CVE-2024-20368: Cisco Identity Services Engine CSRF Flaw

CVE-2024-20368 Overview

CVE-2024-20368 is a cross-site request forgery (CSRF) vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE). The flaw stems from insufficient CSRF protections [CWE-352] in the administrative interface. An unauthenticated, remote attacker can exploit this issue by persuading an authenticated user to click a crafted link. Successful exploitation allows the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user. Cisco ISE serves as a critical network access control platform, making administrative compromise particularly impactful for enterprise authentication, authorization, and accounting (AAA) operations.

Critical Impact
An attacker can execute arbitrary administrative actions on Cisco ISE by tricking an authenticated administrator into following a malicious link, with full impact to confidentiality, integrity, and availability.

Affected Products

Cisco Identity Services Engine 3.1.0 (including patches 1 through 8)
Cisco Identity Services Engine 3.2.0 (including patches 1 through 4)
Cisco Identity Services Engine 3.3.0 (including patch 1)

Discovery Timeline

2024-04-03 - CVE-2024-20368 published to NVD
2024-04-03 - Cisco publishes Cisco Security Advisory cisco-sa-ise-csrf-NfAKXrp5
2025-04-28 - Last updated in NVD database

Technical Details for CVE-2024-20368

Vulnerability Analysis

The vulnerability resides in the web-based management interface of Cisco ISE. The interface does not adequately validate the origin or authenticity of state-changing HTTP requests. Attackers exploit this gap by crafting malicious HTML or JavaScript hosted on an external site. When an authenticated ISE administrator visits the attacker-controlled page or clicks a malicious link, the browser silently submits forged requests to the ISE management interface using the administrator's session credentials.

Because Cisco ISE governs network access policies, endpoint posture assessment, and identity federation, an attacker with administrative-level CSRF abuse can modify authentication policies, create new administrative accounts, or alter device configurations. The attack succeeds without requiring credentials directly, relying instead on the trust the application places in the authenticated session.

Root Cause

The root cause is insufficient CSRF protection on state-changing endpoints in the ISE web management interface. The application fails to validate anti-CSRF tokens, verify the HTTP Origin or Referer headers, or otherwise enforce same-origin request validation on sensitive operations. This classification aligns with CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation requires user interaction. An attacker must convince an authenticated ISE administrator to visit a malicious URL or open a page containing hostile content while their ISE session is active. The attack vector is network-based and requires no prior authentication on the part of the attacker. Common delivery mechanisms include phishing emails containing crafted links, malicious advertisements, or compromised internal sites accessed by administrators using the same browser session.

The vulnerability mechanism does not require a separate exploit payload beyond a crafted HTML form or asynchronous request targeting a vulnerable ISE management endpoint. Refer to the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2024-20368

Indicators of Compromise

Unexpected configuration changes or new administrative accounts created on Cisco ISE
HTTP requests to ISE management endpoints containing external Referer headers or missing CSRF tokens
Administrator session activity originating from browsers shortly after visiting external or untrusted sites
Audit log entries showing privileged actions performed outside normal administrator working patterns

Detection Strategies

Review ISE administrative audit logs for unauthorized policy modifications, account creations, or device configuration changes
Inspect web server access logs for state-changing POST requests with anomalous or absent Referer and Origin headers
Correlate browser proxy logs and ISE access events to identify cross-origin requests reaching the management interface
Monitor for administrative actions occurring without corresponding authenticated user navigation traces in session telemetry

Monitoring Recommendations

Enable verbose audit logging on Cisco ISE and forward logs to a centralized SIEM for retention and correlation
Alert on creation of new administrator accounts or changes to authentication and authorization policies
Track administrator browser sessions and flag concurrent activity across unrelated domains during active ISE sessions
Establish baselines for administrator behavior and alert on deviations from normal configuration change frequency

How to Mitigate CVE-2024-20368

Immediate Actions Required

Upgrade Cisco ISE to a fixed release as documented in the Cisco Security Advisory cisco-sa-ise-csrf-NfAKXrp5
Restrict access to the ISE web-based management interface to dedicated administrative networks or jump hosts
Require administrators to use isolated browser profiles or dedicated management workstations for ISE access
Educate administrators on phishing risks and the dangers of clicking untrusted links during active management sessions

Patch Information

Cisco has released software updates that address this vulnerability. Affected customers running Cisco ISE 3.1, 3.2, or 3.3 must upgrade to a fixed version per the vendor advisory. Consult the Cisco Security Advisory for specific fixed release numbers applicable to each affected train.

Workarounds

No workarounds are listed by Cisco; upgrading to a fixed release is the recommended remediation
Until patching is complete, limit ISE administrative access to trusted networks via firewall ACLs
Enforce short administrative session timeouts to reduce the window during which CSRF attacks can succeed
Require administrators to log out of ISE before browsing external sites or use separate browsers for management tasks

bash

# Example: restrict ISE management interface access via ACL
# Allow only the management subnet to reach the ISE admin interface
access-list 100 permit tcp 10.10.50.0 0.0.0.255 host <ISE-PAN-IP> eq 443
access-list 100 deny   tcp any host <ISE-PAN-IP> eq 443
access-list 100 permit ip any any