CVE-2019-1937
published 2019-08-21CVE-2019-1937: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director…
PriorityP185critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
75.86%
99.5th percentile
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_unified_computing_system_director | >= unspecified < 6.7.3.0 | 6.7.3.0 |
| cisco | integrated_management_controller_supervisor | 2.2.0.3 – 2.2.0.6 | — |
| cisco | integrated_management_controller_supervisor_cisco_ucs_director_and_cisco_ucs_dir | — | — |
| cisco | ucs_director | — | — |
| cisco | ucs_director | 6.6.0.0 – 6.6.1.0 | — |
| cisco | ucs_director | 6.7.0.0 – 6.7.1.0 | — |
| cisco | ucs_director_express_for_big_data | — | — |
| cisco | ucs_director_express_for_big_data | 3.7.0.0 – 3.7.1.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect the authentication bypass by looking for HTTP GET requests to /app/ui/ClientServlet?apiName=GetUserInfo that include both X-Starship-UserSession-Key and X-Starship-Request-Key headers simultaneously — this is the specific header combination that triggers the bypass. ↗
- →Alert on HTTP 200 responses to /app/ui/ClientServlet?apiName=GetUserInfo from sessions that were not previously authenticated (i.e., preceded by a 302 redirect to login.jsp), especially when the response body contains 'loginName':'admin'. ↗
- →The vulnerable code path is in com.cloupia.client.web.auth.AuthenticationFilter.doFilter(); monitor for unauthenticated sessions being promoted to admin via isStarshipRequest() logic when no USER_IN_SESSION attribute exists server-side. ↗
- →The exploit sequence involves: (1) GET to ClientServlet → 302 to login.jsp, (2) GET login.jsp to obtain JSESSIONID, (3) replay ClientServlet request with JSESSIONID + X-Starship-UserSession-Key + X-Starship-Request-Key headers. Correlate these three steps from the same source IP. ↗
- →The exploit sets loginName to 'admin' server-side without credentials; monitor web application logs for admin session creation events not preceded by a valid authentication event. ↗
- ·The X-Starship-UserSession-Key and X-Starship-Request-Key header values are set to random strings by the exploit; detection rules cannot match on specific header values and must instead trigger on the presence of both headers on the target endpoint. ↗
- ·In some cases the server authenticates the original JSESSIONID rather than issuing a new one; detection logic must account for both scenarios (new cookie issued vs. original cookie elevated). ↗
- ·The Metasploit module was only tested against Cisco UCS Director 6.6.0 and 6.7.0; behavior against IMC Supervisor and UCS Director Express for Big Data was not independently verified by the researcher. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
vendor_cisco·2019-08-21·CVSS 9.8
CVE-2019-1937 [CRITICAL] CWE-287 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication.
The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affe
Cisco
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1937 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
CVE-2019-1937: Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator acce
GHSA
GHSA-6j24-rh4h-rq7f: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Di
ghsa_unreviewed·2022-05-24
CVE-2019-1937 [CRITICAL] CWE-287 GHSA-6j24-rh4h-rq7f: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Di
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.
No detection rules found.
Exploit-DB
Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
exploitdb·2023-07-15·CVSS 9.8
CVE-2019-1937 [CRITICAL] Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
---
[+] Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
[+] Cisco IMC Supervisor - < 2.2.1.0
[+] Date: 08/21/2019
[+] Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo
[+] Vendor: https://www.cisco.com/c/en/us/products/servers-unified-computing/integrated-management-controller-imc-supervisor/index.html
[+] Vulnerability Discovery : Pedro Ribeiro
[+] Exploit Author: Fatih Sencer
[+] CVE: CVE-2019-1937
Usage:
./python3 CiscoIMC-Bypass.py -u host
[+] Target https://xxxxxx.com
[+] Target OK
[+] Exploit Succes
[+] Login name : admin
[+] Cookie : REACTED
"""
import argparse,requests,warnings,base64,json,random,string
from requests.packages.urllib3.exceptions import InsecureRequestWarning
warnings
Exploit-DB
Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
exploitdb·2019-08-21
Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities
---
>> Multiple critical vulnerabilities in Cisco UCS Director, Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data
>> Discovered by Pedro Ribeiro ([email protected]) from Agile Information Security
Disclosure: 21/08/2019 / Last updated: 22/08/2019
>> Executive summary:
Cisco UCS Director (UCS) is a cloud orchestration product that automates common private cloud infrastructure management functions. It is built using Java and a variety of other technologies and distributed as a Linux based virtual appliance. A demo of the UCS virtual appliance can be freely downloaded from Cisco's website [1].
Due to severa
Metasploit
Cisco UCS Director Unauthenticated Remote Code Execution
metasploit·CVSS 7.2
CVE-2019-1937 [HIGH] Cisco UCS Director Unauthenticated Remote Code Execution
Cisco UCS Director Unauthenticated Remote Code Execution
The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root. The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator. The second one, CVE-2019-1936, is a command injection in a password change form, that allows the attacker to inject commands that will execute as root. This module combines both vulnerabilities to achieve the unauthenticated command injection as root. It has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also mentions in their advisory that their IMC Supervisor and UCS Director Express are also affected by these vulnerabilities,
http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.htmlhttp://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/173531/Cisco-UCS-IMC-Supervisor-2.2.0.0-Authentication-Bypass.htmlhttp://seclists.org/fulldisclosure/2019/Aug/36https://seclists.org/bugtraq/2019/Aug/49https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbyhttp://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.htmlhttp://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/173531/Cisco-UCS-IMC-Supervisor-2.2.0.0-Authentication-Bypass.htmlhttp://seclists.org/fulldisclosure/2019/Aug/36https://seclists.org/bugtraq/2019/Aug/49https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authby
2019-08-21
Published