CVE-2024-20255: Cisco Expressway CSRF Vulnerability

CVE-2024-20255 Overview

CVE-2024-20255 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Simple Object Access Protocol (SOAP) API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS). An unauthenticated, remote attacker can exploit this flaw by persuading a REST API user to follow a crafted link. Successful exploitation forces the affected system to reload, producing a denial-of-service condition on the targeted appliance.

The vulnerability stems from insufficient CSRF protections in the web-based management interface. Cisco published the issue on February 7, 2024 under advisory cisco-sa-expressway-csrf-KnnZDMj3.

Critical Impact

An unauthenticated attacker can trigger an unscheduled system reload of Cisco Expressway or TelePresence VCS, disrupting collaboration and video conferencing services.

Affected Products

• Cisco Expressway Series
• Cisco TelePresence Video Communication Server (VCS)
• Deployments exposing the SOAP API and web-based management interface

Discovery Timeline

• 2024-02-07 - CVE-2024-20255 published to the National Vulnerability Database (NVD)
• 2024-02-07 - Cisco releases security advisory cisco-sa-expressway-csrf-KnnZDMj3
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-20255

Vulnerability Analysis

The flaw resides in the SOAP API exposed by the web-based management interface on Cisco Expressway and TelePresence VCS. The application does not adequately validate the origin or authenticity of state-changing requests submitted to this interface. As a result, requests issued from an attacker-controlled context are processed as if they originated from a legitimate REST API user session.

Because Expressway and VCS systems frequently sit at the network edge to support business-to-business video traversal and Mobile and Remote Access (MRA), an unscheduled reload disrupts external collaboration sessions and signaling. The vulnerability requires user interaction but does not require attacker authentication, broadening the pool of viable targets.

Root Cause

The root cause is missing or insufficient CSRF protections, classified as [CWE-352] Cross-Site Request Forgery. The SOAP API endpoints do not enforce anti-CSRF tokens, custom request headers, or strict same-origin checks on state-changing operations. Browser-issued requests inherit ambient authentication from an active management session, and the server cannot distinguish forged requests from legitimate ones.

Attack Vector

Exploitation is network based and relies on social engineering. The attacker hosts a crafted page or link that, when visited by a user with an active REST API or management session, issues a SOAP request to the affected device. The triggered operation causes the system to reload. No verified public proof-of-concept exploit code is currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2024-20255

Indicators of Compromise

• Unexpected reload events recorded in Expressway or TelePresence VCS event logs without a corresponding administrator action or scheduled maintenance window.
• SOAP API requests in web server logs originating from external referrers or from browser User-Agent strings rather than known REST clients.
• Management interface access patterns immediately preceding device reboots.

Detection Strategies

• Correlate appliance reload events with prior HTTP requests to the SOAP API endpoints to identify forged request chains.
• Inspect HTTP Referer and Origin headers on requests to the management interface and flag mismatches with the appliance hostname.
• Hunt for repeated short-lived sessions terminating with system reload events across the Expressway cluster.

Monitoring Recommendations

• Forward Expressway and VCS syslog data to a centralized SIEM and alert on system reload events outside maintenance windows.
• Monitor administrator browser endpoints for visits to untrusted external sites while authenticated to Expressway management consoles.
• Track availability metrics for video traversal services and alert on unexpected service restarts.

How to Mitigate CVE-2024-20255

Immediate Actions Required

• Apply the fixed software release identified in the Cisco Security Advisory for Cisco Expressway Series and TelePresence VCS.
• Restrict access to the web-based management interface to dedicated administrative networks and jump hosts.
• Require administrators to use isolated browser sessions when managing Expressway and avoid concurrent browsing to untrusted sites.

Patch Information

Cisco has released free software updates that address CVE-2024-20255. Customers with valid service contracts should obtain fixed releases through their normal update channels. Confirm the specific fixed version for your deployment against the vendor advisory before scheduling maintenance, and validate cluster members are upgraded consistently.

Workarounds

• Cisco's advisory states there are no workarounds that address this vulnerability; patching is the only supported remediation.
• As a defense-in-depth measure, terminate management sessions immediately after administrative tasks complete to reduce CSRF exposure windows.
• Enforce network access controls so that the SOAP API and management interface are not reachable from general user networks or the internet.

# Restrict management interface access at the network edge (example ACL)
access-list MGMT_ACL permit tcp 10.10.0.0 0.0.0.255 host <expressway-ip> eq 443
access-list MGMT_ACL deny   tcp any host <expressway-ip> eq 443
access-list MGMT_ACL permit ip any any