思科ASA和FTD软件中SAML 2.0 SSO实施存在漏洞，可能使远程攻击者利用有效凭据建立未授权的VPN会话，思科已发布软件更新解决，该漏洞安全影响评级为中。

🦘思科Adaptive Security Appliance（ASA）软件和Cisco Firepower Threat Defense（FTD）软件中，SAML 2.0单点登录（SSO）在远程访问VPN服务的实现上存在漏洞。此漏洞是由于使用SAML认证时授权域分离不当所致。若被攻击者利用，他们可使用有效凭据，通过指定连接配置文件进行认证，拦截SAML SSO令牌并提交给其他隧道组以实现未授权的VPN会话建立。

🚀成功利用此漏洞，攻击者能使用未授权的连接配置文件建立远程访问VPN会话，连接到本无权访问的受影响设备后的安全网络。但攻击者必须拥有有效的远程访问VPN用户凭据。

💻思科已发布软件更新来解决这一漏洞，目前没有其他解决此漏洞的方法。该漏洞相关的咨询可在特定链接查看，此咨询是思科2024年5月发布的一部分，完整的咨询及链接可在另一处查看。

A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to successfully establish a VPN session on an affected device.

This vulnerability is due to improper separation of authorization domains when using SAML authentication. An attacker could exploit this vulnerability by using valid credentials to successfully authenticate using their designated connection profile (tunnel group), intercepting the SAML SSO token that is sent back from the Cisco ASA device, and then submitting the same SAML SSO token to a different tunnel group for authentication. A successful exploit could allow the attacker to establish a remote access VPN session using a connection profile that they are not authorized to use and connect to secured networks behind the affected device that they are not authorized to access. For successful exploitation, the attacker must have valid remote access VPN user credentials.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-saml-bypass-KkNvXyKW

This advisory is part of the May 2024 release of the Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication.

Security Impact Rating: Medium
CVE: CVE-2024-20355