Cisco Secure Firewall ASA and FTD Software VPN Web Services Client-Side Request Smuggling Vulnerability

A request smuggling vulnerability has been identified in the VPN web services component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. The issue arises from improper validation of HTTP requests, which an attacker could exploit by persuading a user to visit a malicious website that sends harmful HTTP requests to the device. A successful exploit could enable the attacker to reflect malicious input from the device to the user's browser, facilitating browser-based attacks such as cross-site scripting (XSS). However, the attacker cannot directly impact the affected device.

Impact

Exploitation of this vulnerability could lead to browser-based attacks, including cross-site scripting (XSS)

Remediation

Cisco has released software updates to address this vulnerability. For instructions on upgrading Cisco Secure FTD devices, refer to the Cisco Secure FMC upgrade guide. To determine the best release to upgrade to, consult the Cisco Secure Firewall Threat Defense Compatibility Guide.