Ransomware Group Exploit Cisco VPN Zero-Day Vulnerability

Cisco has issued a warning about a zero-day vulnerability, tracked as CVE-2023-20269, affecting its Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) products. Ransomware operations are actively exploiting this vulnerability to gain initial access to corporate networks.

Medium Severity Zero-Day Vulnerability

The zero-day vulnerability in question has a medium severity rating and primarily impacts the VPN feature of Cisco ASA and Cisco FTD. It allows unauthorized remote attackers to conduct brute-force attacks against existing accounts.

By exploiting this vulnerability and accessing compromised accounts, attackers can establish a clientless SSL VPN session within the breached organization's network. The repercussions of this unauthorized access can vary significantly based on the victim's network configuration.

This development comes after recent reports indicated that ransomware gangs, such as Akira and LockBit, were breaching corporate networks through Cisco VPN devices, with suspicions of an undisclosed vulnerability.

Attack Vector and Vulnerability Details

The CVE-2023-20269 vulnerability is located within the web services interface of Cisco ASA and Cisco FTD devices, explicitly affecting the authentication, authorization, and accounting (AAA) functions.

The flaw arises from improperly separating the AAA functions and other software features, allowing attackers to send authentication requests to the web services interface without limitations. This enables them to conduct brute force attacks using countless username and password combinations, all without being rate-limited or blocked for abuse.

To successfully carry out brute force attacks, the targeted Cisco appliance must meet specific conditions:

At least one user is configured with a password in the LOCAL database or HTTPS management authentication points to a valid AAA server.
SSL VPN is enabled on at least one interface, or IKEv2 VPN is enabled on at least one interface.

For devices running Cisco ASA Software Release 9.16 or earlier, successful authentication allows the attacker to establish a clientless SSL VPN session without additional authorization, posing a significant security risk.

To establish this session, the following conditions must be met:

The attacker possesses valid credentials for a user either in the LOCAL database or the AAA server used for HTTPS management authentication, potentially obtained through brute force attacks.
The device runs Cisco ASA Software Release 9.16 or an earlier version.
SSL VPN is enabled on at least one interface.
The clientless SSL VPN protocol is allowed in the DfltGrpPolicy.

Mitigating the CVE-2023-20269 Vulnerability

While Cisco is actively working on a security update to address CVE-2023-20269, system administrators are strongly advised to take immediate action to mitigate the risks associated with this vulnerability. The following steps are recommended:

Implement Dynamic Access Policies (DAP): Use DAP to stop VPN tunnels associated with DefaultADMINGroup or DefaultL2LGroup.
Deny Access with Default Group Policy: Adjust vpn-simultaneous-logins for DfltGrpPolicy to zero, ensuring all VPN session profiles point to a custom policy.
Local User Database Restrictions: Lock specific users to a single profile using the 'group-lock' option, and prevent VPN setups by setting 'vpn-simultaneous-logins' to zero.
Secure Default Remote Access VPN Profiles: Point all non-default profiles to a sinkhole AAA server (dummy LDAP server) and enable logging to detect potential attack incidents early.

It's crucial to note that multi-factor authentication (MFA) is an effective measure to mitigate the risk associated with this vulnerability. Even if attackers successfully brute force account credentials, MFA would prevent them from hijacking secured accounts to establish VPN connections.

Observations from Rapid7

Rapid7's managed detection and response (MDR) teams have closely monitored threat activity related to Cisco ASA SSL VPN appliances. They observed increased threat activity dating back to March 2023, with adversaries conducting various attacks.

Credential Stuffing and Brute-Force Attacks: Some attacks leveraged weak or default passwords through credential stuffing, while others utilized targeted brute-force attacks on ASA appliances where MFA was either not enabled or not enforced for all users.

Ransomware Deployment: Several incidents led to the deployment of ransomware by groups such as Akira and LockBit.

Targeted Organizations and Industries

The attacks showed no clear pattern in terms of target organizations or verticals. Victims varied in size and spanned across sectors, including healthcare, professional services, manufacturing, oil and gas, and others.

Indicators of Compromise (IOCs)

Rapid7 identified several IP addresses associated with source authentication events to compromised internal assets and outbound connections from the AnyDesk remote desktop application. The list of IP addresses, along with other IOCs, provides valuable insights for threat detection and response.

Dark Web Activity

In parallel with incident response investigations, Rapid7's threat intelligence teams monitored underground forums and Telegram channels for discussions related to these attacks. They discovered a guide on breaking into corporate networks, which included chapters on SSL VPN brute forcing. This guide was being sold for a significant sum on the dark web.

Mitigation Guidance

To strengthen security posture and mitigate the risks associated with these attacks, organizations are advised to take the following measures:

Disable Default Accounts: Ensure default accounts have been disabled or passwords have been reset from the default.
Enforce MFA: Implement multi-factor authentication (MFA) for all VPN users, limiting exceptions.
Enable Logging: Enable logging on VPNs to monitor authentication attempts and detect anomalies.
Regularly Update VPNs: Stay current on patches for security issues in VPNs and other gateway devices.

Cisco's Response

Cisco has confirmed the existence of the CVE-2023-20269 vulnerability and is actively working on a security update. They have provided interim workarounds to address the issue until fixes become available.