processing logic of the Cisco UTD Snort IPS Engine. This could cause the Snort process to reload. If the fail policy is set to “fail-open”, the attacker could bypass security policies. If set to “fail-close”, the attacker could cause traffic inspection to drop. The attack requires no authentication and can be performed remotely over the network.
Protection:
Cisco has released software updates that address this vulnerability. Administrators should upgrade to a fixed software release as indicated in the Cisco Security Advisory cisco-sa-utd-snort3-dos-bypas-b4OUEwxD. There are no workarounds that address this vulnerability. As a general best practice, administrators should ensure that the action in case of Cisco UTD Snort IPS Engine failure is configured appropriately for their security requirements. Regular consultation of Cisco Security Advisories is recommended to determine exposure and complete upgrade solutions.
Impact:
Successful exploitation of CVE-2024-20508 could lead to a security policy bypass or a denial of service condition. In a fail-open configuration, an attacker could bypass configured security policies, potentially allowing malicious traffic to pass through the device uninspected. In a fail-close configuration, the attacker could cause traffic that is configured to be inspected to be dropped, resulting in a denial of service for legitimate traffic. The vulnerability has a CVSS base score of 5.8 (Medium), with an attack vector over the network, low attack complexity, no privileges required, and no user interaction needed. The scope is changed, with low impact on integrity in a fail-open scenario.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
