CVE-2025-20281 Cisco ISE API Unauthenticated Remote Code Exe...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.thezdi.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability
• Blog Title: CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
• Suggested Section: generic-hacking/unsafe-deserialization

🎯 Content Summary

CVE-2025-20281: Unauthenticated Unsafe Deserialization in Cisco ISE enableStrongSwanTunnel API

Summary

On January 25, 2025, ZDI received a report from Kentaro Kawane of an unauthenticated unsafe deserialization in Cisco Identity Services Engine (ISE) enableStrongSwanTunnel API (DescriptionRegistrationListener class), tracked as CVE-2025-20281 (ZDI-25-609) and later fully addressed by CVE-2025-20337 (ZDI-25-607).

Vul...

🔧 Technical Details

An unauthenticated command injection arises from unsafe deserialization of a serialized Java String[] in Cisco ISE’s enableStrongSwanTunnel API, followed by execution of configureStrongSwan.sh via sudo as root. Java 8’s Runtime.exec(String) splits on whitespace via StringTokenizer, ignoring quotes, which breaks multi-argument payloads. By substituting spaces with Bash’s Internal Field Separator (${IFS})...

🤖 Agent Actions

The repository has been updated with relevant technical insights extracted from the ZDI blog:

1. src/pentesting-web/command-injection.md
   • Added a new subsection “Java Runtime.exec Tokenization & ${IFS} Bypass” explaining how Java’s tokenisation can be bypassed using ${IFS}, complete with rationale and practical examples.
   • Integrated the ZDI blog link into an updated “## References” section.

2. src/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.md
   • Expanded the References section with the Cisco ISE container-escape write-up while keeping prior references intact.

These additions capture:
• The Java Runtime.exec whitespace-tokenisation quirk and its exploitation.
• Usage of ${IFS} for r...

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.thezdi.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/unsafe-deserialization".

Repository Maintenance:

• MD Files Formatting: 860 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0