Cisco ASA URL Redirection to Untrusted Site (CVE-2023-20264)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506160);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id("CVE-2023-20264");

  script_name(english:"Cisco ASA URL Redirection to Untrusted Site (CVE-2023-20264)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the implementation of Security Assertion Markup
Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in
Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower
Threat Defense (FTD) Software could allow an unauthenticated, remote
attacker to intercept the SAML assertion of a user who is
authenticating to a remote access VPN session. This vulnerability is
due to insufficient validation of the login URL. An attacker could
exploit this vulnerability by persuading a user to access a site that
is under the control of the attacker, allowing the attacker to modify
the login URL. A successful exploit could allow the attacker to
intercept a successful SAML assertion and use that assertion to
establish a remote access VPN session toward the affected device with
the identity and permissions of the hijacked user, resulting in access
to the protected network.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-saml-hijack-ttuQfyz
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?113333c9");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-20264");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(601);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/11/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/11/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:adaptive_security_appliance_software:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:adaptive_security_appliance_software:9.18.1" :
        {"versionEndIncluding" : "9.18.3.46", "versionStartIncluding" : "9.18.1", "family" : "CiscoFirepower"},
    "cpe:/o:cisco:adaptive_security_appliance_software:9.19.1.5" :
        {"versionEndIncluding" : "9.19.1.12", "versionStartIncluding" : "9.19.1.5", "family" : "CiscoFirepower"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);