CVE-2009-1220

Vulnerability

Cross-site scripting (XSS) vulnerability exists in the +webvpn+/index.html page of WebVPN on Cisco Adaptive Security Appliances (ASA) 5520 running software versions 7.2(4)30 and earlier 7.2 versions (including 7.2(2)22), and 8.0(4)28 and earlier 8.0 versions. The vulnerability is present when clientless mode is enabled. The issue allows injection of arbitrary web script or HTML via the Host HTTP header. [1]

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the affected device with a malicious Host header. No authentication is required as the WebVPN interface is accessible remotely. The attacker only needs network access to the ASA's WebVPN service. The malicious script or HTML is then reflected in the response, executing in the context of the victim's browser session.

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the victim's browser, leading to potential information disclosure, session hijacking, or other client-side attacks. The impact is limited to the browser session of the user accessing the WebVPN portal.

Mitigation

No specific fix or patched version is disclosed in the available reference [1]. Given the age of this CVE (2009), affected devices may be end-of-life or require upgrading to a later software version that addresses the issue. Users should consult Cisco's current advisory for any updates.