Cisco Nexus Dashboard Fabric Controller (NDFC) Web UI Command Injection Vulnerability (CVE-2024-20432)

Advisory 4, Oct 2024

CVSS Score: Base 9.9 Critical

BACKGROUND

Cisco has issued a security advisory addressing a critical vulnerability (CVE-2024-20432) in its Nexus Dashboard Fabric Controller (NDFC). This vulnerability could allow an authenticated, low-privileged remote attacker to perform a command injection attack against an affected device. The vulnerability resides in the REST API and web user interface of Cisco NDFC. It stems from improper user authorization and insufficient validation of command arguments. An attacker with valid credentials could exploit this weakness by submitting crafted commands to an affected REST API endpoint or through the web UI.

IMPACT

Allows a remote attacker to execute arbitrary commands on the command-line interface (CLI), potentially compromising the entire network system.
It could expose sensitive configurations, disrupt business operations, or launch further attacks, such as deploying malware or altering traffic routes.
May lead to unauthorized changes, service disruptions, or even a complete shutdown of network segments.
May lead to a widespread impact on multiple network components.

AFFECTED SYSTEMS

This vulnerability affects Cisco NDFC.

Cisco NDFC Release	First Fixed Release
11.5 and earlier	Not Vulnerable
12.0 12.2.2

Note:

This vulnerability does not affect Cisco NDFC when it is configured for SAN controller deployment.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
Nexus Dashboard Insights
Nexus Dashboard Orchestrator (NDO)

RECOMMENDATIONS

Apply patches immediately for the affected administrators.
Limit access to the REST API and web UI to only necessary users.
Implement strong authentication mechanisms for all users.
Continuously monitor logs for suspicious activities or unauthorized access attempts.
Keep the Cisco Nexus Dashboard Fabric Controller software up to date with the latest security patches.
Regularly audit and update security configurations based on Cisco’s latest recommendations and security advisories.