While Cisco attributed credit to Agile Information Security for finding vulnerability #1, it did not do so with finding vulnerabilities #2 and #3, and also refused to provide a CVE for both these vulnerabilities. However, vulnerability #2 (Unsafe Flex AMF Java Object Deserialization) was also found and reported to Cisco by Olivier Arteau of Groupe Technologie Desjardins and vulnerability #3 (Privilege Escalation via Incorrect sudo File Permissions) was also found and reported to Cisco by Hector Cuesta. You can also see a video of the exploit in action on YouTube.Īll the vulnerabilities in this advisory were found independently by Agile Information Security. Therefore, this vulnerability chain is ideal to demonstrate the risks of Cross Site Scripting when paired with a phishing attack.Ī Ruby exploit that implements this full exploit chain (described in more detail in End to End Exploit, at the end of this file) is publicly available in the same repository as this advisory. We have analysed version 2.4.0.357 and found three vulnerabilities: an unauthenticated stored cross site scripting, a authenticated Java deserialization vulnerability leading to remote code execution as an unprivileged user, and a privilege escalation from that unprivileged user to root.īy putting them all together, we can achieve remote code execution as root, provided we can convince an administrator into visiting the ISE page vulnerable to the stored cross site scripting. ISE is distributed by Cisco as a virtual appliance. It also shares vital contextual data, such as user and device identities, threats, and vulnerabilities with integrated solutions from Cisco technology partners, so you can identify, contain, and remediate threats faster.' Summary

It helps you gain visibility into what is happening in your network, such as who is connected, which applications are installed and running, and much more.

With ISE, you can see users and devices controlling access across wired, wireless, and VPN connections to the corporate network.Ĭisco ISE allows you to provide highly secure network access to users and devices. The Cisco Identity Services Engine (ISE) is your one-stop solution to streamline security policy management and reduce operating costs.

#3: Privilege Escalation via Incorrect sudo and File Permissions.

#2: Unsafe Flex AMF Java Object Deserialization.

Multiple vulnerabilities in Cisco Identity Services Engine (XSS to RCE as root) By Pedro Ribeiro ( | from Agile Information Security and Dominik Czarnota ( Disclosure: / Last updated:

Cisco ise 2.4 admin guide