Same Origin Policy Violation in Multiple Clientless SSL VPN Products

CVE-2009-2631

Summary

Various clientless SSL VPN products, when misconfigured, allow attackers to exploit a fundamental design flaw facilitating unauthorized content retrieval from remote URLs. This flaw violates the same-origin policy, potentially allowing cross-site scripting (XSS) attacks, unauthorized access to internal resources, and exploitation of user sessions. Remote attackers can read cookies from different domains, perform keylogging, and engage in a range of malicious actions, posing serious risks to organizational security.

References