CVE-2020-27128
published 2020-11-06CVE-2020-27128: A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an…
PriorityP359medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
60.78%
99.0th percentile
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | sd-wan | < 20.3.1 | 20.3.1 |
| cisco | sd-wan_vmanage | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/dataservice/statistics/download/dr/filelist
bytes
|2f 2e 2e 2f|
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Cisco Viptela vManage Directory Traversal (CVE-2020-27128)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/dataservice/statistics/download/dr/filelist"; fast_pattern; http.request_body; content:"|2f 2e 2e 2f|"; reference:cve,2020-27128; classtype:web-application-attack; sid:2035136; rev:2; metadata:created_at 2022_02_08, cve CVE_2020_27128, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_02_08, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
- →Look for HTTP POST requests to the specific vManage API endpoint '/dataservice/statistics/download/dr/filelist' — this is the targeted API path for the directory traversal exploit.
- →Detect directory traversal sequences in the HTTP request body: the byte pattern |2f 2e 2e 2f| represents '/../' (URL-encoded path traversal) in the POST body.
- →The exploit requires an authenticated session — monitor for authenticated API abuse (anomalous POST requests from authenticated users to dataservice endpoints) as a precondition. ↗
- →MITRE mapping: TA0007 (Discovery) / T1083 (File and Directory Discovery) — correlate with file write activity on the vManage host following API calls to this endpoint.
- ·The Snort/ET rule targets both perimeter and internal deployment zones, meaning the attacker may be operating from inside the network as well — ensure the rule is deployed on internal sensors, not just perimeter.
- ·No workarounds exist for this vulnerability; detection/blocking rules are the only mitigation until patching is applied. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vgpq-9fqj-mrjr: A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary fi
ghsa_unreviewed·2022-05-24
CVE-2020-27128 [MEDIUM] CWE-22 GHSA-vgpq-9fqj-mrjr: A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary fi
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system.
Cisco
Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
vendor_cisco·2020-11-04·CVSS 6.5
CVE-2020-27128 [MEDIUM] CWE-22 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system.
The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security
Cisco
Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-27128 Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
CVE-2020-27128: Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-22, CWE-22
Bug IDs: CSCvv21749
Suricata
ET EXPLOIT Cisco Viptela vManage Directory Traversal (CVE-2020-27128)
suricata·2022-02-08·CVSS 6.5
CVE-2020-27128 [MEDIUM] ET EXPLOIT Cisco Viptela vManage Directory Traversal (CVE-2020-27128)
ET EXPLOIT Cisco Viptela vManage Directory Traversal (CVE-2020-27128)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Cisco Viptela vManage Directory Traversal (CVE-2020-27128)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/dataservice/statistics/download/dr/filelist"; fast_pattern; http.request_body; content:"|2f 2e 2e 2f|"; reference:cve,2020-27128; classtype:web-application-attack; sid:2035136; rev:2; metadata:created_at 2022_02_08, cve CVE_2020_27128, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_02_08, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Disco
No public exploits indexed.
No writeups or analysis indexed.
2020-11-06
Published