Exploit Attempts Target Cisco IOS Vulnerability with Evasive Techniques
Attackers are actively exploiting a Cisco IOS vulnerability, likely CVE-2023-20198, using custom headers and URL encoding to bypass security measures.
Security researchers have observed exploit attempts targeting a known vulnerability in Cisco IOS, strongly suspected to be CVE-2023-20198. The attacks involve sending crafted POST requests to the /webui_wsma_https endpoint, which is part of the device's web UI management interface. These requests contain a SOAP envelope designed to execute arbitrary commands on the targeted device.
The observed exploit payload includes a command to retrieve system information, specifically uname -a. This indicates a reconnaissance phase, where attackers aim to gather details about the compromised system before potentially escalating their actions. The use of this specific command suggests an effort to confirm the operating system and its configuration.
A notable characteristic of these attack attempts is the inclusion of custom HTTP headers: Opt-Out-Email and Opt-Out-Url. These headers, seemingly employed by a vulnerability management platform named Rootevidence, are not standard and appear to be an attempt to disguise the malicious traffic or potentially interact with specific security tools. This is the first time these specific headers have been observed in conjunction with this exploit.
Furthermore, the attackers are employing URL encoding for certain characters within the request path, specifically encoding the 'w' in /webui_wsma_https as %77. This technique is often used to evade detection by Web Application Firewalls (WAFs) and other security devices that may not properly decode or interpret such encoded characters, allowing the malicious payload to reach its intended target.
The vulnerability itself, CVE-2023-20198, is a critical authentication bypass flaw affecting the Cisco IOS XE Web UI. It allows unauthenticated attackers to perform actions with privilege level 15, effectively granting them full administrative control over the affected device. The exploitability of this vulnerability has been a concern since its disclosure.
While the specific exploit observed is not entirely new, the addition of these evasive techniques highlights the evolving tactics of threat actors. The combination of leveraging a known critical vulnerability and employing methods to circumvent security defenses underscores the persistent threat to network infrastructure.
Organizations running Cisco IOS XE are strongly advised to ensure their devices are patched against CVE-2023-20198. Additionally, implementing robust WAF rules that properly handle URL encoding and monitoring network traffic for unusual POST requests to management interfaces can help detect and prevent such attacks. The use of custom headers, while potentially benign in some contexts, warrants further investigation when observed in conjunction with suspicious network activity.