Security breach impacted Cisco VIRL
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-11651 +1 in the same advisory: …11652 | Authentication Bypass and Unauthenticated RCE in SaltStack Salt CVE-2020-11651 is a critical (CVSS 9.8) authentication bypass in SaltStack Salt's salt-master process: the ClearFuncs class fails to validate method calls, so a remote attacker can invoke privileged methods without authenticating. By sending crafted messages to the salt-master's network interface, an unauthenticated user can retrieve the master's root tokens/eauth credentials and use them to execute arbitrary commands on salt minions, yielding full remote code execution across the entire Salt deployment. Anyone running affected Salt versions before 2019.2.4 or 3000.x before 3000.2 — including Salt shipped in Debian, Ubuntu, openSUSE Leap, and VMware's Application Remote Collector — is exposed, especially masters reachable on their ZeroMQ ports. Exploitation is confirmed in the wild: the flaw is on CISA's KEV catalog, EPSS puts exploitation probability at 96.6%, attackers have been mass-scanning for vulnerable Salt installs, and breaches using this bug hit Cisco (six servers), LineageOS, Ghost, and DigiCert. Do: Upgrade salt-master to Salt 2019.2.4 or 3000.2 (or later), or apply the patched packages issued by Debian, Ubuntu, and openSUSE; VMware vROps customers should apply VMware's Application Remote Collector fix. Restrict access to the salt-master ZeroMQ ports (4505/4506) to trusted networks and review masters for signs of compromise, such as unexpected root tokens or unauthorized jobs run on minions. | 9.8 group max | 97% | KEV PoC ×2 |
| largetens of thousands of deployments (thousands of internet-exposed Salt masters, plus Salt bundled in Ubuntu/Debian/openSUSE and VMware ARC) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | us-1.virl.info | ploited SaltStack issues to compromise six company servers: us-1.virl.info us-2.virl.info us-3.virl.info us-4.virl.info vsm-us-1.virl. |
| domain | us-2.virl.info | ck issues to compromise six company servers: us-1.virl.info us-2.virl.info us-3.virl.info us-4.virl.info vsm-us-1.virl.info vsm-us-2.v |
| domain | us-3.virl.info | mpromise six company servers: us-1.virl.info us-2.virl.info us-3.virl.info us-4.virl.info vsm-us-1.virl.info vsm-us-2.virl.info “Cisco |
| domain | us-4.virl.info | mpany servers: us-1.virl.info us-2.virl.info us-3.virl.info us-4.virl.info vsm-us-1.virl.info vsm-us-2.virl.info “Cisco infrastructure |
| domain | vsm-us-1.virl.info | us-1.virl.info us-2.virl.info us-3.virl.info us-4.virl.info vsm-us-1.virl.info vsm-us-2.virl.info “Cisco infrastructure maintains the salt |
| domain | vsm-us-2.virl.info | .virl.info us-3.virl.info us-4.virl.info vsm-us-1.virl.info vsm-us-2.virl.info “Cisco infrastructure maintains the salt-master servers tha |
Full article380 words · extracted from securityaffairs.com · click to collapse
Cisco discloses security breach that impacted VIRL-PE infrastructure, threat actors exploited SaltStack vulnerabilities to hack six company servers.
Cisco has disclosed a security incident that impacted part of its VIRL-PE infrastructure, threat actors exploited vulnerabilities in the SaltStack software package to breach six company servers.
These issues affect the following Cisco products running a vulnerable software release:
- Cisco Modeling Labs Corporate Edition (CML)
- Cisco Virtual Internet Routing Lab Personal Edition (VIRL-PE)
Cisco’s advisory states that the SaltStack software package is bundled with some Cisco products, hackers exploited SaltStack issues to compromise six company servers:
- us-1.virl.info
- us-2.virl.info
- us-3.virl.info
- us-4.virl.info
- vsm-us-1.virl.info
- vsm-us-2.virl.info
“Cisco infrastructure maintains the salt-master servers that are used with Cisco VIRL-PE. Those servers were upgraded on May 7, 2020. Cisco identified that the Cisco maintained salt-master servers that are servicing Cisco VIRL-PE releases 1.2 and 1.3 were compromised. The servers were remediated on May 7, 2020.” reads the advisory.
The six servers are part of the backend infrastructure for VIRL-PE (Internet Routing Lab Personal Edition), a service that allows Cisco users to model and simulate their virtual network environment.
Cisco has it fixed and remediated all breached VIRL-PE servers on May 7, when it upgraded them by applying the patches for the SaltStack software.
Cisco also confirmed that the Cisco Modeling Labs Corporate Edition (CML), a network modeling tool, is affected by the issues.
At the end of April, researchers from F-Secure disclosed a number of vulnerabilities in the “Salt” framework, including two issues that could be exploited by attackers to take over Salt installations.
The two flaws, tracked as CVE-2020-11651 and CVE-2020-11652, are a directory traversal issue and an authentication bypass vulnerability respectively. Chaining the issue, an attacker could bypass authentication and run arbitrary code on Salt master servers exposed online.
Immediately after the public disclosure of the issues. administrators of Salt servers started reporting attacks exploiting the above vulnerabilities last week, threat actors used them to deliver backdoors and miners.
Shortly after the disclosure of the flaws, threat actors exploited them in several attacks against organizations, including mobile operating system vendor LineageOS, Digicert CA, blogging platform Ghost, cloud software provider Xen Orchestra, and search provider Algolia.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Cisco VIRL-PE infrastructure, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/103963/hacking/cisco-virl-pe-infrastructure-hack.html