CVE-2009-2119

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the login interface (my.logon.php3) of F5 FirePass SSL VPN versions 5.5 through 5.5.2 and 6.0 through 6.0.3. The vulnerability allows remote attackers to inject arbitrary web script or HTML via a base64-encoded value in the xcho parameter.

Exploitation

An attacker can craft a malicious URL containing a base64-encoded payload in the xcho parameter. When a victim visits the login page with this crafted parameter, the injected script executes in the context of the victim's browser. No authentication is required to trigger the vulnerability.

Impact

Successful exploitation allows an attacker to execute arbitrary web script or HTML in the context of the victim's browser session. This can lead to session hijacking, credential theft, or other malicious actions within the FirePass SSL VPN interface.

Mitigation

No fix or workaround is disclosed in the available references. Users are advised to restrict access to the login interface or apply web application firewall rules to filter malicious input.