Cisco Secure Desktop Remote Cross-Site Scripting Vulnerability

Cisco Secure Desktop contains a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks.

The vulnerability is due to a lack of input sanitation in the Cisco Secure Desktop. An unauthenticated, remote attacker could exploit this vulnerability by convincing a targeted user to visit a malicious website that is designed to submit an HTTP POST request to the web interface of the affected product. If the targeted user visits the malicious page, the attacker could execute arbitrary script code in the browser of the user in the security context of the affected site.

Proof-of-concept code is publicly available.

Cisco has confirmed this vulnerability and released updated software.

To exploit this vulnerability, an attacker must convince a targeted user to visit a malicious website. Performing an exploit will likely require the attacker to use social engineering tactics, such as sending targeted users a link to the site via e-mail, instant messaging, or another form of communication.

Cisco would like to thank Matias Pablo Brutti and Ernesto Alvarez from Core Security Technologies for discovering this vulnerability.

Because of changes made in Cisco Secure Desktop 3.5, Cisco ASA with an older version of ASA firmware but with Cisco Secure Desktop 3.5 or later will not be affected by this vulnerability.

The problem is fixed for Cisco ASA firmware version
8.0(5) and later.