CVE-2017-3813 - Missing Authorization

Severity

72%

Complexity

39%

Confidentiality

165%

A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the access controls. An attacker could exploit this vulnerability by opening the Internet Explorer browser. An exploit could allow the attacker to use Internet Explorer with the privileges of the SYSTEM user. This may allow the attacker to execute privileged commands on the targeted system. This vulnerability affects versions prior to released versions 4.4.00243 and later and 4.3.05017 and later. Cisco Bug IDs: CSCvc43976.

A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the access controls. An attacker could exploit this vulnerability by opening the Internet Explorer browser. An exploit could allow the attacker to use Internet Explorer with the privileges of the SYSTEM user. This may allow the attacker to execute privileged commands on the targeted system. This vulnerability affects versions prior to released versions 4.4.00243 and later and 4.3.05017 and later. Cisco Bug IDs: CSCvc43976.

CVSS 3.0 Base Score 7.8. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 7.2. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C).

Demo Examples

Missing Authorization

CWE-862

This function runs an arbitrary SQL query on a given database, returning the result of the query.


               
$employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);
return $preparedStatement->fetchAll();//Use a prepared statement to avoid CWE-89
/.../

While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.

Missing Authorization

CWE-862

The following program could be part of a bulletin board system that allows users to send private messages to each other. This program intends to authenticate the user before deciding whether a private message should be displayed. Assume that LookupMessageObject() ensures that the $id argument is numeric, constructs a filename based on that id, and reads the message details from that file. Also assume that the program stores all private messages for all users in the same directory.


               
DisplayPrivateMessage($id);
print "Body: " . encodeHTML($Message->{body}) . "\n";
# For purposes of this example, assume that CWE-309 and# CWE-523 do not apply.
ExitError("invalid username or password");

While the program properly exits if authentication fails, it does not ensure that the message is addressed to the user. As a result, an authenticated attacker could provide any arbitrary identifier and read private messages that were intended for other users.

One way to avoid this problem would be to ensure that the "to" field in the message object matches the username of the authenticated user.

Overview

Type

Cisco AnyConnect Secure Mobility Client

First reported 8 years ago

2017-02-09 17:59:00

Last updated 5 years ago

2019-10-03 00:03:00

Affected Software

Cisco AnyConnect Secure Mobility Client 4.0.00052

4.0.00052

Cisco AnyConnect Secure Mobility Client 4.0.00057

4.0.00057

Cisco AnyConnect Secure Mobility Client 4.0.00061

4.0.00061

Cisco AnyConnect Secure Mobility Client 4.1.00028

4.1.00028

Cisco AnyConnect Secure Mobility Client 4.1.02011

4.1.02011

Cisco AnyConnect Secure Mobility Client 4.1.04011

4.1.04011

Cisco AnyConnect Secure Mobility Client 4.1.06013

4.1.06013

Cisco AnyConnect Secure Mobility Client 4.1.06020

4.1.06020

Cisco AnyConnect Secure Mobility Client 4.1.08005

4.1.08005

Cisco AnyConnect Secure Mobility Client 4.2.00096

4.2.00096

Cisco AnyConnect Secure Mobility Client 4.2.01022

4.2.01022

Cisco AnyConnect Secure Mobility Client 4.2.01035

4.2.01035

Cisco AnyConnect Secure Mobility Client 4.2.02075

4.2.02075

Cisco AnyConnect Secure Mobility Client 4.2.03013

4.2.03013

Cisco AnyConnect Secure Mobility Client 4.2.04018

4.2.04018

Cisco AnyConnect Secure Mobility Client 4.2.04039

4.2.04039

Cisco AnyConnect Secure Mobility Client 4.2.05015

4.2.05015

Cisco AnyConnect Secure Mobility Client 4.2.06014

4.2.06014

Cisco AnyConnect Secure Mobility Client 4.3.00748

4.3.00748

Cisco AnyConnect Secure Mobility Client 4.3.01095

4.3.01095

Cisco AnyConnect Secure Mobility Client 4.3.02039

4.3.02039

Cisco AnyConnect Secure Mobility Client 4.3.03086

4.3.03086

Cisco AnyConnect Secure Mobility Client 4.3.04027

4.3.04027

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.