SAML 2.0 Single Sign-On Vulnerability in Cisco Adaptive Security Appliance and Firepower Threat Defense Software

CVE-2023-20264

Summary

A security vulnerability exists in the SAML 2.0 single sign-on implementation for remote access VPN connections in Cisco Adaptive Security Appliance and Firepower Threat Defense Software. This issue arises from inadequate validation of the login URL, allowing an unauthenticated remote attacker to exploit the weakness. By tricking a user into visiting a maliciously controlled site, the attacker can manipulate the login URL, enabling them to intercept the SAML assertion during the authentication process. If successful, the attacker gains the ability to establish a remote access VPN session using the hijacked user's identity and permissions, potentially compromising the security of the protected network.

References