cisco-ucm-cluster-enum: Cisco Unified Communications Manager - Cluster Enumeration

id: cisco-ucm-cluster-enum

info:
  name: Cisco Unified Communications Manager - Cluster Enumeration
  author: Morgan Robertson
  severity: low
  description: |
    Enumerated Cisco UCM cluster nodes (servers) using the unauthenticated UDS API (XML), allowing identification of backend servers without authentication.
  reference:
    - https://developer.cisco.com/site/user-data-services/develop-and-test/api-reference/#servers
  metadata:
    verified: true
    product: unified_communications_manager
    vendor: cisco
    shodan-query: http.title:"Unified Communications Self Care Portal"
    fofa-query: title="Unified Communications Self Care Portal"
  tags: cisco,ucm,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cucm-uds/servers"

    headers:
      Accept: application/xml

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "text/xml"
          - "application/xml"
        condition: or

      - type: word
        part: body
        words:
          - '<servers uri'
          - '<server>'
        condition: and

    extractors:
      - type: xpath
        name: cluster_nodes
        xpath:
          - "/servers/server"
# digest: 4a0a0047304502210083fa0eb2b5d188720caacb79daa30888251a535be4f2ffd7b8a9b7be1af32eef02201c62bf87857fbe2fc94fa9e4f3d6ee197d5e771436898bd3911755a50f6ae76a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.