Clientless SSL VPN products vulnerable, says US-CERT

Share this article:
US-CERT this week warned of a vulnerability that impacts a host of clientless SSL VPN products and could lead to bypassed authentication and other internet attacks.

Clientless SSL products provide web-based access to intranet sites, internal file shares and remote desktops, without needing to install a traditional VPN client.

Many of these products operate in a way that bypasses fundamental web browser domain-based security mechanisms, US-CERT said. Products from Cisco, Citrix, McAfee, Intel and a number of other vendors are affected.

The security mechanism that is bypassed is the same-origin policy, which is enforced by web browsers to prevent active content, such as JavaScript, hosted on one site from accessing or modifying data on a different site. Many clientless VPN products retrieve content from different sites and then present that content as coming from the SSL VPN, circumventing the same-origin restrictions.

Because of the vulnerability, an attacker could create a malicious page that, when viewed through the clientless VPN, be used to hijack a user's session or capture keystrokes.

Through a specially crafted web page, an attacker could retrieve all cookies set by sites requested through the clientless VPN and then use those cookies to “hijack the user's VPN session and all other sessions accessed through the web (clientless) VPN that rely on cookies for session identification,” the US-CERT said. Also, an attacker could construct a page with a hidden frame that could log a user's keystrokes.

“There is no solution to this problem,” the US-CERT said in its advisory. “Depending on their specific configuration and location in the network, these devices may be impossible to operate securely.”

The US-CERT offered a number of workarounds, such as limiting URL rewriting or VPN server network connectivity to only trusted domains, or disabling URL hiding features.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.