Cisco has released patches to handle a higher- intensity security flaw impacting its Secure Client software that could be exploited by a threat actor to start a VPN session with that of a qualified user.
The networking equipment company described the vulnerability, tracked as CVE- 2024- 20337 ( CVSS score: 8.2 ), as allowing an unauthenticated, remote attacker to conduct a carriage return line feed ( CRLF ) injection attack against a user.
Arising as a result of inadequate confirmation of user- supplied input, a threat actor had leverage the flaw to trap a user into clicking on a particularly crafted link while establishing a VPN session.
” A effective exploit may allow the attacker to execute random script code in the browser or access delicate, browser- based information, including a legitimate SAML token”, the company said in an expert.
” The attacker could then use the gift to build a remote access VPN program with the permissions of the affected person. Personal hosts and companies behind the VPN headend would still need further qualifications for successful entry”.
The risk impacts Safe Client for Windows, Linux, and mac, and has been addressed in the following variations-
- Earlier than 4.10.04065 ( not vulnerable )
- 4.10.04065 and later ( fixed in 4.10.08025 )
- 5.0 ( migrate to a fixed release )
- 5.1 ( fixed in 5.1.2.42 )
Google security researcher Paulos Yibelo Mesfin has been credited with discovering and reporting the weakness, telling The Hacker News that the weakness allows attackers to get local internal networks when a specific visits a site under their control.
Cisco has even published fixes for CVE- 2024- 20338 ( CVSS score: 7.3 ), another higher- severity flaw in Secure Client for Linux that may permit an authenticated, native attacker to promote privileges on an afflicted device. It has been resolved in type 5.1.2.42.
” An attacker could exploit this risk by copying a malicious collection file to a specific file in the file and persuading an executive to restart a specific procedure”, it said. ” A effective abuse may allow the attacker to execute arbitrary code on an affected system with core privileges”.