During a penetration test, BLS was tasked with assessing various components of a customer’s Cisco SD-WAN implementation. While performing the penetration test, BLS discovered that an unauthenticated remote attacker could enumerate user accounts on the vManage component of Cisco’s SD-WAN.
Cisco SD-WAN Overview
For those unfamiliar with Cisco’s SD-WAN, here is a brief overview of it’s components.
Figure 1: Workflow of Cisco’s SD-WAN components
- The vManage is used to administer all of the devices within the SD-WAN from a web interface
- The vSmart handles the implementation of policies and connectivity between SD-WAN branches
- The vEdge routers are the gateways at the branches used to connect to the SD-WAN
- The vBond is the internet facing component that connects to each of vEdge routers to establish a secure connection to the network
Even though it is hosted externally in the cloud, in the majority of implementations access to the vManage is handled by white listing only the IP addresses that need to have access to it.
Normally, vManage users authenticate by sending a POST request containing their credentials to the
Figure 2: Using the
/j_securitycheck endpoint to authenticate with vManage
Although undocumented, it was discovered that vManage allows users to also supply a HTTP Basic Authorization header for authentication.
Figure 3: Using an HTTP Basic Authorization header to authenticate with vManage
While further evaluating this method of authenticating, it was observed that, if a username that did not exist was supplied in the HTTP Basic Authorization header, the server would take significantly longer to respond.
Figure 4: Comparing request response times when supplying a username that exists and a username that does not exist
An attacker could utilize the difference in response times to launch a brute force attack. This could result in the attacker obtaining valid usernames for vManage accounts.
MITRE ID: T1087
Since Cisco’s vMange is a closed source product, BLS was unable to determine the root cause of the user account enumeration during the penetration test. However, Cisco’s security advisory states that the root cause of the user account enumeration was vManage’s “improper handling of HTTP headers”.
Cisco's PSIRT. 2021-03-05 Vulnerability assigned
CVE-2021-1486. 2021-05-05 Public Disclosure.