CVE-2024-20381: Cisco IOS XR Auth Bypass Vulnerability

CVE-2024-20381 Overview

A vulnerability exists in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers. This authorization bypass vulnerability could allow an authenticated, remote attacker to modify the configuration of an affected application or device.

The vulnerability stems from improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.

Critical Impact

Authenticated attackers can bypass authorization controls to create new user accounts, elevate privileges, and make unauthorized configuration changes to network infrastructure devices.

Affected Products

• Cisco Network Services Orchestrator (NSO) versions 4.4.1 through 6.2.2
• Cisco IOS XR versions 6.5.1 through 24.2.11
• Cisco Small Business RV Series Router Firmware versions 1.0.00.29 through 1.0.03.29

Discovery Timeline

• September 11, 2024 - CVE CVE-2024-20381 published to NVD
• October 8, 2024 - Last updated in NVD database

Technical Details for CVE-2024-20381

Vulnerability Analysis

This vulnerability is classified as CWE-285 (Improper Authorization), indicating a fundamental flaw in how the JSON-RPC API validates user permissions before processing requests. The affected systems fail to properly verify that an authenticated user has the necessary authorization level to perform requested operations through the API.

The JSON-RPC API, which serves as the programmatic interface for the web-based management console, accepts requests from authenticated users but does not adequately validate whether those users are authorized to execute specific administrative functions. This creates a significant privilege escalation path where low-privileged users can perform actions intended only for administrators.

The vulnerability affects critical network infrastructure components including Cisco's Network Services Orchestrator, which is used for automating network service deployments, and the RV340 series routers commonly deployed in small business environments. Exploitation could lead to complete compromise of network device configurations.

Root Cause

The root cause is improper authorization checks within the JSON-RPC API implementation. When the API receives requests from authenticated users, it fails to adequately validate whether the user's assigned role and permissions authorize them to perform the requested operation. This allows users with basic access privileges to invoke API methods that should be restricted to administrative users, enabling unauthorized configuration changes and privilege escalation.

Attack Vector

An attacker must first authenticate to the affected system with valid credentials, even those of a low-privileged account. Once authenticated, the attacker can craft malicious JSON-RPC requests targeting privileged API endpoints. By sending these requests directly to the API, the attacker can bypass the authorization controls that would normally prevent unauthorized configuration modifications.

The attack can be executed remotely over the network with low complexity, requiring no user interaction. The attacker could create new administrative accounts, modify existing user privileges, or alter device configurations that could disrupt network operations or create persistent backdoor access.

Detection Methods for CVE-2024-20381

Indicators of Compromise

• Unexpected new user accounts created on affected Cisco devices or NSO instances
• Privilege level changes for existing user accounts without authorized change requests
• Unusual JSON-RPC API requests in web server or application logs, particularly from low-privileged accounts
• Configuration changes that do not correlate with authorized administrative activities

Detection Strategies

• Monitor JSON-RPC API access logs for requests to privileged endpoints from accounts that should not have administrative access
• Implement behavioral analysis to detect anomalous patterns of API usage that deviate from normal user behavior
• Configure alerts for any user account creation or privilege modification events on affected systems
• Review audit logs for configuration changes and correlate them with authorized change management tickets

Monitoring Recommendations

• Enable comprehensive logging for all JSON-RPC API transactions on affected systems
• Deploy network-based intrusion detection rules to identify suspicious API request patterns targeting NSO or affected router interfaces
• Establish baseline behavior for API usage and configure anomaly detection to alert on deviations
• Regularly audit user accounts and privilege assignments on all affected Cisco products

How to Mitigate CVE-2024-20381

Immediate Actions Required

• Review the Cisco Security Advisory for specific patch information and affected version details
• Audit all user accounts on affected systems and remove any unauthorized accounts
• Review and restrict network access to JSON-RPC API endpoints, limiting exposure to trusted networks only
• Implement strict role-based access control policies for all users with access to affected systems

Patch Information

Cisco has released security updates to address this vulnerability. Administrators should consult the Cisco Security Advisory (cisco-sa-nso-auth-bypass-QnTEesp) for specific fixed software versions applicable to their deployment. The advisory provides detailed guidance on upgrading Cisco NSO, IOS XR, and RV340 Series routers to patched versions.

For Cisco NSO and ConfD deployments, ensure you are running a fixed release as specified in the advisory. For Cisco RV340 Series routers, note that these products have entered end-of-life status and may have limited support options.

Workarounds

• Restrict access to the JSON-RPC API by implementing firewall rules or access control lists that limit connectivity to trusted management networks
• Disable the JSON-RPC API if it is not required for operations, using alternative management interfaces where possible
• Implement network segmentation to isolate management interfaces from general network traffic
• Use strong authentication mechanisms and consider implementing multi-factor authentication where supported

# Example: Restrict management interface access via ACL on Cisco IOS XR
# Apply to management interface to limit API access to trusted hosts only
ipv4 access-list MGMT-ACCESS
 10 permit ipv4 10.0.0.0/24 any
 20 deny ipv4 any any log
!
interface MgmtEth0/RP0/CPU0/0
 ipv4 access-group MGMT-ACCESS ingress