Description
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Cisco ACE XML Gateway 6.0 - Internal IP Disclosure EDB-10000 · remote · Sep 25, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt
- 20090925 Unmatched Request Discloses Client Internal IP Address vendor-advisory
- 20090924 Cisco ACE XML Gateway <= 6.0 Internal IP disclosure mailing-list
- ADV-2009-2778 vdb-entry
- cisco-ace-ipaddress-info-disclosure(53482) vdb-entry
- 20090925 Cisco ACE XML Gateway <= 6.0 Internal IP disclosure mailing-list
- 36522 vdb-entry
- 36879 third-party-advisory
- 1022949 vdb-entry