Cisco IOS XE Web UI (CVE-2023-20198)

title: Exploitation Indicators Of CVE-2023-20198
id: 2ece8816-b7a0-4d9b-b0e8-ae7ad18bc02b
status: test
description: Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.
references:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
    - https://www.thestack.technology/security-experts-call-for-incident-response-exercises-after-mass-cisco-device-exploitation/
author: Lars B. P. Frydenskov (Trifork Security)
date: 2023-10-20
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - detection.emerging-threats
logsource:
    product: cisco
    service: syslog
    definition: 'Requirements: Cisco IOS XE system logs needs to be configured and ingested'
detection:
    keyword_event:
        - '%WEBUI-6-INSTALL_OPERATION_INFO:'
        - '%SYS-5-CONFIG_P:'
        - '%SEC_LOGIN-5-WEBLOGIN_SUCCESS:'
    keyword_user:
        - 'cisco_tac_admin'
        - 'cisco_support'
        - 'cisco_sys_manager'
    condition: keyword_event and keyword_user
falsepositives:
    - Rare false positives might occur if there are valid users named "cisco_tac_admin" or "cisco_support", which are not created by default or CISCO representatives
level: high

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Web WHERE

Web.url="*/webui/logoutconfirm.html?logon_hash=*"
Web.http_method=POST
Web.status=200

BY Web.http_user_agent Web.status Web.http_method
   Web.url Web.url_length Web.src Web.dest
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_ios_xe_implant_access_filter`

`cisco_ios`
facility="SYS"
mnemonic="CONFIG_P"
message_text="*Configured programmatically by process SEP_webui_wsma_http*"
| rex field=_raw "process\s(?<process>\S+)\sfrom.*as\s(?<user>\S+)\son\s(?<vty>\S+)"
| eval dest=coalesce(host, dvc, dest, "unknown")
| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(process) as process
              values(vty) as vty
  by dest user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_ios_xe_webui_programmatic_configuration_filter`

Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_any ("%SYS-5-CONFIG_P", "%SEC_LOGIN-5-WEBLOGIN_SUCCESS", "%WEBUI-6-INSTALL_OPERATION_INFO")
| where SyslogMessage has_any ("cisco_tac_admin", "cisco_support") or SyslogMessage has "INSTALL_OPERATION_INFO"
| project TimeGenerated, HostName, SyslogMessage

/%(SYS-5-CONFIG_P|SEC_LOGIN-5-WEBLOGIN_SUCCESS|WEBUI-6-INSTALL_OPERATION_INFO)/
| /cisco_tac_admin|cisco_support|INSTALL_OPERATION_INFO/
| groupBy([@host], function=count())

alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET MALWARE BadCandy Cisco IOS XE Implant Check-in"; flow:established,to_server; urilen:38; http.method; content:"POST"; http.uri; content:"/webui/logoutconfirm.html?logon_hash=1"; fast_pattern; threshold:type limit,seconds 300,count 1,track by_src; reference:url,blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/; reference:cve,2023-20198; classtype:trojan-activity; sid:2048584; rev:3; metadata:affected_product Cisco_IOS, attack_target Web_Server, created_at 2023_10_17, cve CVE_2023_20198, deployment Perimeter, deployment Internet, deployment SSLDecrypt, former_category EXPLOIT, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_10_21, reviewed_at 2024_01_26; target:dest_ip;)

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Cisco IOS XE Web UI Command Injection Vulnerability (CVE-2023-20273)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webui/rest/softwareMgmt/installAdd"; startswith; nocase; fast_pattern; http.cookie; content:"Auth="; startswith; http.header_names; to_lowercase; content:"|0d 0a|x-csrf-token|0d 0a|"; nocase; http.request_body; content:"|22|ipaddress|22|"; nocase; content:"|22|"; within:5; content:"|3a|"; within:5; content:"|3a|"; within:5; content:"|3a|"; within:5; pcre:"/^.{0,5}(?:[\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|(?:[\x3c\x3e\x24]|%3c|%3e|%24)(?:\x28|%28))/R"; reference:url,blog.leakix.net/2023/10/cisco-root-privesc/; reference:url,twitter.com/joel_land/status/1719708750741639539; reference:url,sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z; reference:cve,2023-20273; classtype:attempted-admin; sid:2049007; rev:2; metadata:affected_product Cisco_IOS, attack_target Networking_Equipment, created_at 2023_11_01, cve CVE_2023_20273, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Critical, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_27, reviewed_at 2023_11_01, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services; target:dest_ip;)