Cyber Security News

Researcher Details Cisco Smart Licensing that Lets Attacker Control Device

Cisco disclosed a critical vulnerability identified as CVE-2024-20439, affecting its Smart Licensing Utility.

An independent researcher discovered this vulnerability through reverse engineering. It involves a hardcoded static password that could allow attackers to gain unauthorized access and control over affected devices.

The vulnerability highlights significant security concerns for organizations using Cisco’s licensing systems.

Target Application

This vulnerability primarily affects the Cisco Smart Licensing Utility, which is available for Windows and Linux platforms.

The researcher downloaded the Linux version and extracted its contents using standard command-line tools. The utility is built as an Electron application on top of a REST API written in Golang.

 The REST API listens on all network interfaces by default, exposing it to potential external threats. 

According to the Starkeblog, the researcher utilized the Ghidra Golang Extension to analyze the cslu-api binary, uncovering the hardcoded password “Library4C$LU.”

This password is embedded within the APIClient.js file of the Electron component, facilitating unauthorized access through HTTP Basic Authentication.

Download Free Incident Response Plan Template for Your Security Team – Free Download

Electron Component

The critical credentials were found in the resources/app.asar file within the installer package. The .asar file is an Electron archive that can be extracted to reveal its contents.

The APIClient.js file contains the following code snippet:

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
var axios_1 = require("axios");
var https = require("https");
var rxjs_1 = require("rxjs");
var APIClient = /** @class */ (function () {
    function APIClient(config) {
        this.protocol = "http";
        this.apiHost = "localhost";
        this.apiPort = 4596;
        this.apiEndpointPath = "/cslu/v1";
        this.basicAuthUserName = "cslu-windows-client";
        this.basicAuthPassword = "Library4C$LU";
        if (!!APIClient.getInstance()) {
            return APIClient.getInstance();
        }
        [...]

This code reveals that versions 2.0.0 to 2.2.0 of the application use these credentials for HTTP Basic Authentication, posing a significant security risk.

Analysis and Next Steps

The vulnerability is particularly severe because the cslu-api process listens on all network interfaces, allowing attackers with network access to exploit it easily.

Versions 2.0.0 and 2.1.0 also share these credentials, making them equally vulnerable. 

Golang binary

The researcher suggests further analysis could involve developing tools or Metasploit modules to exploit this vulnerability and extract data from compromised systems.

However, they emphasize that updating to version 2.3.0 or later mitigates this risk by removing the hardcoded password. 

Organizations using Cisco’s Smart Licensing Utility are urged to update their software immediately to protect against potential exploitation.

Cisco’s advisory provides detailed instructions on securing affected systems and mitigating risks associated with this vulnerability.

This discovery underscores the importance of robust security practices in software development and deployment. Hardcoded credentials pose significant risks and should be avoided in production environments.

As cybersecurity threats evolve, organizations must remain vigilant and proactive in safeguarding their systems against vulnerabilities like CVE-2024-20439.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14-day free trial

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party JavaScript…

10 hours ago

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs to…

10 hours ago

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate payroll…

10 hours ago

PupkinStealer Exploits Web Browser Passwords and App Tokens to Exfiltrate Data Through Telegram

A newly identified .NET-based information-stealing malware, dubbed PupkinStealer (also known as PumpkinStealer in some reports),…

11 hours ago

71 Fake Websites Impersonating German Retailer to Steal Payment Information

Recorded Future Payment Fraud Intelligence has uncovered a sprawling network of 71 fraudulent e-commerce domains…

11 hours ago

New Scan Uncovers 150K Industrial Systems Worldwide Vulnerable to Cyberattacks

A groundbreaking study leveraging advanced application-layer scanning has exposed approximately 150,000 industrial control systems (ICS)…

11 hours ago