How to Fix CVE-2023-20154- An Authentication Bypass Vulnerability in Cisco Modeling Labs?

The network appliances manufacturer giant Cisco published an advisory on 19 April 2022 in which Cisco detailed an authentication bypass vulnerability in Cisco Modeling Labs, a network simulation and visualization tool developed by Cisco Systems. The vulnerability tracked as CVE-2023-20154 is a Critical severity vulnerability with a CVSS score of 9.1 out of 10. The flaw is in the external authentication mechanism of Cisco Modeling Labs that allows an unauthenticated, but unprivileged, remote attacker to bypass authentication and log in to the web management interface of an affected device with administrative privileges. Since this flaw allows the attacker to access the web interface with administrative privileges, it is most important to fix the CVE-2023-20154 vulnerability. Let’s see how to fix CVE-2023-20154, an authentication bypass vulnerability in Cisco Modeling Labs.

Short Introduction About Cisco Modeling Labs

Cisco Modeling Labs (CML) is a network simulation and visualization tool developed by Cisco Systems. It allows network engineers and administrators to create virtual network environments to test and validate complex network scenarios, configurations, and designs.

CML is designed to simulate multiple network devices, such as routers, switches, firewalls, and servers, allowing users to configure and test their behavior in a virtual environment before implementing changes in the live network. The software supports a range of network protocols and technologies, including IPv4, IPv6, BGP, OSPF, MPLS, VPN, and many others.

CML provides an intuitive graphical user interface that enables users to create and manage virtual network topologies with ease. It also includes a comprehensive set of tools and features for network modeling, testing, and troubleshooting, such as packet capturing, protocol analysis, and network performance monitoring.

Summary of CVE-2023-20154

This is an critical authentication bypass vulnerability in Cisco Modeling Labs. The vulnerability is due to the improper handling of specific messages returned by the associated external authentication server. This vulnerability could be exploited by logging in to the web interface of an affected server.  The flaw allows an authenticated, remote attacker not only to bypass authentication but also to access and modify every simulation.

Cisco Modeling Labs Affected by CVE-2023-20154

The vulnerability affects the following Cisco products configured with LDAP authentication:

To check if LDAP authentication is configured on your Cisco Modeling Labs, log in and navigate to Tools > System Administration > User Authentication. For more information, refer to the Configuring LDAP Authentication guide.

Cisco has confirmed that Modeling Labs – Personal and Modeling Labs – Personal Plus are not affected by this vulnerability.

How to Fix CVE-2023-20154- An Authentication Bypass Vulnerability in Cisco Modeling Labs?

Cisco has released software updates addressing this vulnerability, and workarounds are available. The table below shows Cisco Modeling Labs software releases and whether they are affected by this vulnerability, as well as the first release containing the fix for this vulnerability. Customers are advised to upgrade to a fixed software release as indicated:

We recommend to upgrade to v2.5.1 to fix the CVE-2023-20154 vulnerability.

Workaround

Before we discuss about the available workaround, let’s see the specific condition required to exploit the CVE-2023-20154 vulnerability.

The vulnerability can only be exploited under specific conditions determined by the associated LDAP authentication server’s response to authentication queries from Cisco Modeling Labs. If the LDAP server is configured to reply to search queries with a non-empty array of matching entries (containing search result reference entries), the authentication bypass vulnerability can be exploited. Only the LDAP server administrator can verify and change this behavior, as it cannot be influenced by an attacker.

Administrators can address this vulnerability by verifying the LDAP authentication server configuration, making sure that failing search queries do not return non-empty matching result arrays. Methods for achieving this depend on the deployed LDAP server. For further guidance, consult the documentation for your specific LDAP installation.