Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability within Cisco IOS XR Software's health check feature can expose an internal Redis database to unauthorized remote access. This flaw allows attackers to interact with the Redis instance, potentially leading to unauthorized data modification or information disclosure within the containerized environment. While the vulnerability is contained within a sandbox and does not permit system-level compromise or remote code execution on the host, it could still impact the integrity and confidentiality of data processed by the affected component.
- Vulnerable component: Cisco IOS XR health check
- Core weakness: Unauthenticated access to Redis
- Main business impact: Unauthorized data access or modification
Attack Path
How an attacker could exploit the issue
A vulnerability within Cisco IOS XR Software's health check feature could enable an attacker to access a Redis instance. This occurs because the health check process activates TCP port 6379 by default, making the Redis instance accessible. An attacker could then connect to this open port. Successful exploitation allows the attacker to modify the Redis in-memory database, write files to the container's filesystem, and obtain information about the Redis database. However, the container's sandboxed environment prevents remote code execution or compromise of the host system.
- Exposed by activated health check RPM.
- Attacker connects to open Redis port.
- Attacker modifies database and writes files.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows an unauthenticated attacker to access a Redis instance within a container on Cisco IOS XR software. While the attacker can read information, write to the in-memory database, and write arbitrary files to the container's file system, they cannot execute remote code or compromise the host system. The risk is mitigated by the sandboxed nature of the container, limiting the potential impact to the container itself.
- Attacker skill level: Low
- Required access or conditions: Network access to the affected device.
- Business risk or urgency: Low
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability may allow an unauthenticated, remote attacker to access a Redis instance running within a container on Cisco IOS XR Software. This access could permit the attacker to write arbitrary files to the container's filesystem or retrieve information about the Redis database. Exploitation is possible if the health check RPM is activated, which opens TCP port 6379. Given the limited scope of the container, remote code execution or compromise of the host system is not expected.
- Identify Cisco IOS XR systems with activated health check RPM.
- Restrict network access to TCP port 6379.
- Apply vendor updates and monitor for related activity.
