Skip to content

Commit ac84688

Browse files
netpickermailsanjayhere
netpicker
and
mailsanjayhere
authored
cisco_nxos 2022 cves (#165)
* arista 2021 cves * Fix flake8 and syntax errors in Arista CVE scripts * cisco_ios 2022 cves * cisco_xe 2022 cves * cisco_xe 2022 cves * cisco_xr 2022 cves * cisco_xr 2022 cves * cisco_nxos 2022 cves * cisco_nxos 2022 cves --------- Co-authored-by: mailsanjayhere <mailsanjayhere@gmail.com>
1 parent 590c3bf commit ac84688

File tree

7 files changed

+236
-0
lines changed

7 files changed

+236
-0
lines changed

‎CVEasy/Cisco/2022/cisco_nxos/__init__.py‎

Whitespace-only changes.

‎CVEasy/Cisco/2022/cisco_nxos/cve202220623.py‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220623',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_bfd='show running-config | include feature bfd'
10+
),
11+
)
12+
def rule_cve202220623(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20623 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to a logic error in the BFD rate limiter functionality of Nexus 9000 Series Switches.
16+
An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted stream of traffic
17+
through the device, causing BFD traffic to be dropped and resulting in BFD session flaps, route instability,
18+
and a denial of service condition.
19+
"""
20+
# Extract the platform information
21+
platform_output = commands.show_version
22+
23+
# Check if the device is a Nexus 9000 Series
24+
is_n9k = 'Nexus 9000' in platform_output
25+
26+
# If not a Nexus 9000 device, it's not vulnerable
27+
if not is_n9k:
28+
return
29+
30+
# Extract the output of the command to check BFD configuration
31+
bfd_output = commands.check_bfd
32+
33+
# Check if BFD is enabled
34+
bfd_enabled = 'feature bfd' in bfd_output
35+
36+
# Assert that the device is not vulnerable
37+
assert not bfd_enabled, (
38+
f"Device {device.name} is vulnerable to CVE-2022-20623. "
39+
"The device is a Nexus 9000 Series switch with BFD enabled, "
40+
"which could allow an unauthenticated attacker to cause BFD session flaps and a denial of service "
41+
"through crafted traffic. "
42+
"For more information, see"
43+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-bfd-dos-wGQXrzxn"
44+
)

‎CVEasy/Cisco/2022/cisco_nxos/cve202220624.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220624',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_cfs='show running-config | include cfs ipv4 distribute'
10+
),
11+
)
12+
def rule_cve202220624(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20624 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to insufficient validation of incoming CFSoIP packets.
16+
An unauthenticated, remote attacker could exploit this vulnerability by sending crafted
17+
CFSoIP packets to an affected device, causing it to reload and resulting in a denial of
18+
service condition.
19+
"""
20+
# Extract the output of the command to check CFS configuration
21+
cfs_output = commands.check_cfs
22+
23+
# Check if CFSoIP is enabled
24+
cfs_enabled = 'cfs ipv4 distribute' in cfs_output
25+
26+
# If CFSoIP is not enabled, device is not vulnerable
27+
if not cfs_enabled:
28+
return
29+
30+
# Assert that the device is not vulnerable
31+
assert not cfs_enabled, (
32+
f"Device {device.name} is vulnerable to CVE-2022-20624. "
33+
"The device has Cisco Fabric Services over IP (CFSoIP) enabled, "
34+
"which could allow an unauthenticated attacker to cause a denial of service through crafted "
35+
"CFSoIP packets. "
36+
"For more information, see"
37+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cfsoip-dos-tpykyDr"
38+
)

‎CVEasy/Cisco/2022/cisco_nxos/cve202220625.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220625',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_cdp='show running-config | include no cdp enable|cdp enable'
10+
),
11+
)
12+
def rule_cve202220625(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20625 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to improper handling of Cisco Discovery Protocol messages.
16+
An unauthenticated, adjacent attacker could exploit this vulnerability by sending
17+
malicious CDP packets to an affected device, causing the CDP service to fail and
18+
restart, and in rare conditions, causing the entire device to restart.
19+
"""
20+
# Extract the output of the command to check CDP configuration
21+
cdp_output = commands.check_cdp
22+
23+
# Check if CDP is enabled
24+
cdp_enabled = 'cdp enable' in cdp_output
25+
26+
# If CDP is not enabled, device is not vulnerable
27+
if not cdp_enabled:
28+
return
29+
30+
# Assert that the device is not vulnerable
31+
assert not cdp_enabled, (
32+
f"Device {device.name} is vulnerable to CVE-2022-20625. "
33+
"The device has Cisco Discovery Protocol enabled, "
34+
"which could allow an adjacent attacker to cause a denial of service through "
35+
"malicious CDP packets. "
36+
"For more information, see"
37+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdp-dos-G8DPLWYG"
38+
)

‎CVEasy/Cisco/2022/cisco_nxos/cve202220650.py‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220650',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_nxapi='show running-config | include feature nxapi'
10+
),
11+
)
12+
def rule_cve202220650(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20650 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to insufficient input validation of user supplied data that is sent to the NX-API.
16+
An authenticated, remote attacker could exploit this vulnerability by sending a crafted HTTP POST request
17+
to the NX-API of an affected device, allowing them to execute arbitrary commands with root privileges.
18+
Note: The NX-API feature is disabled by default.
19+
"""
20+
# Extract the output of the command to check NX-API configuration
21+
nxapi_output = commands.check_nxapi
22+
23+
# Check if NX-API is enabled
24+
nxapi_enabled = 'feature nxapi' in nxapi_output
25+
26+
# If NX-API is not enabled, device is not vulnerable
27+
if not nxapi_enabled:
28+
return
29+
30+
# Assert that the device is not vulnerable
31+
assert not nxapi_enabled, (
32+
f"Device {device.name} is vulnerable to CVE-2022-20650. "
33+
"The device has NX-API enabled, which could allow an authenticated attacker "
34+
"to execute arbitrary commands with root privileges through crafted HTTP POST requests. "
35+
"For more information, see"
36+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nxapi-cmdinject-ULukNMZ2"
37+
)

‎CVEasy/Cisco/2022/cisco_nxos/cve202220823.py‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220823',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_ospfv3='show running-config | include router ospfv3|ipv6 router ospf'
10+
),
11+
)
12+
def rule_cve202220823(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20823 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to incomplete input validation of specific OSPFv3 packets.
16+
An unauthenticated, remote attacker could exploit this vulnerability by sending a malicious
17+
OSPFv3 link-state advertisement (LSA) to an affected device, causing the OSPFv3 process to
18+
crash and restart multiple times, leading to a denial of service condition.
19+
Note: The OSPFv3 feature is disabled by default.
20+
"""
21+
# Extract the output of the command to check OSPFv3 configuration
22+
ospfv3_output = commands.check_ospfv3
23+
24+
# Check if OSPFv3 is enabled (either via 'router ospfv3' or 'ipv6 router ospf')
25+
ospfv3_enabled = any(feature in ospfv3_output for feature in [
26+
'router ospfv3',
27+
'ipv6 router ospf'
28+
])
29+
30+
# If OSPFv3 is not enabled, device is not vulnerable
31+
if not ospfv3_enabled:
32+
return
33+
34+
# Assert that the device is not vulnerable
35+
assert not ospfv3_enabled, (
36+
f"Device {device.name} is vulnerable to CVE-2022-20823. "
37+
"The device has OSPFv3 enabled, which could allow an unauthenticated attacker "
38+
"to cause a denial of service through malicious OSPFv3 LSA packets. "
39+
"For more information, see"
40+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ospfv3-dos-48qutcu"
41+
)

‎CVEasy/Cisco/2022/cisco_nxos/cve202220824.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202220824',
6+
platform=['cisco_nxos'],
7+
commands=dict(
8+
show_version='show version',
9+
check_cdp='show running-config | include no cdp enable|cdp enable'
10+
),
11+
)
12+
def rule_cve202220824(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2022-20824 vulnerability in Cisco NX-OS Software.
15+
The vulnerability is due to improper input validation of specific values within Cisco Discovery Protocol messages.
16+
An unauthenticated, adjacent attacker could exploit this vulnerability by sending malicious CDP packets to an
17+
affected device, allowing them to execute arbitrary code with root privileges or cause a denial of "
18+
"service condition.
19+
Note: CDP is enabled by default, and the attacker must be in the same broadcast domain (Layer 2 adjacent).
20+
"""
21+
# Extract the output of the command to check CDP configuration
22+
cdp_output = commands.check_cdp
23+
24+
# Check if CDP is enabled
25+
cdp_enabled = 'cdp enable' in cdp_output
26+
27+
# If CDP is not enabled, device is not vulnerable
28+
if not cdp_enabled:
29+
return
30+
31+
# Assert that the device is not vulnerable
32+
assert not cdp_enabled, (
33+
f"Device {device.name} is vulnerable to CVE-2022-20824. "
34+
"The device has Cisco Discovery Protocol enabled, "
35+
"which could allow an adjacent attacker to execute arbitrary code with root privileges or cause a "
36+
"denial of service. For more information, see"
37+
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cdp-dos-ce-wWvPucC9"
38+
)

0 commit comments

Comments
 (0)