CERT-In Advisory
CIAD-2009-0057
Clientless Browser-Based VPN Same Origin Bypass Vulnerability
Original Issue Date: December 10, 2009
Severity Rating: High
Systems Affected
- Multiple vendors clientless web-based VPN solutions
Overview
A vulnerability has been reported in clientless web-based VPN solutions that could allow an attacker to bypass authentication or conduct other web-based attacks.
Description
Clientless SSL VPNs provide browser-based access to internal and external resources without the need to install a traditional VPN client. To connect to a VPN, a web browser is used to authenticate to the web VPN, then the web VPN retrieves and presents the content from the requested pages.
The vulnerability exists in the implementation of web-based VPN solutions. Many clientless SSL VPN products retrieve content from different sites, then present that content as coming from the SSL VPN, effectively circumventing browser same origin restrictions.
A remote attacker can create specially crafted web page and will be able to access the target user's cookies including authentication cookies if any, associated with the VPN or with arbitrary sites accessed via the VPN. The attacker could exploit this vulnerability to bypass domain-based content restrictions and same-origin policy to obtain VPN session tokens and read or modify content including cookies, script, or HTML content from any site accessed through the clientless SSL VPN.
Workaround
- Limit URL rewriting to trusted domains
- Limit VPN server network connectivity to trusted domains
- Disable URL hiding features
For more details refer US-CERT Vulnerability note
Vendor Information
Sonicwall
http://www.sonicwall.com/us/2123_14882.html
CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=19500
References
US-CERT
http://www.kb.cert.org/vuls/id/261869
Xforce
http://xforce.iss.net/xforce/xfdb/54523 20
SecurityTracker
http://securitytracker.com/alerts/2009/Dec/1023255.html
Security Focus
http://www.securityfocus.com/bid/37152
CVE Name
CVE-2009-2631
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|