CVE-2023-20269 - Incorrect Authorization

Severity

90%

Complexity

39%

Confidentiality

86%

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.

CVSS 3.1 Base Score 9.1. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Demo Examples

Incorrect Authorization

CWE-863

The following code could be for a medical records application. It displays a record to already authenticated users, confirming the user's authorization using a value stored in a cookie.


               
}
}
setcookie("role", $role, time()+60*60*2);
die("\n");
DisplayMedicalHistory($_POST['patient_ID']);
die("You are not Authorized to view this record\n");

The programmer expects that the cookie will only be set when getRole() succeeds. The programmer even diligently specifies a 2-hour expiration for the cookie. However, the attacker can easily set the "role" cookie to the value "Reader". As a result, the $role variable is "Reader", and getRole() is never invoked. The attacker has bypassed the authorization system.

Overview

Type

Cisco Firepower Threat Defense

First reported 1 year ago

2023-09-06 18:15:00

Last updated 1 year ago

2023-09-14 16:10:00

Affected Software

Cisco Firepower Threat Defense 6.2.3

6.2.3

Cisco Firepower Threat Defense (FTD) 6.2.3.1

6.2.3.1

Cisco Firepower Threat Defense (FTD) 6.4.0

6.4.0

Cisco Firepower Threat Defense 6.2.3.13

6.2.3.13

Cisco Firepower Threat Defense (FTD) 6.2.3.14

6.2.3.14

Cisco Firepower Threat Defense (FTD) 6.2.3.15

6.2.3.15

Cisco Firepower Threat Defense 6.2.3.12

6.2.3.12

Cisco Firepower Threat Defense 6.6.0

6.6.0

Cisco Firepower Threat Defense 6.2.3.2

6.2.3.2

Cisco Firepower Threat Defense 6.2.3.3

6.2.3.3

Cisco Firepower Threat Defense 6.2.3.4

6.2.3.4

Cisco Firepower Threat Defense 6.2.3.5

6.2.3.5

Cisco Firepower Threat Defense 6.2.3.6

6.2.3.6

Cisco Firepower Threat Defense 6.2.3.7

6.2.3.7

Cisco Firepower Threat Defense 6.2.3.10

6.2.3.10

Cisco Firepower Threat Defense 6.2.3.11

6.2.3.11

Cisco Firepower Threat Defense 6.2.3.9

6.2.3.9

Cisco Firepower Threat Defense (FTD) 6.2.3.16

6.2.3.16

Cisco Firepower Threat Defense (FTD) 6.4.0.1

6.4.0.1

Cisco Firepower Threat Defense 6.4.0.3

6.4.0.3

Cisco Firepower Threat Defense (FTD) 6.4.0.2

6.4.0.2

Cisco Firepower Threat Defense (FTD) 6.4.0.4

6.4.0.4

Cisco Firepower Threat Defense (FTD) 6.4.0.5

6.4.0.5

Cisco Firepower Threat Defense (FTD) 6.4.0.6

6.4.0.6

Cisco Firepower Threat Defense (FTD) 6.4.0.7

6.4.0.7

Cisco Firepower Threat Defense (FTD) 6.4.0.8

6.4.0.8

Cisco Firepower Threat Defense 6.4.0.9

6.4.0.9

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.