CVE-2022-20818: Local Privilege Escalation via Partial File Read in Cisco SD-WAN

The “config -> load” feature from Viptela SSH shell uses “wget” to fetch remote “command” files over FTP. By hosting a malicious FTP server and replacing the local files created by wget with symlinks, an attacker can abuse the “root” privileges with which the commands are run to read the first line of arbitrary files.

By reading the secret from “/etc/confd/confd_etc_secret”, the attacker is able to obtain an interactive shell with “root” privileges on the machine.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• Access to the Viptela shell (e.g. via SSH)
  OR
• Access to the local system

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Additional Resources:

Article by Johnny "straight_blast" Yu detailing how to use the "/etc/confd/confd_etc_secret" secret + GDB to gain a root shell

The original ftp_server script used and modified in this exploit was taken from here