SSRF Vulnerability in Cisco Finesse, Unified CCE, and Unified CCX

Cisco has disclosed a critical Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2024-20455, affecting Cisco Finesse, Cisco Unified Contact Center Enterprise (Unified CCE), and Cisco Unified Contact Center Express (Unified CCX). The vulnerability exists due to insufficient validation of user-supplied input provided to the application, allowing an unauthenticated, remote attacker to manipulate the backend server into performing unauthorized HTTP requests. By crafting specific requests, an attacker can bypass access controls to reach internal resources that are otherwise not accessible from the public internet. This flaw poses a significant risk to organizations as it may lead to the exfiltration of sensitive configuration data, internal metadata, or internal service responses that aid in further reconnaissance or lateral movement within the network. Defenders should prioritize patching, as this vulnerability requires no specialized authentication or prior access to the targeted systems.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to perform SSRF attacks, leading to the exposure of sensitive internal information and reconnaissance of internal network segments. This exposes critical contact center infrastructure to potential data theft and increased risk of follow-on attacks against backend components, impacting the confidentiality of organizational data.

Recommendation

Prioritize the application of vendor-supplied patches for CVE-2024-20455 across all affected Cisco Unified Communications products. Configure network-level egress filtering to restrict internal server-to-server communication initiated by these specific applications to only required destinations. Implement strict input validation and access controls on any application endpoints that handle URI-based parameters.