Skip to content

Commit 590c3bf

Browse files
netpickermailsanjayhere
netpicker
and
mailsanjayhere
authored
cisco_xr 2022 cves (#164)
* arista 2021 cves * Fix flake8 and syntax errors in Arista CVE scripts * cisco_ios 2022 cves * cisco_xe 2022 cves * cisco_xe 2022 cves * cisco_xr 2022 cves * cisco_xr 2022 cves --------- Co-authored-by: mailsanjayhere <mailsanjayhere@gmail.com>
1 parent 813c4dd commit 590c3bf

File tree

8 files changed

+336
-0
lines changed

8 files changed

+336
-0
lines changed

‎CVEasy/Cisco/2022/cisco_xr/__init__.py‎

Whitespace-only changes.

‎CVEasy/Cisco/2022/cisco_xr/cve202220655.py‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220655',
6+
platform=['cisco_xr'],
7+
commands=dict(
8+
show_version='show version',
9+
check_confd='show processes confd'
10+
),
11+
)
12+
def rule_cve202220655(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20655 vulnerability in Cisco IOS XR Software.
15+
The vulnerability is due to insufficient validation of a process argument in the ConfD CLI.
16+
An authenticated, local attacker could exploit this vulnerability by injecting commands during
17+
the execution of this process, allowing them to execute arbitrary commands on the underlying
18+
operating system with root privileges.
19+
"""
20+
# List of vulnerable versions
21+
vulnerable_versions = [
22+
'7.0.1', '7.0.2', '7.0.3', '7.1.0', # IOS XR versions
23+
'2.6.5', # Virtual Topology System versions
24+
'4.3.9.1', '4.4.5.6', '4.5.7', '4.6.1.7', '4.7.1', '5.1.0.1', # Network Services Orchestrator versions
25+
'3.12.1', # Enterprise NFV Infrastructure Software versions
26+
'18.4.4', '19.2.1', # Catalyst SD-WAN Manager versions
27+
'16.10.2', '16.12.1b', '17.2.1r', # IOS XE Catalyst SD-WAN versions
28+
'18.4.4', '19.2.1' # SD-WAN vEdge Router versions
29+
]
30+
31+
# Extract the version information
32+
version_output = commands.show_version
33+
34+
# Check if version is vulnerable
35+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
36+
37+
# If version is not vulnerable, no need to check further
38+
if not version_vulnerable:
39+
return
40+
41+
# Extract the output of the command to check ConfD process
42+
confd_output = commands.check_confd
43+
44+
# Check if ConfD is running
45+
confd_running = 'confd' in confd_output
46+
47+
# Assert that the device is not vulnerable
48+
assert not confd_running, (
49+
f"Device {device.name} is vulnerable to CVE-2022-20655. "
50+
"The device is running a vulnerable version with ConfD enabled, "
51+
"which could allow an authenticated attacker to execute arbitrary commands with root privileges. "
52+
"For more information, see"
53+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB"
54+
)

‎CVEasy/Cisco/2022/cisco_xr/cve202220714.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220714',
6+
platform=['cisco_xr'],
7+
commands=dict(
8+
show_version='show version',
9+
check_linecard='show inventory | include Lightspeed-Plus'
10+
),
11+
)
12+
def rule_cve202220714(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20714 vulnerability in Cisco IOS XR Software.
15+
The vulnerability is due to incorrect handling of malformed packets in the data plane microcode
16+
of Lightspeed-Plus line cards for ASR 9000 Series routers. An unauthenticated, remote attacker
17+
could exploit this vulnerability by sending crafted IPv4 or IPv6 packets through an affected device,
18+
causing the line card to reset and resulting in a denial of service condition.
19+
"""
20+
# Extract the output of the command to check for Lightspeed-Plus line cards
21+
linecard_output = commands.check_linecard
22+
23+
# Check if Lightspeed-Plus line cards are present
24+
lightspeed_plus_present = 'Lightspeed-Plus' in linecard_output
25+
26+
# Assert that the device is not vulnerable
27+
assert not lightspeed_plus_present, (
28+
f"Device {device.name} is vulnerable to CVE-2022-20714. "
29+
"The device has Lightspeed-Plus line cards installed, "
30+
"which could allow an unauthenticated attacker to cause a denial of service through crafted IPv4/IPv6 packets. "
31+
"For more information, see"
32+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lsplus-Z6AQEOjk"
33+
)

‎CVEasy/Cisco/2022/cisco_xr/cve202220758.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220758',
6+
platform=['cisco_xr'],
7+
commands=dict(
8+
show_version='show version',
9+
check_bgp='show running-config | include router bgp|address-family l2vpn evpn'
10+
),
11+
)
12+
def rule_cve202220758(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20758 vulnerability in Cisco IOS XR Software.
15+
The vulnerability is due to incorrect processing of BGP update messages containing specific EVPN attributes.
16+
An unauthenticated, remote attacker could exploit this vulnerability by sending crafted BGP update messages
17+
through an established trusted peer connection, causing the BGP process to restart and resulting in a
18+
denial of service (DoS) condition.
19+
"""
20+
# Extract the output of the command to check BGP EVPN configuration
21+
bgp_output = commands.check_bgp
22+
23+
# Check if BGP is configured with L2VPN EVPN address family
24+
bgp_configured = 'router bgp' in bgp_output
25+
evpn_configured = 'address-family l2vpn evpn' in bgp_output
26+
27+
# Device is vulnerable if both BGP and L2VPN EVPN are configured
28+
is_vulnerable = bgp_configured and evpn_configured
29+
30+
# Assert that the device is not vulnerable
31+
assert not is_vulnerable, (
32+
f"Device {device.name} is vulnerable to CVE-2022-20758. "
33+
"The device has BGP configured with L2VPN EVPN address-family, "
34+
"which could allow an unauthenticated attacker to cause a denial of service through crafted "
35+
"BGP update messages. "
36+
"For more information, see"
37+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bgpevpn-zWTRtPBb"
38+
)

‎CVEasy/Cisco/2022/cisco_xr/cve202220821.py‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220821',
6+
platform=['cisco_xr'],
7+
commands=dict(
8+
show_version='show version',
9+
check_redis='show processes | include redis',
10+
check_port='show processes | include 6379'
11+
),
12+
)
13+
def rule_cve202220821(configuration, commands, device, devices):
14+
"""
15+
This rule checks for the CVE-2022-20821 vulnerability in Cisco IOS XR Software.
16+
The vulnerability is due to the health check RPM opening TCP port 6379 by default upon activation.
17+
An unauthenticated, remote attacker could exploit this vulnerability by connecting to the Redis
18+
instance on the open port, allowing them to write to the Redis in-memory database, write arbitrary
19+
files to the container filesystem, and retrieve information about the Redis database.
20+
"""
21+
# Extract the output of the commands
22+
redis_output = commands.check_redis
23+
port_output = commands.check_port
24+
25+
# Check if Redis is running and port 6379 is open
26+
redis_running = 'redis' in redis_output
27+
port_open = '6379' in port_output
28+
29+
# Device is vulnerable if Redis is running and port 6379 is open
30+
is_vulnerable = redis_running and port_open
31+
32+
# Assert that the device is not vulnerable
33+
assert not is_vulnerable, (
34+
f"Device {device.name} is vulnerable to CVE-2022-20821. "
35+
"The device has Redis running with port 6379 open, "
36+
"which could allow an unauthenticated attacker to access and modify the Redis database. "
37+
"For more information, see"
38+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK"
39+
)

‎CVEasy/Cisco/2022/cisco_xr/cve202220845.py‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220845',
6+
platform=['cisco_xr'],
7+
commands=dict(
8+
show_version='show version',
9+
check_platform='show inventory | include Chassis',
10+
check_tl1='show processes | include tl1'
11+
),
12+
)
13+
def rule_cve202220845(configuration, commands, device, devices):
14+
"""
15+
This rule checks for the CVE-2022-20845 vulnerability in Cisco IOS XR Software.
16+
The vulnerability is due to TL1 not freeing memory under some conditions in NCS 4000 Series devices.
17+
An authenticated, local attacker could exploit this vulnerability by connecting to the device and
18+
issuing TL1 commands, causing the TL1 process to consume large amounts of memory and potentially
19+
leading to a denial of service condition.
20+
"""
21+
# List of vulnerable versions
22+
vulnerable_versions = [
23+
'6.5.25', '6.5.26', '6.5.28', '6.5.29', '6.5.31', '6.5.32'
24+
]
25+
26+
# Extract the version information
27+
version_output = commands.show_version
28+
29+
# Check if version is vulnerable
30+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
31+
32+
# If version is not vulnerable, no need to check further
33+
if not version_vulnerable:
34+
return
35+
36+
# Extract the platform information
37+
platform_output = commands.check_platform
38+
39+
# Check if the device is an NCS 4000 Series
40+
is_ncs4k = 'NCS-4' in platform_output
41+
42+
# If not an NCS 4000 device, it's not vulnerable
43+
if not is_ncs4k:
44+
return
45+
46+
# Extract the output of the command to check TL1 process
47+
tl1_output = commands.check_tl1
48+
49+
# Check if TL1 process is running
50+
tl1_running = 'tl1' in tl1_output
51+
52+
# Assert that the device is not vulnerable
53+
assert not tl1_running, (
54+
f"Device {device.name} is vulnerable to CVE-2022-20845. "
55+
"The device is an NCS 4000 Series running a vulnerable version with TL1 process enabled, "
56+
"which could allow an authenticated attacker to cause a denial of service through memory exhaustion. "
57+
"For more information, see"
58+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6"
59+
)

‎CVEasy/Cisco/2022/cisco_xr/cve202220846.py‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220846',
6+
platform=['cisco_xr'],
7+
commands=dict(
8+
show_version='show version',
9+
check_cdp='show running-config | include cdp'
10+
),
11+
)
12+
def rule_cve202220846(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20846 vulnerability in Cisco IOS XR Software.
15+
The vulnerability is due to a heap buffer overflow in certain Cisco Discovery Protocol messages.
16+
An unauthenticated, adjacent attacker could exploit this vulnerability by sending malicious
17+
Cisco Discovery Protocol packets to an affected device, causing the CDP process to reload.
18+
"""
19+
# List of vulnerable versions
20+
vulnerable_versions = [
21+
'6.5.1', '6.5.2', '6.5.3', '6.5.15', '6.5.25', '6.5.26', '6.5.28', '6.5.29',
22+
'6.5.31', '6.5.32', '6.5.90', '6.5.92', '6.5.93',
23+
'6.6.1', '6.6.2', '6.6.3', '6.6.4', '6.6.11', '6.6.12', '6.6.25',
24+
'6.7.1', '6.7.2', '6.7.3', '6.7.4', '6.7.35',
25+
'6.8.1', '6.8.2', '6.9.1',
26+
'7.0.0', '7.0.1', '7.0.2', '7.0.11', '7.0.12', '7.0.14', '7.0.90',
27+
'7.1.1', '7.1.2', '7.1.3', '7.1.15', '7.1.25',
28+
'7.2.0', '7.2.1', '7.2.2', '7.2.12',
29+
'7.3.1', '7.3.2', '7.3.3', '7.3.4', '7.3.15', '7.3.16', '7.3.27',
30+
'7.4.1', '7.4.2', '7.4.15', '7.4.16',
31+
'7.5.1', '7.5.2', '7.5.12',
32+
'7.6.1', '7.6.15'
33+
]
34+
35+
# Extract the version information
36+
version_output = commands.show_version
37+
38+
# Check if version is vulnerable
39+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
40+
41+
# If version is not vulnerable, no need to check further
42+
if not version_vulnerable:
43+
return
44+
45+
# Extract the output of the command to check CDP configuration
46+
cdp_output = commands.check_cdp
47+
48+
# Check if CDP is enabled (CDP is enabled by default unless explicitly disabled)
49+
cdp_disabled = 'no cdp' in cdp_output
50+
51+
# Assert that the device is not vulnerable
52+
assert cdp_disabled, (
53+
f"Device {device.name} is vulnerable to CVE-2022-20846. "
54+
"The device is running a vulnerable version with CDP enabled, "
55+
"which could allow an adjacent attacker to cause a denial of service through malicious CDP packets. "
56+
"For more information, see"
57+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2"
58+
)

‎CVEasy/Cisco/2022/cisco_xr/cve202220849.py‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220849',
6+
platform=['cisco_xr'],
7+
commands=dict(
8+
show_version='show version',
9+
check_pppoe='show running-config | include bba-group pppoe|pppoe enable'
10+
),
11+
)
12+
def rule_cve202220849(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20849 vulnerability in Cisco IOS XR Software.
15+
The vulnerability is due to improper handling of error conditions within specific PPPoE packet
16+
sequences in the Broadband Network Gateway feature. An unauthenticated, adjacent attacker could
17+
exploit this vulnerability by sending a sequence of specific PPPoE packets from controlled CPE,
18+
causing the PPPoE process to continually restart and resulting in a denial of service condition.
19+
"""
20+
# List of vulnerable versions
21+
vulnerable_versions = [
22+
'6.5.1', '6.5.2', '6.5.3', '6.5.15', '6.6.1', '6.6.2', '6.6.3', '6.6.4', '6.6.25',
23+
'6.7.1', '6.7.2', '6.7.3', '6.7.35', '6.8.1', '6.8.2', '6.9.1',
24+
'7.0.1', '7.0.2', '7.0.90', '7.1.1', '7.1.2', '7.1.3', '7.1.15', '7.1.25',
25+
'7.2.1', '7.2.2', '7.3.1', '7.3.2', '7.3.3', '7.3.4', '7.4.1', '7.4.2',
26+
'7.5.1'
27+
]
28+
29+
# Extract the version information
30+
version_output = commands.show_version
31+
32+
# Check if version is vulnerable
33+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
34+
35+
# If version is not vulnerable, no need to check further
36+
if not version_vulnerable:
37+
return
38+
39+
# Extract the output of the command to check PPPoE configuration
40+
pppoe_output = commands.check_pppoe
41+
42+
# Check if PPPoE is configured
43+
pppoe_configured = any(feature in pppoe_output for feature in [
44+
'bba-group pppoe',
45+
'pppoe enable'
46+
])
47+
48+
# Assert that the device is not vulnerable
49+
assert not pppoe_configured, (
50+
f"Device {device.name} is vulnerable to CVE-2022-20849. "
51+
"The device is running a vulnerable version with PPPoE enabled, "
52+
"which could allow an adjacent attacker to cause a denial of service through crafted PPPoE packets. "
53+
"For more information, see"
54+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt"
55+
)

0 commit comments

Comments
 (0)