Skip to content

Commit 9414a94

Browse files
netpickermailsanjayhere
netpicker
and
mailsanjayhere
authored
arista 2021 cves (#161)
* arista 2021 cves * Fix flake8 and syntax errors in Arista CVE scripts --------- Co-authored-by: mailsanjayhere <mailsanjayhere@gmail.com>
1 parent f6b1a60 commit 9414a94

File tree

13 files changed

+849
-0
lines changed

13 files changed

+849
-0
lines changed

‎CVEasy/Arista/2021/__init__.py‎

Whitespace-only changes.

‎CVEasy/Arista/2021/cve202128496.py‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202128496',
6+
platform=['arista_eos'],
7+
commands=dict(
8+
show_version='show version',
9+
show_bfd='show running-config | section bfd',
10+
show_eapi='show management api http-commands'
11+
),
12+
)
13+
def rule_cve202128496(configuration, commands, device, devices):
14+
"""
15+
This rule checks for CVE-2021-28496 vulnerability in Arista EOS devices.
16+
The vulnerability allows BFD shared secret passwords to be leaked when displaying output
17+
over eAPI or other JSON outputs to authenticated users on the device.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 4.22.x versions (all releases)
25+
'4.22.0', '4.22.12',
26+
# 4.23.x versions (up to 4.23.9)
27+
'4.23.0', '4.23.9',
28+
# 4.24.x versions (up to 4.24.7)
29+
'4.24.0', '4.24.7',
30+
# 4.25.x versions (up to 4.25.4)
31+
'4.25.0', '4.25.4',
32+
# 4.26.x versions (up to 4.26.1)
33+
'4.26.0', '4.26.1'
34+
]
35+
36+
# Check if the current device's software version is in the list of vulnerable versions
37+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
38+
39+
# If version is not vulnerable, no need to check further
40+
if not version_vulnerable:
41+
return
42+
43+
# Check if BFD is configured with shared secret profiles
44+
bfd_config = commands.show_bfd
45+
has_bfd_secrets = 'profile' in bfd_config and 'key-id' in bfd_config
46+
47+
# Check if eAPI is enabled
48+
eapi_config = commands.show_eapi
49+
eapi_enabled = 'enabled' in eapi_config.lower()
50+
51+
# Device is vulnerable if using BFD shared secrets and eAPI is enabled
52+
is_vulnerable = has_bfd_secrets and eapi_enabled
53+
54+
# Assert that the device is not vulnerable
55+
assert not is_vulnerable, (
56+
f"Device {device.name} is vulnerable to CVE-2021-28496. "
57+
"The device is running a vulnerable version AND has BFD shared secret profiles configured "
58+
"with eAPI enabled, which could expose sensitive password information. "
59+
"Recommended fixes:\n"
60+
"1. Upgrade to one of the following fixed versions:\n"
61+
" * 4.23.10 or later for 4.23.x train\n"
62+
" * 4.24.8 or later for 4.24.x train\n"
63+
" * 4.25.5 or later for 4.25.x train\n"
64+
" * 4.26.2 or later for 4.26.x train\n"
65+
"2. Or apply the appropriate hotfix:\n"
66+
" * For 4.22.0 - 4.25.0: SecurityAdvisory0069Hotfix-4.22-4.25.0.swix\n"
67+
" * For 4.25.1 - 4.26.1: SecurityAdvisory0069Hotfix-4.25.1-4.26.1.swix\n"
68+
"3. As a workaround, restrict access to CLI show commands using role-based authorization\n"
69+
"For more information, see"
70+
"https://www.arista.com/en/support/advisories-notices/security-advisory/13243-security-advisory-0069"
71+
)

‎CVEasy/Arista/2021/cve202128500.py‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202128500',
6+
platform=['arista_eos'],
7+
commands=dict(
8+
show_version='show version',
9+
show_users='show running-config | section username',
10+
show_agents='show running-config | include openconfig|terminattr'
11+
),
12+
)
13+
def rule_cve202128500(configuration, commands, device, devices):
14+
"""
15+
This rule checks for CVE-2021-28500 vulnerability in Arista EOS devices.
16+
The vulnerability allows unrestricted access to the device for local users with nopassword
17+
configuration due to incorrect use of EOS's AAA APIs by OpenConfig and TerminAttr agents.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 4.20.x and earlier versions
25+
'4.20.0', '4.20.15',
26+
# 4.21.x versions
27+
'4.21.0', '4.21.14M',
28+
# 4.22.x versions
29+
'4.22.0', '4.22.11M',
30+
# 4.23.x versions
31+
'4.23.0', '4.23.8M',
32+
# 4.24.x versions
33+
'4.24.0', '4.24.6M',
34+
# 4.25.x versions
35+
'4.25.0', '4.25.4M',
36+
# 4.26.x versions
37+
'4.26.0', '4.26.1F'
38+
]
39+
40+
# Check if the current device's software version is in the list of vulnerable versions
41+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
42+
43+
# If version is not vulnerable, no need to check further
44+
if not version_vulnerable:
45+
return
46+
47+
# Check if any users are configured with nopassword
48+
users_config = commands.show_users
49+
has_nopassword_users = 'nopassword' in users_config
50+
51+
# Check if OpenConfig or TerminAttr agents are enabled
52+
agents_config = commands.show_agents
53+
agents_enabled = 'openconfig' in agents_config or 'terminattr' in agents_config
54+
55+
# Device is vulnerable if it has nopassword users and agents enabled
56+
is_vulnerable = has_nopassword_users and agents_enabled
57+
58+
# Assert that the device is not vulnerable
59+
assert not is_vulnerable, (
60+
f"Device {device.name} is vulnerable to CVE-2021-28500. "
61+
"The device is running a vulnerable version AND has local users with nopassword configuration "
62+
"while OpenConfig/TerminAttr agents are enabled, which could allow unrestricted access. "
63+
"Recommended fixes:\n"
64+
"1. Upgrade to one of the following fixed versions:\n"
65+
" * 4.26.2F or later for 4.26.x train\n"
66+
" * 4.25.5M or later for 4.25.x train\n"
67+
" * 4.24.7M or later for 4.24.x train\n"
68+
" * 4.23.9M or later for 4.23.x train\n"
69+
" * 4.22.12M or later for 4.22.x train\n"
70+
" * 4.21.15M or later for 4.21.x train\n"
71+
"2. Until upgrade is complete, implement these workarounds:\n"
72+
" * Remove nopassword configuration for local users\n"
73+
" * Or apply the appropriate hotfix:\n"
74+
" - For 32-bit systems: SecurityAdvisory0071Hotfix.i386.swix\n"
75+
" - For 64-bit systems: SecurityAdvisory0071Hotfix.x86_64.swix\n"
76+
"For more information, see "
77+
"https://www.arista.com/en/support/advisories-notices/security-advisory/13449-security-advisory-0071"
78+
)

‎CVEasy/Arista/2021/cve202128501.py‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202128501',
6+
platform=['arista_eos'],
7+
commands=dict(
8+
show_version='show version',
9+
show_terminattr='show running-config | include terminattr',
10+
show_openconfig='show running-config | include openconfig',
11+
show_users='show running-config | section username'
12+
),
13+
)
14+
def rule_cve202128501(configuration, commands, device, devices):
15+
"""
16+
This rule checks for CVE-2021-28501 vulnerability in Arista EOS devices.
17+
The vulnerability allows unrestricted access to the device for local users with nopassword
18+
configuration due to incorrect use of EOS's AAA APIs by OpenConfig and TerminAttr agents.
19+
"""
20+
# Extract the version information from the command output
21+
version_output = commands.show_version
22+
23+
# List of vulnerable software versions
24+
vulnerable_versions = [
25+
# TerminAttr versions before 1.16.2
26+
'1.15.0', '1.15.1', '1.15.2', '1.15.3',
27+
'1.16.0', '1.16.1'
28+
]
29+
30+
# Check if the current device's software version is in the list of vulnerable versions
31+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
32+
33+
# If version is not vulnerable, no need to check further
34+
if not version_vulnerable:
35+
return
36+
37+
# Check if TerminAttr or OpenConfig agents are enabled
38+
terminattr_config = commands.show_terminattr
39+
openconfig_config = commands.show_openconfig
40+
agents_enabled = bool(terminattr_config or openconfig_config)
41+
42+
# Check if any users are configured with nopassword
43+
users_config = commands.show_users
44+
has_nopassword_users = 'nopassword' in users_config
45+
46+
# Device is vulnerable if agents are enabled and has nopassword users
47+
is_vulnerable = agents_enabled and has_nopassword_users
48+
49+
# Assert that the device is not vulnerable
50+
assert not is_vulnerable, (
51+
f"Device {device.name} is vulnerable to CVE-2021-28501. "
52+
"The device is running a vulnerable version of TerminAttr AND has local users with nopassword configuration "
53+
"while OpenConfig/TerminAttr agents are enabled, which could allow unrestricted access. "
54+
"Recommended fixes:\n"
55+
"1. Upgrade to TerminAttr v1.16.2 or later\n"
56+
"2. Until upgrade is complete, implement these workarounds:\n"
57+
" * Disable OpenConfig gNMI/gNOI and OpenConfig RESTCONF and TerminAttr\n"
58+
" * Or apply the appropriate hotfix with proxy service:\n"
59+
" - For 32-bit systems: SecurityAdvisory0071Hotfix.i386.swix\n"
60+
" - For 64-bit systems: SecurityAdvisory0071Hotfix.x86_64.swix\n"
61+
"For more information, see"
62+
"https://www.arista.com/en/support/advisories-notices/security-advisory/13449-security-advisory-0071"
63+
)

‎CVEasy/Arista/2021/cve202128503.py‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202128503',
6+
platform=['arista_eos'],
7+
commands=dict(
8+
show_version='show version',
9+
show_eapi='show management api http-commands',
10+
show_cert_auth='show running-config | include certificate user'
11+
),
12+
)
13+
def rule_cve202128503(configuration, commands, device, devices):
14+
"""
15+
This rule checks for CVE-2021-28503 vulnerability in Arista EOS devices.
16+
The vulnerability allows remote attackers to bypass authentication when certificate-based
17+
authentication is used with eAPI, due to improper credential re-evaluation.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 4.23.x versions before 4.23.10
25+
'4.23.0', '4.23.1', '4.23.2', '4.23.3', '4.23.4',
26+
'4.23.5', '4.23.6', '4.23.7', '4.23.8', '4.23.9',
27+
# 4.24.x versions before 4.24.8
28+
'4.24.0', '4.24.1', '4.24.2', '4.24.3', '4.24.4',
29+
'4.24.5', '4.24.6', '4.24.7',
30+
# 4.25.x versions before 4.25.6
31+
'4.25.0', '4.25.1', '4.25.2', '4.25.3', '4.25.4', '4.25.5',
32+
# 4.26.x versions before 4.26.3
33+
'4.26.0', '4.26.1', '4.26.2'
34+
]
35+
36+
# Check if the current device's software version is in the list of vulnerable versions
37+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
38+
39+
# If version is not vulnerable, no need to check further
40+
if not version_vulnerable:
41+
return
42+
43+
# Check if eAPI is enabled
44+
eapi_config = commands.show_eapi
45+
eapi_enabled = 'enabled' in eapi_config.lower()
46+
47+
# Check if certificate-based authentication is configured
48+
cert_config = commands.show_cert_auth
49+
cert_auth_enabled = 'certificate user' in cert_config
50+
51+
# Device is vulnerable if both eAPI and certificate auth are enabled
52+
is_vulnerable = eapi_enabled and cert_auth_enabled
53+
54+
# Assert that the device is not vulnerable
55+
assert not is_vulnerable, (
56+
f"Device {device.name} is vulnerable to CVE-2021-28503. "
57+
"The device is running a vulnerable version AND has eAPI enabled with certificate-based authentication, "
58+
"which could allow remote attackers to bypass authentication. "
59+
"Recommended fixes:\n"
60+
"1. Upgrade to one of the following fixed versions:\n"
61+
" * 4.26.3 or later for 4.26.x train\n"
62+
" * 4.25.6 or later for 4.25.x train\n"
63+
" * 4.24.8 or later for 4.24.x train\n"
64+
" * 4.23.10 or later for 4.23.x train\n"
65+
"2. Until upgrade is complete, implement this workaround:\n"
66+
" * Disable certificate-based authentication for eAPI:\n"
67+
" switch(config)#management security\n"
68+
" switch(config-mgmt-security)#ssl profile profileEAPI\n"
69+
" switch(config-mgmt-sec-ssl-profile-profileEAPI)#no trust certificate user.cert\n"
70+
"For more information, see"
71+
"https://www.arista.com/en/support/advisories-notices/security-advisory/13605-security-advisory-0072"
72+
)

‎CVEasy/Arista/2021/cve202128504.py‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202128504',
6+
platform=['arista_eos'],
7+
commands=dict(
8+
show_version='show version',
9+
show_tcam='show hardware tcam profile',
10+
show_acl='show running-config | section ip access-list'
11+
),
12+
)
13+
def rule_cve202128504(configuration, commands, device, devices):
14+
"""
15+
This rule checks for CVE-2021-28504 vulnerability in Arista EOS devices.
16+
The vulnerability occurs on Strata family products when TCAM profile is enabled and
17+
port IPv4 access-lists contain rules matching VXLAN protocol, causing subsequent rules
18+
to not match IP protocol fields as expected.
19+
"""
20+
# Extract the version information from the command output
21+
version_output = commands.show_version
22+
23+
# List of vulnerable software versions
24+
vulnerable_versions = [
25+
# 4.26.x versions before 4.26.4F
26+
'4.26.0', '4.26.1F', '4.26.2F', '4.26.3F',
27+
# 4.27.x versions before 4.27.1M
28+
'4.27.0F'
29+
]
30+
31+
# Check if the current device's software version is in the list of vulnerable versions
32+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
33+
34+
# If version is not vulnerable, no need to check further
35+
if not version_vulnerable:
36+
return
37+
38+
# Check if TCAM profile feature is enabled
39+
tcam_output = commands.show_tcam
40+
tcam_enabled = 'Profile:' in tcam_output
41+
42+
# Check if any ACL has VXLAN protocol matching
43+
acl_config = commands.show_acl
44+
has_vxlan_acl = 'protocol vxlan' in acl_config.lower()
45+
46+
# Device is vulnerable if TCAM profile is enabled and has VXLAN protocol matching in ACLs
47+
is_vulnerable = tcam_enabled and has_vxlan_acl
48+
49+
# Assert that the device is not vulnerable
50+
assert not is_vulnerable, (
51+
f"Device {device.name} is vulnerable to CVE-2021-28504. "
52+
"The device is running a vulnerable version AND has TCAM profile enabled with ACLs matching VXLAN protocol, "
53+
"which could cause subsequent ACL rules to not match IP protocol fields correctly. "
54+
"Recommended fixes:\n"
55+
"1. Upgrade to one of the following fixed versions:\n"
56+
" * 4.26.4F or later for 4.26.x train\n"
57+
" * 4.27.1M or later for 4.27.x train\n"
58+
"2. Until upgrade is complete, implement this workaround:\n"
59+
" * Replace 'protocol vxlan' matches in ACLs with:\n"
60+
" - protocol udp\n"
61+
" - destination port 4789 (or configured VXLAN port)\n"
62+
"For more information, see"
63+
"https://www.arista.com/en/support/advisories-notices/security-advisory/15267-security-advisory-0073"
64+
)

0 commit comments

Comments
 (0)