CVE-2009-2631 Clientless SSL VPN products break web browser domain-based security models
Clientless SSL VPNs violating same-origin policy allow attackers to execute XSS, steal cookies, and access internal resources via browser-based attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2009-2631?
CVE-2009-2631 is a medium-severity cross-site scripting vulnerability in Cisco Adaptive Security Appliance, published on 4 Dec 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple clientless SSL VPN products that run in web browsers, including Stonesoft StoneGate; Cisco ASA; SonicWALL E-Class SSL VPN and SonicWALL SSL VPN; SafeNet SecureWire Access Gateway; Juniper Networks Secure Access; Nortel CallPilot; Citrix Access Gateway; and other products, when running in configurations that do not restrict access to the same domain as the VPN, retrieve the content of remote URLs from one domain and rewrite them so they originate from the VPN's domain, which violates the same origin policy and allows remote attackers to conduct cross-site scripting attacks, read cookies that originated from other domains, access the Web VPN session to gain access to internal resources, perform key logging, and conduct other attacks. NOTE: it could be argued that this is a fundamental design problem in any clientless VPN solution, as opposed to a commonly-introduced error that can be fixed in separate implementations. Therefore a single CVE has been assigned for all products that have this design
Which versions are affected by CVE-2009-2631?
It affects 5 products.
Products include Aladdin Safenet Securewire Access Gateway, Cisco Adaptive Security Appliance, Sonicwall E-Class Ssl Vpn, Sonicwall Ssl Vpn, Stonesoft Stonegate.
How do I fix CVE-2009-2631?
No fix has been published for CVE-2009-2631 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2009-2631 being exploited?
There is no known exploitation of CVE-2009-2631 in the wild and no public exploit code.
Sources
Also known as GHSA-jvhh-4rp5-cfmm.