Cisco Web Security Appliance Privilege Escalation Vulnerability [CVE-2021-1359]
CVE number – CVE-2021-1359
A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root.
This vulnerability is due to insufficient validation of user-supplied XML input for the web interface. An attacker could exploit this vulnerability by uploading crafted XML configuration files that contain scripting code to a vulnerable device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. An attacker would need a valid user account with the rights to upload configuration files to exploit this vulnerability.
This vulnerability affects Cisco AsyncOS for Cisco WSA, both virtual and hardware appliances.
Customers are advised to upgrade to an appropriate fixed software release as indicated in the following table:
| Cisco AsyncOS for Web Security Appliance Major Release | First Fixed Release |
|---|---|
| 11.8 and earlier | 11.8.4-004 |
| 12.0 | 12.0.3-005 |
| 12.5 | 12.5.21 |
| 14.0 | Not affected. |
1. Release 12.5.2 will be a Maintenance Release (MR) a few days after the publication date of this security advisory.
In most cases, the software can be upgraded over the network by using the System Upgrade options in the Cisco WSA web interface. To upgrade a device by using the web interface, do the following:
- Choose System Administration > System Upgrade.
- Click Upgrade Options.
- Choose Download and Install.
- Choose the release to upgrade to.
- In the Upgrade Preparation area, choose the appropriate options.
- Click Proceed to begin the upgrade. A progress bar displays the status of the upgrade.
After the upgrade is complete, the device reboots.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-scr-web-priv-esc-k3HCGJZ
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.