Cisco ASA Software WebVPN Cross-Site Scripting Vulnerability

Cisco ASA Software versions 8.0.4(28) and prior contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks.

The vulnerability is due to insufficient input validation within the WebVPN clientless mode feature. Attackers could exploit this vulnerability to conduct cross-site scripting attacks, which could result in the execution of arbitrary HTML or scripting code in a user’s browser session within the security context of the site.

Proof of concept code is available to demonstrate this cross-site scripting attack.

Cisco has confirmed the vulnerability and released software updates.

To exploit this vulnerability, the clientless mode of the WebVPN feature must be enabled. An attacker must also be able to inject crafted HTTP headers into a browser, which requires the use of a web application technology such as JavaScript or Flash. These factors reduce the likelihood of an attack.

An exploit may allow the attacker to obtain the WebVPN session cookie and gain unauthorized access to the VPN device.