Johannes Ullrich, dean of analysis on the SANS Institute, stated, “Most probably, that is an XML Exterior Entity vulnerability.” Exterior entities, he defined, are an XML function that instructs the parser to both learn native recordsdata or entry exterior URLs. On this case, an attacker might embed an exterior entity within the license file, instructing the XML parser to learn a confidential file and embrace it within the response. It is a frequent vulnerability in XML parsers, he stated, sometimes mitigated by disabling exterior entity parsing.
An attacker would have the ability to acquire learn entry to confidential recordsdata like configuration recordsdata, he added, and probably person credentials. Ullrich additionally stated an ISE administrator could have entry to numerous the data, however they need to not have entry to person credentials.
The Cisco advisory says an attacker might exploit this vulnerability by importing a malicious file to the appliance: “A profitable exploit might permit the attacker to learn arbitrary recordsdata from the underlying working system that would embrace delicate information that ought to in any other case be inaccessible even to directors. To take advantage of this vulnerability, the attacker should have legitimate administrative credentials.”
Cisco stated proof-of-concept exploit code is out there for this vulnerability, however up to now the corporate isn’t conscious of any malicious use of the outlet.
Today, admin credentials aren’t onerous to get, Harrington famous. The “soiled secret that few individuals wish to discuss is throughout IT and safety operations there are such a lot of techniques which are left with default credentials.” That’s notably frequent, he stated, with gadgets behind a firewall, akin to community entry management servers, as a result of admins suppose as a result of they’re contained in the community they’ll’t be touched by exterior hackers. However plenty of credentials might be scooped up in compromises of functions the place Cisco admins may need saved passwords.
Associated content material: Cisco warns of three critical ISE vulnerabilities
