Skip to content

Commit 813c4dd

Browse files
netpickermailsanjayhere
netpicker
and
mailsanjayhere
authored
cisco_xe 2022 cves (#163)
* arista 2021 cves * Fix flake8 and syntax errors in Arista CVE scripts * cisco_ios 2022 cves * cisco_xe 2022 cves * cisco_xe 2022 cves --------- Co-authored-by: mailsanjayhere <mailsanjayhere@gmail.com>
1 parent 6a39755 commit 813c4dd

22 files changed

+916
-0
lines changed

‎CVEasy/Cisco/2022/cisco_xe/__init__.py‎

Whitespace-only changes.

‎CVEasy/Cisco/2022/cisco_xe/cve202220676.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220676',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_tcl='show running-config | include tclsh'
10+
),
11+
)
12+
def rule_cve202220676(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20676 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to insufficient input validation of data that is passed into the Tcl interpreter.
16+
An authenticated, local attacker with privilege level 15 could exploit this vulnerability by loading
17+
malicious Tcl code on an affected device, allowing them to escalate to root-level privileges.
18+
"""
19+
# Extract the output of the command to check Tcl configuration
20+
tcl_output = commands.check_tcl
21+
22+
# Check if Tcl shell access is enabled
23+
tcl_enabled = 'tclsh' in tcl_output
24+
25+
# Assert that the device is not vulnerable
26+
assert not tcl_enabled, (
27+
f"Device {device.name} is vulnerable to CVE-2022-20676. "
28+
"The device has Tcl shell access enabled, "
29+
"which could allow an authenticated attacker with privilege level 15 to escalate to root privileges. "
30+
"For more information, see"
31+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-grbtubU"
32+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220678.py‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220678',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_appnav='show running-config | include appnav-controller|service-insertion'
10+
),
11+
)
12+
def rule_cve202220678(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20678 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to incorrect handling of certain TCP segments in the AppNav-XE feature.
16+
An unauthenticated, remote attacker could exploit this vulnerability by sending a stream of crafted
17+
TCP traffic at a high rate through an interface with AppNav interception enabled, causing the device
18+
to reload and resulting in a denial of service (DoS) condition.
19+
"""
20+
# Extract the output of the command to check AppNav configuration
21+
appnav_output = commands.check_appnav
22+
23+
# Check if AppNav-XE is configured
24+
appnav_configured = any(feature in appnav_output for feature in [
25+
'appnav-controller', 'service-insertion'
26+
])
27+
28+
# Assert that the device is not vulnerable
29+
assert not appnav_configured, (
30+
f"Device {device.name} is vulnerable to CVE-2022-20678. "
31+
"The device has AppNav-XE configured, "
32+
"which could allow an unauthenticated attacker to cause a denial of service through crafted TCP traffic. "
33+
"For more information, see"
34+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appnav-xe-dos-j5MXTR4"
35+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220679.py‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
import re # Add regex module
2+
from comfy import high
3+
4+
5+
@high(
6+
name='rule_cve202220679',
7+
platform=['cisco_xe'],
8+
commands=dict(
9+
show_version='show version',
10+
check_ipsec='show running-config | include crypto ipsec',
11+
check_mtu='show interfaces | include MTU'
12+
),
13+
)
14+
def rule_cve202220679(configuration, commands, device, devices):
15+
# Convert command outputs to strings to handle None values
16+
ipsec_output = str(commands.check_ipsec or "")
17+
mtu_output = str(commands.check_mtu or "")
18+
19+
# Check if IPsec is configured
20+
ipsec_configured = 'crypto ipsec' in ipsec_output
21+
22+
# Check if any interface has MTU >= 1800 using regex
23+
high_mtu = False
24+
for line in mtu_output.splitlines():
25+
if 'MTU' in line:
26+
# Use regex to find the first sequence of digits after "MTU"
27+
match = re.search(r'MTU.*?(\d+)', line)
28+
if match:
29+
try:
30+
mtu = int(match.group(1))
31+
if mtu >= 1800:
32+
high_mtu = True
33+
break
34+
except ValueError:
35+
continue
36+
37+
# Device is vulnerable if both conditions are met
38+
is_vulnerable = ipsec_configured and high_mtu
39+
40+
# Assert that the device is not vulnerable
41+
assert not is_vulnerable, (
42+
f"Device {device.name} is vulnerable to CVE-2022-20679. "
43+
"The device has IPsec configured and interfaces with MTU >= 1800 bytes, "
44+
"which could allow an attacker to cause a denial of service. "
45+
"For more information, see"
46+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qfp-ipsec-GQmqvtqV"
47+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220681.py‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220681',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_platform='show inventory | include Chassis'
10+
),
11+
)
12+
def rule_cve202220681(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20681 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to insufficient validation of user privileges after executing certain CLI commands
16+
on Cisco Catalyst 9000 Family Switches and Wireless Controllers. An authenticated, local attacker with low
17+
privileges could exploit this vulnerability by executing certain CLI commands to elevate their privileges
18+
to level 15.
19+
"""
20+
# Extract the version information from the command output
21+
version_output = commands.show_version
22+
23+
_ = version_output # intentionally unused
24+
25+
# Extract the platform information
26+
platform_output = commands.check_platform
27+
28+
# Check if the device is a Catalyst 9000 Series
29+
is_cat9k = 'C9' in platform_output
30+
31+
# If not a Catalyst 9000 device, it's not vulnerable
32+
if not is_cat9k:
33+
return
34+
35+
# Assert that the device is not vulnerable
36+
assert not is_cat9k, (
37+
f"Device {device.name} is vulnerable to CVE-2022-20681. "
38+
"The device is a Catalyst 9000 Series switch/wireless controller, "
39+
"which could allow an authenticated attacker to elevate privileges to level 15 through certain CLI commands. "
40+
"For more information, see"
41+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-priv-esc-ybvHKO5"
42+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220682.py‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220682',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_platform='show inventory | include Chassis',
10+
check_wireless='show running-config | include wireless|capwap'
11+
),
12+
)
13+
def rule_cve202220682(configuration, commands, device, devices):
14+
"""
15+
This rule checks for the CVE-2022-20682 vulnerability in Cisco IOS XE Software.
16+
The vulnerability is due to inadequate input validation of incoming CAPWAP packets encapsulating
17+
multicast DNS (mDNS) queries in the Catalyst 9000 Family Wireless Controllers. An attacker could
18+
exploit this vulnerability by connecting to a wireless network and sending a crafted mDNS query,
19+
which would flow through and be processed by the wireless controller.
20+
"""
21+
# Extract the platform information
22+
platform_output = commands.check_platform
23+
24+
# Check if the device is a Catalyst 9000 Series
25+
is_cat9k = 'C9' in platform_output
26+
27+
# If not a Catalyst 9000 device, it's not vulnerable
28+
if not is_cat9k:
29+
return
30+
31+
# Extract the output of the command to check wireless/CAPWAP configuration
32+
wireless_output = commands.check_wireless
33+
34+
# Check if wireless controller and CAPWAP are configured
35+
wireless_configured = any(feature in wireless_output for feature in ['wireless', 'capwap'])
36+
37+
# Device is vulnerable if it's a Cat9K and has wireless/CAPWAP configured
38+
is_vulnerable = is_cat9k and wireless_configured
39+
40+
# Assert that the device is not vulnerable
41+
assert not is_vulnerable, (
42+
f"Device {device.name} is vulnerable to CVE-2022-20682. "
43+
"The device is a Catalyst 9000 Series wireless controller with CAPWAP configured, "
44+
"which could allow an unauthenticated attacker to cause a denial of service through crafted mDNS queries. "
45+
"For more information, see"
46+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-capwap-mdns-6PSn7gKU"
47+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220683.py‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220683',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_platform='show inventory | include Chassis',
10+
check_fnf='show running-config | include flow|performance monitor'
11+
),
12+
)
13+
def rule_cve202220683(configuration, commands, device, devices):
14+
"""
15+
This rule checks for the CVE-2022-20683 vulnerability in Cisco IOS XE Software.
16+
The vulnerability is due to insufficient packet verification for traffic inspected by the AVC feature
17+
in Cisco Catalyst 9800 Series Wireless Controllers. An unauthenticated, remote attacker could exploit
18+
this vulnerability by sending crafted packets from the wired network to a wireless client, causing
19+
the wireless controller to reload and resulting in a denial of service (DoS) condition.
20+
"""
21+
# Extract the platform information
22+
platform_output = commands.check_platform
23+
24+
# Check if the device is a Catalyst 9800 Series
25+
is_cat9800 = 'C9800' in platform_output
26+
27+
# If not a Catalyst 9800 device, it's not vulnerable
28+
if not is_cat9800:
29+
return
30+
31+
# Extract the output of the command to check AVC/FNF configuration
32+
fnf_output = commands.check_fnf
33+
34+
# Check if AVC/FNF is configured
35+
fnf_configured = any(feature in fnf_output for feature in ['flow', 'performance monitor'])
36+
37+
# Device is vulnerable if it's a Cat9800 and has AVC/FNF configured
38+
is_vulnerable = is_cat9800 and fnf_configured
39+
40+
# Assert that the device is not vulnerable
41+
assert not is_vulnerable, (
42+
f"Device {device.name} is vulnerable to CVE-2022-20683. "
43+
"The device is a Catalyst 9800 Series wireless controller with AVC/FNF configured, "
44+
"which could allow an unauthenticated attacker to cause a denial of service through crafted packets. "
45+
"For more information, see"
46+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge"
47+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220684.py‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220684',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_platform='show inventory | include Chassis',
10+
check_wireless='show running-config | include wireless|snmp-server'
11+
),
12+
)
13+
def rule_cve202220684(configuration, commands, device, devices):
14+
"""
15+
This rule checks for the CVE-2022-20684 vulnerability in Cisco IOS XE Software.
16+
The vulnerability is due to a lack of input validation of the information used to generate an SNMP trap
17+
related to a wireless client connection event in Catalyst 9000 Family Wireless Controllers. An attacker
18+
could exploit this vulnerability by sending an 802.1x packet with crafted parameters during the wireless
19+
authentication setup phase of a connection.
20+
"""
21+
# Extract the platform information
22+
platform_output = commands.check_platform
23+
24+
# Check if the device is a Catalyst 9000 Series
25+
is_cat9k = 'C9' in platform_output
26+
27+
# If not a Catalyst 9000 device, it's not vulnerable
28+
if not is_cat9k:
29+
return
30+
31+
# Extract the output of the command to check wireless and SNMP configuration
32+
wireless_output = commands.check_wireless
33+
34+
# Check if wireless controller and SNMP traps are configured
35+
wireless_configured = 'wireless' in wireless_output
36+
snmp_configured = 'snmp-server' in wireless_output
37+
38+
# Device is vulnerable if it's a Cat9K and has both wireless and SNMP configured
39+
is_vulnerable = is_cat9k and wireless_configured and snmp_configured
40+
41+
# Assert that the device is not vulnerable
42+
assert not is_vulnerable, (
43+
f"Device {device.name} is vulnerable to CVE-2022-20684. "
44+
"The device is a Catalyst 9000 Series wireless controller with SNMP traps configured, "
45+
"which could allow an unauthenticated attacker to cause a denial of service through crafted 802.1x packets. "
46+
"For more information, see"
47+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-snmp-trap-dos-mjent3Ey"
48+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220692.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220692',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_netconf='show running-config | include netconf-yang|ssh'
10+
),
11+
)
12+
def rule_cve202220692(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20692 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to insufficient resource management in the NETCONF over SSH feature.
16+
A low-privileged, authenticated, remote attacker could exploit this vulnerability by initiating
17+
a large number of NETCONF over SSH connections, causing the device to reload and resulting in
18+
a denial of service (DoS) condition.
19+
"""
20+
# Extract the output of the command to check NETCONF configuration
21+
netconf_output = commands.check_netconf
22+
23+
# Check if NETCONF over SSH is enabled
24+
netconf_enabled = 'netconf-yang' in netconf_output and 'ssh' in netconf_output
25+
26+
# Assert that the device is not vulnerable
27+
assert not netconf_enabled, (
28+
f"Device {device.name} is vulnerable to CVE-2022-20692. "
29+
"The device has NETCONF over SSH enabled, "
30+
"which could allow an authenticated attacker to cause a denial of service through multiple connections. "
31+
"For more information, see"
32+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncossh-dos-ZAkfOdq8"
33+
)

‎CVEasy/Cisco/2022/cisco_xe/cve202220693.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220693',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_webui='show running-config | include ip http|restconf'
10+
),
11+
)
12+
def rule_cve202220693(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20693 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to insufficient input validation in the web UI feature.
16+
An authenticated, remote attacker could exploit this vulnerability by sending crafted input
17+
to the web UI API, allowing them to inject commands to the underlying operating system with
18+
root privileges.
19+
"""
20+
# Extract the output of the command to check web UI configuration
21+
webui_output = commands.check_webui
22+
23+
# Check if web UI or RESTCONF is enabled
24+
webui_enabled = any(feature in webui_output for feature in [
25+
'ip http server',
26+
'ip http secure-server',
27+
'restconf'
28+
])
29+
30+
# Assert that the device is not vulnerable
31+
assert not webui_enabled, (
32+
f"Device {device.name} is vulnerable to CVE-2022-20693. "
33+
"The device has web UI or RESTCONF enabled, "
34+
"which could allow an authenticated attacker to inject commands with root privileges through "
35+
"crafted API input. "
36+
"For more information, see"
37+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webuiapi-inj-Nyrq92Od"
38+
)

0 commit comments

Comments
 (0)