CVE-2017-12340

Vulnerability in Cisco NX-OS allows local attacker to access Bash shell

• CVSS 4.2
• CWE-116 Improper Encoding or Escaping of Output
• Authentication, Authorization, and Session Management
• Local

A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series Switches could allow an authenticated, local attacker to access the Bash shell of an affected device's operating system, even if the Bash shell is disabled on the system. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain functions of the Python scripting sandbox of the affected system. An attacker could exploit this vulnerability to escape the scripting sandbox and enter the Bash shell of the operating system with the privileges of the authenticated user for the affected system. To exploit this vulnerability, the attacker must have local access to the affected system and be authenticated to the affected system with administrative or Python execution privileges. Cisco Bug IDs: CSCvd86513.

CVE

CVE-2017-12340

CWE

CWE-116 Improper Encoding or Escaping of Output

CVSS base score

4.2

Published

2017-11-30

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update d8s-python to version 0.1.1 or higher.

import subprocess

def execute_command(command):
    """Vulnerable function that demonstrates the security issue."""
    result = subprocess.run(command, shell=True, capture_output=True, text=True)
    return result.stdout

import subprocess

def execute_command(command):
    """Secure function that fixes the vulnerability."""
    unsafe_commands = ['rm', 'shutdown', 'reboot', 'curl', 'wget', 'chmod', 'chown', 'mv', 'cp']
    
    for unsafe_command in unsafe_commands:
        if unsafe_command in command:
            raise ValueError(f"Command '{unsafe_command}' is not allowed")

    result = subprocess.run(command, shell=True, capture_output=True, text=True)
    return result.stdout

@misc{vaitp:cve201712340,
  title        = {{Vulnerability in Cisco NX-OS allows local attacker to access Bash shell}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2017-12340},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-12340/}}
}