cbcvebase.
CVE-2017-6622
published 2017-05-18

CVE-2017-6622: A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and…

PriorityP183critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
62.17%
99.1th percentile
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724.

Affected

11 ranges
VendorProductVersion rangeFixed in
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——
ciscoprime_collaboration_provisioning——

Detection & IOCsextracted from sources · hover to see the quote

url/cupm/ScriptMgr?command=compile&language=bsh&script=foo&scripttext=↗
path/cupm/ScriptMgr↗
commandRuntime.getRuntime().exec(new%20String[]{"$BASH","-c","$COMMAND"});↗
  • →Detect unauthenticated HTTP HEAD requests to /cupm/ScriptMgr with query parameters 'command=compile' and 'language=bsh', which indicates exploitation of the auth-bypass + BeanShell injection vector. ↗
  • →Alert on HTTP requests to /cupm/ScriptMgr containing 'Runtime.getRuntime().exec' in the scripttext parameter, indicating remote code execution via BeanShell script injection. ↗
  • →Monitor for reverse shell patterns in web request parameters: URI-encoded strings containing 'mkfifo', '/bin/sh -i', and 'nc' are indicative of the exploit payload. ↗
  • →The vulnerability is exploitable via HTTP HEAD method to bypass authentication; monitor for HEAD requests to sensitive /cupm/ endpoints from unauthenticated sessions. ↗
  • ·Vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1 only; patched versions are not affected. ↗
  • ·No workarounds are available; the only remediation is upgrading to a fixed software release. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.