Skip to content

Commit e902624

Browse files
netpickermailsanjayhere
netpicker
and
mailsanjayhere
authored
cisco_xe cve 2023 (#172)
* arista 2021 cves * Fix flake8 and syntax errors in Arista CVE scripts * cisco_ios 2022 cves * cisco_xe 2022 cves * cisco_xe 2022 cves * cisco_xr 2022 cves * cisco_xr 2022 cves * cisco_nxos 2022 cves * cisco_nxos 2022 cves * arista 2022 2024 cve * arista 2022 2024 cve * Arista 2023 * Arista 2023 * cisco_ios 2023 cve * cisco_ios 2023 cve * cisco_xe cve 2023 * cisco_xe cve 2023 --------- Co-authored-by: mailsanjayhere <mailsanjayhere@gmail.com>
1 parent de186ab commit e902624

19 files changed

+905
-0
lines changed

‎CVEasy/Cisco/2023/cisco_xe/__init__.py‎

Whitespace-only changes.

‎CVEasy/Cisco/2023/cisco_xe/cve202320027.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320027',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_vfr='show running-config | include ip virtual-reassembly'
10+
),
11+
)
12+
def rule_cve202320027(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20027 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to improper reassembly of large packets when Virtual Fragmentation
16+
Reassembly (VFR) is enabled on either a tunnel interface or on a physical interface that is
17+
configured with an MTU greater than 4,615 bytes.
18+
"""
19+
# Extract the output of the command to check VFR configuration
20+
vfr_output = commands.check_vfr
21+
22+
# Check if VFR is configured
23+
vfr_configured = 'ip virtual-reassembly' in vfr_output
24+
25+
# Assert that the device is not vulnerable
26+
assert not vfr_configured, (
27+
f"Device {device.name} is vulnerable to CVE-2023-20027. "
28+
"The device has Virtual Fragmentation Reassembly (VFR) enabled, "
29+
"which could allow an attacker to cause a denial of service. "
30+
"For more information, see"
31+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv4-vfr-dos-CXxtFacb"
32+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320029.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320029',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_meraki='show running-config | include meraki'
10+
),
11+
)
12+
def rule_cve202320029(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20029 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to insufficient memory protection in the Meraki onboarding feature.
16+
An attacker could exploit this vulnerability by modifying the Meraki registration parameters,
17+
which could allow them to elevate privileges to root.
18+
"""
19+
# Extract the output of the command to check Meraki configuration
20+
meraki_output = commands.check_meraki
21+
22+
# Check if Meraki onboarding is configured
23+
meraki_configured = 'meraki' in meraki_output
24+
25+
# Assert that the device is not vulnerable
26+
assert not meraki_configured, (
27+
f"Device {device.name} is vulnerable to CVE-2023-20029. "
28+
"The device has Meraki onboarding feature enabled, "
29+
"which could allow an attacker to elevate privileges to root. "
30+
"For more information, see"
31+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-sABD8hcU"
32+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320033.py‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320033',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_mgmt='show running-config | include interface GigabitEthernet0'
10+
),
11+
)
12+
def rule_cve202320033(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20033 vulnerability in Cisco IOS XE Software for
15+
Catalyst 3650/3850 Series Switches. The vulnerability is due to improper resource
16+
management when processing traffic received on the management interface.
17+
An attacker could exploit this vulnerability by sending a high rate of traffic to
18+
the management interface.
19+
"""
20+
# Extract the version information from the command output
21+
version_output = commands.show_version
22+
23+
# List of vulnerable software versions
24+
vulnerable_versions = [
25+
# 16.3 versions
26+
'16.3.1', '16.3.2', '16.3.3', '16.3.1a', '16.3.4', '16.3.5', '16.3.5b',
27+
'16.3.6', '16.3.7', '16.3.8', '16.3.9', '16.3.10', '16.3.11',
28+
# 16.4-16.9 versions
29+
'16.4.1', '16.5.1', '16.5.1a', '16.6.1', '16.6.2', '16.6.3', '16.6.4',
30+
'16.6.5', '16.6.4a', '16.6.6', '16.6.7', '16.6.8', '16.6.9', '16.6.10',
31+
'16.7.1', '16.8.1', '16.8.1a', '16.8.1s', '16.9.1', '16.9.2', '16.9.1s',
32+
'16.9.3', '16.9.4', '16.9.3a', '16.9.5', '16.9.6', '16.9.7', '16.9.8',
33+
# 16.11-16.12 versions
34+
'16.11.1', '16.11.2', '16.11.1s', '16.12.1', '16.12.1s', '16.12.2',
35+
'16.12.3', '16.12.8', '16.12.4', '16.12.3s', '16.12.3a', '16.12.5',
36+
'16.12.6', '16.12.5b', '16.12.6a', '16.12.7', '16.12.9'
37+
]
38+
39+
# Check if the current device's software version is in the list of vulnerable versions
40+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
41+
42+
# If version is not vulnerable, no need to check further
43+
if not version_vulnerable:
44+
return
45+
46+
# Extract the output of the command to check management interface configuration
47+
mgmt_output = commands.check_mgmt
48+
49+
# Check if management interface is configured
50+
mgmt_configured = 'interface GigabitEthernet0' in mgmt_output
51+
52+
# Assert that the device is not vulnerable
53+
assert not mgmt_configured, (
54+
f"Device {device.name} is vulnerable to CVE-2023-20033. "
55+
"The device is running a vulnerable version AND has management interface configured, "
56+
"which could allow an attacker to cause a denial of service. "
57+
"For more information, see"
58+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat3k-dos-ZZA4Gb3r"
59+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320035.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320035',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_sdwan='show running-config | include sdwan'
10+
),
11+
)
12+
def rule_cve202320035(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20035 vulnerability in Cisco IOS XE SD-WAN Software.
15+
The vulnerability is due to insufficient input validation by the system CLI.
16+
An attacker with privileges to run commands could exploit this vulnerability by submitting
17+
crafted input to the system CLI, allowing them to execute commands with root-level privileges.
18+
"""
19+
# Extract the output of the command to check SD-WAN configuration
20+
sdwan_output = commands.check_sdwan
21+
22+
# Check if SD-WAN is configured
23+
sdwan_configured = 'sdwan' in sdwan_output
24+
25+
# Assert that the device is not vulnerable
26+
assert not sdwan_configured, (
27+
f"Device {device.name} is vulnerable to CVE-2023-20035. "
28+
"The device has SD-WAN configured with CLI access, "
29+
"which could allow an attacker to execute arbitrary commands with root privileges. "
30+
"For more information, see"
31+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sdwan-VQAhEjYw"
32+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320065.py‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320065',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_iox='show running-config | include iox'
10+
),
11+
)
12+
def rule_cve202320065(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20065 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to insufficient restrictions on the hosted application in the
16+
Cisco IOx application hosting subsystem. An attacker could exploit this vulnerability
17+
by logging in to and then escaping the Cisco IOx application container.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 16.4 versions
25+
'16.4.1', '16.4.2', '16.4.3',
26+
# 17.3 versions
27+
'17.3.1', '17.3.2', '17.3.3', '17.3.1a', '17.3.1w', '17.3.2a', '17.3.1x',
28+
'17.3.1z', '17.3.4', '17.3.5', '17.3.4a', '17.3.6', '17.3.4b', '17.3.4c',
29+
'17.3.5a', '17.3.5b',
30+
# 17.4-17.9 versions
31+
'17.4.1', '17.4.2', '17.4.1a', '17.4.1b', '17.4.2a',
32+
'17.5.1', '17.5.1a', '17.5.1b', '17.5.1c',
33+
'17.6.1', '17.6.2', '17.6.1w', '17.6.1a', '17.6.1x', '17.6.3', '17.6.1y',
34+
'17.6.1z', '17.6.3a', '17.6.4', '17.6.1z1',
35+
'17.7.1', '17.7.1a', '17.7.1b', '17.7.2',
36+
'17.8.1', '17.8.1a',
37+
'17.9.1', '17.9.1w', '17.9.2', '17.9.1a', '17.9.2a'
38+
]
39+
40+
# Check if the current device's software version is in the list of vulnerable versions
41+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
42+
43+
# If version is not vulnerable, no need to check further
44+
if not version_vulnerable:
45+
return
46+
47+
# Extract the output of the command to check IOx configuration
48+
iox_output = commands.check_iox
49+
50+
# Check if IOx is configured
51+
iox_configured = 'iox' in iox_output
52+
53+
# Assert that the device is not vulnerable
54+
assert not iox_configured, (
55+
f"Device {device.name} is vulnerable to CVE-2023-20065. "
56+
"The device is running a vulnerable version AND has IOx application hosting configured, "
57+
"which could allow an attacker to elevate privileges to root. "
58+
"For more information, see"
59+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-"
60+
"sa-iox-priv-escalate-Xg8zkyPk"
61+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320066.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320066',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_webui='show running-config | include ip http|webui'
10+
),
11+
)
12+
def rule_cve202320066(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20066 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to insufficient security configuration in the web UI.
16+
An attacker could exploit this vulnerability by sending a crafted request to the web UI,
17+
allowing them to gain read access to files outside the filesystem mountpoint.
18+
"""
19+
# Extract the output of the command to check web UI configuration
20+
webui_output = commands.check_webui
21+
22+
# Check if web UI is enabled
23+
webui_enabled = any(service in webui_output for service in ['ip http', 'webui'])
24+
25+
# Assert that the device is not vulnerable
26+
assert not webui_enabled, (
27+
f"Device {device.name} is vulnerable to CVE-2023-20066. "
28+
"The device has web UI enabled, which could allow an attacker to access files "
29+
"outside the filesystem mountpoint through path traversal. "
30+
"For more information, see"
31+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-pthtrv-es7GSb9V"
32+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320067.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320067',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_wlc='show running-config | include wireless|http client'
10+
),
11+
)
12+
def rule_cve202320067(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20067 vulnerability in Cisco IOS XE Software for Wireless LAN Controllers.
15+
The vulnerability is due to insufficient input validation of received traffic in the "
16+
"HTTP-based client profiling feature.
17+
An attacker could exploit this vulnerability by sending crafted traffic through a wireless access point,
18+
causing high CPU utilization and a denial of service condition.
19+
"""
20+
# Extract the output of the command to check WLC and HTTP client profiling configuration
21+
wlc_output = commands.check_wlc
22+
23+
# Check if WLC and HTTP client profiling are configured
24+
wlc_configured = 'wireless' in wlc_output and 'http client' in wlc_output
25+
26+
# Assert that the device is not vulnerable
27+
assert not wlc_configured, (
28+
f"Device {device.name} is vulnerable to CVE-2023-20067. "
29+
"The device has wireless LAN controller and HTTP client profiling enabled, "
30+
"which could allow an attacker to cause a denial of service condition. "
31+
"For more information, see"
32+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-dos-wFujBHKw"
33+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320072.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320072',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_tunnel='show running-config | include tunnel|gre'
10+
),
11+
)
12+
def rule_cve202320072(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20072 vulnerability in Cisco IOS XE Software.
15+
The vulnerability is due to improper handling of large fragmented tunnel protocol packets.
16+
An attacker could exploit this vulnerability by sending crafted fragmented packets to an affected system,
17+
causing it to reload and resulting in a denial of service (DoS) condition.
18+
"""
19+
# Extract the output of the command to check tunnel configuration
20+
tunnel_output = commands.check_tunnel
21+
22+
# Check if any tunnel protocols (like GRE) are configured
23+
tunnel_configured = any(protocol in tunnel_output for protocol in ['tunnel', 'gre'])
24+
25+
# Assert that the device is not vulnerable
26+
assert not tunnel_configured, (
27+
f"Device {device.name} is vulnerable to CVE-2023-20072. "
28+
"The device has tunnel protocols configured (e.g., GRE), "
29+
"which could allow an attacker to cause a denial of service through crafted fragmented packets. "
30+
"For more information, see"
31+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-gre-crash-p6nE5Sq5"
32+
)

‎CVEasy/Cisco/2023/cisco_xe/cve202320082.py‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202320082',
6+
platform=['cisco_xe'],
7+
commands=dict(
8+
show_version='show version',
9+
check_platform='show inventory | include Chassis'
10+
),
11+
)
12+
def rule_cve202320082(configuration, commands, device, devices):
13+
"""
14+
This rule checks for the CVE-2023-20082 vulnerability in Cisco IOS XE Software
15+
for Catalyst 9300 Series Switches. The vulnerability is due to errors that occur
16+
when retrieving the public release key used for image signature verification.
17+
An attacker could exploit this vulnerability by modifying specific variables in the
18+
SPI flash memory, allowing them to execute persistent code at boot time and break
19+
the chain of trust.
20+
"""
21+
# Extract the output of the command to check platform type
22+
platform_output = commands.check_platform
23+
24+
# Check if the device is a Catalyst 9300 Series Switch
25+
is_cat9300 = 'C9300' in platform_output
26+
27+
# Extract the version information from the command output
28+
version_output = commands.show_version
29+
30+
# Check if version is before 16.11.1 (more vulnerable)
31+
version_pre_16_11_1 = not any(ver in version_output for ver in ['16.11.1', '16.12', '17.'])
32+
33+
# Assert that the device is not vulnerable
34+
assert not (is_cat9300 and version_pre_16_11_1), (
35+
f"Device {device.name} is vulnerable to CVE-2023-20082. "
36+
"The device is a Catalyst 9300 Series Switch running a version before 16.11.1, "
37+
"which could allow an attacker to execute persistent code at boot time. "
38+
"For more information, see"
39+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9300-spi-ace-yejYgnNQ"
40+
)

0 commit comments

Comments
 (0)