Cisco patches Secure Client VPN flaw that could reveal authentication tokens (CVE-2024-20337)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-20335 +1 in the same advisory: …20336 | A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attacke A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attacker to perform command injection attacks against an affected device. In order to exploit this vulnerability, the attacker must have valid administrative credentials for the device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. NVD description · AI analysis pending | 6.5 | <1% |
| — | ||
| CVE-2024-20337 +1 in the same advisory: …20338 | A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access. NVD description · AI analysis pending | 8.2 group max | 31% |
| — |
Full article342 words · extracted from helpnetsecurity.com · click to collapse
Cisco has fixed two high-severity vulnerabilities affecting its Cisco Secure Client enterprise VPN and endpoint security solution, one of which (CVE-2024-20337) could be exploited by unauthenticated, remote attackers to grab users’ valid SAML authentication token.
“The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user,” Cisco says, but notes that “individual hosts and services behind the VPN headend would still need additional credentials for successful access.”
Cisco Secure Client vulnerabilities (CVE-2024-20337, CVE-2024-20338)
CVE-2024-20337 is a carriage return line feed (CRLF) injection vulnerability.
“An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token,” the company explained.
The vulnerability affects specific Secure Client for Windows, macOS and Linux versions – if the VPN headend (i.e., termination point for the VPN tunnels) is configured with the SAML External Browser feature.
CVE-2024-20338, on the other hand, affects only Cisco Secure Client for Linux if it has the ISE Posture module installed; can only be exploited by an authenticated, local attacker; and could allow the attacker to execute arbitrary code on an affected device with root privileges.
There is no currently no indication that either of these flaws are being exploited by attackers, but enterprise admins should nevertheless upgrade to one of the fixed versions quickly.
Other vulnerabilities patched (and not)
This time around, Cisco has also patched several medium-severity vulnerabilities in Duo Authentication for Windows Logon and RDP and AppDynamics Controller, and warned about two flaws (CVE-2024-20335, CVE-2024-20336) in Cisco Small Business 100, 300, and 500 Series wireless access points (APs) that could allow authenticated, remote attackers to execute arbitrary code as the root user.
The company doesn’t plan to patch those last two, since those wireless APs have entered the end-of-life process. “Customers are encouraged to migrate to the Cisco Business Access Point Series,” Cisco advises.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/03/08/cve-2024-20337/