CVE-2023-20198-poc

CVE-2023-20198 is a critical vulnerability in the Cisco IOS XE software Web UI feature that allows unauthenticated remote attackers to create accounts with privilege level 15 on affected systems, thereby gaining full control of the device.

The vulnerability primarily stems from improper handling of path resolution in the Web UI feature. Attackers craft HTTP requests using double URL encoding to bypass Nginx's path filtering mechanism and directly access protected internal endpoints, such as /webui_wsma_http. Through these endpoints, attackers can send specially crafted SOAP requests to execute arbitrary CLI commands or make configuration changes.

Specifically, the attacker's request path undergoes double URL encoding, causing Nginx to fail to correctly identify and block unauthorized access, resulting in unauthorized requests being forwarded to the backend iosd service. Through this service, attackers can exploit the Web Services Management Agent (WSMA) functionality to send SOAP requests, create user accounts with the highest privileges, and thereby gain full control of the affected device.

Cisco has issued a security advisory, recommending that users upgrade to the fixed version as soon as possible and take appropriate security measures to prevent such attacks.