Cisco SD-WAN: vManage Vulnerability
Cisco: CVE-2021-1486: SD-WAN vManage Software
Author: Nelson Maher
During a penetration test, Black Lantern Security (BLS) was tasked with assessing various components of a customer’s Cisco SD-WAN implementation. While performing the penetration test, BLS discovered that an unauthenticated remote attacker could enumerate user accounts on the vManage component of Cisco’s SD-WAN.
Cisco SD-WAN Overview
For those unfamiliar with Cisco’s SD-WAN, here is a brief overview of its components.
The vManage is used to administer all of the devices within the SD-WAN from a web interface
The vSmart handles the implementation of policies and connectivity between SD-WAN branches
The vEdge routers are the gateways at the branches used to connect to the SD-WAN
The vBond is the internet facing component that connects to each of vEdge routers to establish a secure connection to the network
Even though it is hosted externally in the cloud, in the majority of implementations access to the vManage is handled by white listing only the IP addresses that need to have access to it.
Normally, vManage users authenticate by sending a POST request containing their credentials to the
Although undocumented, it was discovered that vManage allows users to also supply a HTTP Basic Authorization header for authentication.
While further evaluating this method of authenticating, it was observed that, if a username that did not exist was supplied in the HTTP Basic Authorization header, the server would take significantly longer to respond
An attacker could utilize the difference in response times to launch a brute force attack. This could result in the attacker obtaining valid usernames for vManage accounts.
Since Cisco’s vMange is a closed source product, BLS was unable to determine the root cause of the user account enumeration during the penetration test. However, Cisco’s security advisory states that the root cause of the user account enumeration was vManage’s “improper handling of HTTP headers.”