Thread: Multiple Vulnerabilities with the Cisco Developer Network

Tweet

I found a bunch of vulnerabilities with Cisco subdomains a couple of weeks ago, some of them were plain old XSS vulnerabilities,while others were more interesting. Cisco is yet to fix some of them which I will not be talking about here, however I will discuss the other issues that I found and which have now been fixed.

I found an XSS on the developer.cisco.com domain, and since Cisco uses Single Sign On for most of its subdomains, an attacker could simply exploit this issue and gain access to the user accounts under other Cisco domains. The Cisco Developer Network runs on a well known product, which is actively maintained by the developers and used worldwide by several major corporations.

The other issue I found was particularly interesting because the application failed to check necessary user privilege levels while a user attempted access to application modules that were obviously sensitive. To this effect, I was able to locate the administration modules of several key sections under developer.cisco.com that would have allowed me to upload files, change and delete the content that users would see. I had access to all available administrative tasks since the application was clearly not checking whether I had admin or guest privileges. To make things worse, Google had traversed and cached these pages which would allow an attacker to reach to all the administration modules following an advanced Google search.


Now that both the issues have been fixed, here's a finer look at the vulnerabilities:

1. XSS in the Cisco Developer Network (developer.cisco.com)
The following pages accept client side input via the '_153_keywords' parameter and render it back to the browser without sanitization.

• http://developer.cisco.com/group/con...&p_p_mode=view
• http://developer.cisco.com/group/con...abs1=completed

This was a POST based XSS, hence to craft an attack vector, an attacker would need to create a page that autosubmits a form on page/body.

2. Insufficient privilege/permission check on the Cisco Developer Network.
The application did not verify the permission levels of logged in users when providing access to the administration modules of several sections listed on http://developer.cisco.com/web/cdc/tech under "Available Technology Centers"

Some examples were:

• http://developer.cisco.com/web/cupapi/admin
• http://developer.cisco.com/web/telesched/administration
  
  
  
  
  An advanced Google search, like the following, can get a list of modules that were vulnerable:
  https://www.google.co.in/search?q=si...administration

More details, on my blog: http://www.riyazwalikar.com/2012/06/...ith-cisco.html