Warning! Cisco device VPN zero-day vulnerability exploited by ransomware gang

Recently, Cisco warned that a zero-day vulnerability, CVE-2023-20269, exists in its Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD), which is being actively exploited by ransomware groups to gain initial access to corporate networks.

This medium-severity zero-day vulnerability affects the VPN features of Cisco ASA and Cisco FTD, allowing unauthorized remote attackers to conduct brute-force attacks against existing accounts.

By accessing these accounts, attackers can establish clientless SSL VPN sessions within the targeted organization's network, which can have various impacts depending on the victim's network configuration.

Reports from last month indicated that the Akira ransomware group breached corporate networks almost exclusively through Cisco VPN devices, which was speculated to have been done through an unknown vulnerability.

Reports a week later showed that, in addition to Akira, the Lockbit ransomware group also exploited undocumented security issues in Cisco VPN devices. However, the exact nature of this issue remained unclear.

At the time, Cisco released a security advisory stating that these breaches were caused by credential brute-forcing on devices where MFA was not configured.

This week, Cisco confirmed the existence of this zero-day vulnerability exploited by these ransomware groups and provided workarounds in an interim security advisory.

However, security updates for the affected products are not yet available.

▍Vulnerability Details

The CVE-2023-20269 flaw is located within the web services interface of Cisco ASA and Cisco FTD devices, specifically in the functions handling Authentication, Authorization, and Accounting (AAA) features.

The flaw is caused by the improper separation of the AAA function and other software features. This allows attackers to send authentication requests to the web services interface to influence or compromise authorization components.

Since these requests are not rate-limited, attackers can use countless username and password combinations to brute-force credentials without being rate-limited or blocked for abuse.

For a brute-force attack to work, Cisco devices must meet the following conditions:

1. At least one user has a password configured in the local database, or HTTPS management authentication points to a valid AAA server.

2. At least one interface has SSL VPN enabled or at least one interface has IKEv2 VPN enabled.

3. If the target device runs Cisco ASA software version 9.16 or earlier, the attacker can establish a clientless SSL VPN session after successful authentication without additional authorization.

To establish this clientless SSL VPN session, the target device needs to meet the following conditions:

1. The attacker has valid credentials for a user existing in the local database or the AAA server used for HTTPS management authentication. These credentials can be obtained using brute-force attack techniques.

2. The device runs Cisco ASA software version 9.16 or earlier.

3. SSL VPN is enabled on at least one interface.

4. The clientless SSL VPN protocol is permitted in the DfltGrpPolicy.

▍Mitigation Recommendations

Cisco will release security updates to address CVE-2023-20269, but until the fixes are available, system administrators are advised to take the following actions:

1. Use DAP (Dynamic Access Policies) to terminate VPN tunnels through DefaultADMINGroup or DefaultL2LGroup.

2. Deny access using the default group policy by adjusting the vpn-simultaneous-logins of DfltGrpPolicy to zero and ensuring all VPN session profiles point to custom policies.

3. Implement local user database restrictions by using the "Group Lock" option to lock specific users to a single profile, and prevent VPN setup by setting "vpn-simultaneous-logins" to zero.

Cisco also recommends securing the default remote access VPN profile by pointing all non-default profiles to a Sinkhole AAA server (dummy LDAP server) and enabling logging to catch potential attack events as early as possible.

Finally, it is important to note that Multi-Factor Authentication (MFA) can mitigate the risk, as even a successful brute-force of account credentials is not sufficient to hijack MFA-protected accounts and use them to establish VPN connections.

The SecurityGauge Attack Library already includes this zero-day vulnerability. You can search for the keyword "CVE-2023-20269" in the SecurityGauge Security Measurement and Verification Platform to obtain relevant attack simulation verification actions, thereby verifying whether your security defense system can effectively respond to ransomware's exploitation of this vulnerability. You can also search for the keyword "Akira" in the SecurityGauge Security Measurement and Verification Platform to obtain attack simulation verification actions related to this ransomware group, thereby verifying whether your security defense system can effectively defend against all attack methods of this ransomware group.