1. Introduction
Cisco APIC-EM 1.1 is affected by an unspecified reflected cross-site scripting (XSS) vulnerability. This allows a remote attacker to execute arbitrary script code in a user’s browser session via a specially crafted request, potentially compromising confidentiality and integrity of the system. Systems running Cisco Application Policy Infrastructure Controller Enterprise Module version 1.1 are usually impacted. A successful exploit could lead to data theft or unauthorized control of affected systems.
2. Technical Explanation
- Root cause: Improper input sanitization in Cisco APIC-EM 1.1 allows for reflected cross-site scripting.
- Exploit mechanism: An attacker sends a malicious URL to a user, which when accessed executes arbitrary JavaScript code within the user’s browser session. For example, an attacker could send a link containing a payload like ``.
- Scope: Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) version 1.1 is affected.
3. Detection and Assessment
You can confirm if your system is vulnerable by checking the APIC-EM version number. Scanning tools may also identify this vulnerability.
- Quick checks: Check the application’s self-reported version via the web interface or command line (if available).
- Scanning: Nessus plugin ID 6c92abd can detect this vulnerability as an example.
- Logs and evidence: Review APIC-EM logs for suspicious requests containing script tags or encoded characters. Specific log paths depend on your configuration.
4. Solution / Remediation Steps
The solution is to contact Cisco for a fix or upgrade to a patched version of APIC-EM.
4.1 Preparation
- There are no known dependencies, but plan for potential service interruption during the upgrade process. A roll back plan involves restoring from backup or snapshot.
- Change windows may be required depending on your organization’s policies. Approval from relevant stakeholders might be needed.
4.2 Implementation
- Step 1: Contact Cisco support and request the latest patch for APIC-EM version 1.1.
- Step 2: Download the patch file from Cisco’s website.
- Step 3: Follow Cisco’s documented upgrade procedure to install the patch on your APIC-EM instance.
4.3 Config or Code Example
Before
After
4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent XSS vulnerabilities. Input validation and safe defaults are key.
- Practice 1: Implement strict input validation on all user-supplied data to block potentially malicious characters or scripts.
- Practice 2: Use a Content Security Policy (CSP) to control the resources that the browser is allowed to load, reducing the risk of XSS attacks.
4.5 Automation (Optional)
Automation may not be directly applicable for patching this specific vulnerability without using Cisco’s automation tools.
5. Verification / Validation
Verify the fix by confirming that the APIC-EM version has been updated and retesting for XSS vulnerabilities.
- Post-fix check: Check the application’s self-reported version via the web interface to confirm it is a patched version.
- Smoke test: Verify that core APIC-EM functionality, such as network policy management and device monitoring, continues to operate normally.
- Monitoring: Monitor APIC-EM logs for any suspicious requests or errors related to input validation.
6. Preventive Measures and Monitoring
Update security baselines to include this vulnerability, and add checks in your CI/CD pipeline.
- Baselines: Update your security baseline or policy to require the latest APIC-EM version with the XSS fix applied.
- Pipelines: Integrate SAST tools into your CI/CD pipeline to scan for potential XSS vulnerabilities in custom code used by APIC-EM.
- Asset and patch process: Establish a regular patch review cycle for all network devices, including APIC-EM, to ensure timely application of security updates.
7. Risks, Side Effects, and Roll Back
Applying the patch may cause temporary service interruption. Always have a roll back plan.
- Risk or side effect 1: Patch installation could lead to brief downtime. Mitigate by scheduling during off-peak hours.
- Roll back: Restore from the pre-patch backup or snapshot if any issues occur.
8. References and Resources
- Vendor advisory or bulletin: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160201-apic-em
- NVD or CVE entry: https://www.nvd.nist.gov/vuln/detail/CVE-2016-1305
- Product or platform documentation relevant to the fix: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/configuration/b_config_apic-em_secur.html