0

While checking for vulnerabilities in one of our Cisco switches I came upon this: CVE-2019-12665.

Excerpt from the CVE:

A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to read and modify data that should normally have been sent via an encrypted channel.

My understanding is that An HTTP-client communicates with an HTTP-server and there might be a switch in between (relaying the traffic). But I just don't understand the utility of having the switch acting as a client (or a server for that matter).

In the linked document, issued by Cisco, the "client feature" cannot even be disabled.

The standard HTTP 1.1 client and the secure HTTP client are always enabled. No commands exist to disable the HTTP client.

My question is: How and why does the switch contain, or offer the ability, to operate as a HTTP client (and/or server)? Why, when or how is this feature utilized?

Improve this question

2 Answers 2

Reset to default
3

How and why does the switch contain, or offer the ability, to operate as a HTTP client...

Simple, because "http:" and "https:" are valid references for actions. For example, copy...

troz-gw-1#copy ?
... (paired down)
  flash:          Copy from flash: file system
  ftp:            Copy from ftp: file system
  http:           Copy from http: file system
  https:          Copy from https: file system
  rcp:            Copy from rcp: file system
  scp:            Copy from scp: file system
  tftp:           Copy from tftp: file system
  xmodem:         Copy from xmodem: file system
  ymodem:         Copy from ymodem: file system

The DDNS service can use http. The callhome subsystem uses http. etc. etc.

Improve this answer
3
  • The practical reason for supporting http(s) in copy would be "So that the user can copy e.g. software images directly from an HTTP(S) server, a feature which some may find useful."
    – ilkkachu
    Oct 20, 2019 at 8:32
  • But the http(s) copy command can only be executed directly from the switch, right? If client A and http-server B are communicating using HTTP, with the switch inbetween, the command is not used?
    – ledwinder96
    Oct 21, 2019 at 7:21
  • You seem to be confused on what "client" and "server" mean; they apply to management services only. They have nothing to do with the switch being a switch and doing what switches do.
    – Ricky
    Oct 21, 2019 at 15:16
3

Here's half an answer to your question, right from the same document:

Remote applications may require that you enable the HTTP server before using them. Applications that use the HTTP server include:

  • Cisco web browser user interface, which uses the Cisco IOS XE Homepage Server, HTTP-based EXEC Server, and HTTP IOS File System
    (IFS) Server
  • VPN Device Manager (VDM) application, which uses the VDM Server and the XML Session Manager (XSM)
  • QoS Device Manager (QDM) application, which uses the QDM Server
  • IP Phone and Cisco IOS XE Telephony Service applications, which use the ITS Local Directory Search and IOS Telephony Server (ITS)
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.