CVE-2021-1237

A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL injection attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system which, in turn, causes a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges.

Recent assessments:

gwillcox-r7 at January 29, 2021 10:43pm UTC reported:

Interesting vulnerability :) On Windows systems running Cisco AnyConnect Secure Mobility Client for Windows releases earlier than Release 4.9.04043, authenticated attackers could modify a configuration file that was loaded and used when Cisco AnyConnect starts up to load an arbitrary DLL and have it be run as the SYSTEM user. The advisory at <https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-injec-pQnryXLf&gt; does not specify which file this is, however I imagine it would be possible to find it by using ProcMon, applying the appropriate filters, and then restarting the Cisco AnyConnect process and looking for any attempts to load a configuration file. From there it would then just be a case of figuring out the configuration file format.

Unfortunately without knowing the configuration file format, its a little hard to say how tough this vulnerability is to exploit. Given that you can load an arbitrary DLL file though I imagine the file format must not be too stringent, as otherwise such behavior would be blocked, but this says nothing as to whether the file is a binary format, a text format, or something else or if there are many fields that need to be filled in for the exploit to succeed or just a few.

Given this I’m giving this exploitability rating a 3/5 to play on the safe side of things. Its probably possible but without further info its possible it may take some effort to form a valid configuration file which could make exploitation of this vulnerability considerably more difficult.

Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 3