Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers
Our summary
SANS Internet Storm Center researcher Johannes Ullrich spotted a honeypot request attempting to exploit an older Cisco IOS flaw, likely CVE-2023-20198, through a POST to a WSMA SOAP endpoint containing a 'uname -a' command execution attempt. The traffic came from a tool identifying itself as RootEvidence/1.0, a vulnerability management scanning platform, and notably included custom 'Opt-Out-Email' and 'Opt-Out-Url' headers that let targets request removal from future scans - a practice the researcher says he hasn't seen used by other scanners before, though RootEvidence has apparently been doing it since last December. The request also URL-encoded the letter 'w' in the path, a trick that could bypass poorly configured web application firewalls. The finding mainly highlights ongoing automated scanning for the known Cisco IOS vulnerability rather than any new attack technique.
Below is the opening; the full story is at SANS Internet Storm Center.
From SANS Internet Storm Center
This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.