Bypass of ZIA domain fronting detection module through evasion technique

CVE-2023-28807

What is CVE-2023-28807?

In Zscaler Internet Access (ZIA), a vulnerability arises due to a mismatch between the Connect Host and the Server Name Indication (SNI) in Client Hello messages. This discrepancy can be exploited by attackers to bypass network security measures, effectively concealing their malicious communications within what appears to be legitimate traffic. As a result, the integrity of network security controls is compromised, posing significant risks to organizations relying on the platform for web traffic protection. Organizations are advised to implement mitigation strategies to safeguard against this vulnerability and ensure robust security protocols.

References