Attacker Value
Moderate
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
1

CVE-2021-1237

Disclosure Date: January 13, 2021
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Privilege Escalation
Techniques
Validation
Validated

Description

A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL injection attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system which, in turn, causes a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges.

Add Assessment

3
Ratings
Technical Analysis

Interesting vulnerability :) On Windows systems running Cisco AnyConnect Secure Mobility Client for Windows releases earlier than Release 4.9.04043, authenticated attackers could modify a configuration file that was loaded and used when Cisco AnyConnect starts up to load an arbitrary DLL and have it be run as the SYSTEM user. The advisory at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-injec-pQnryXLf does not specify which file this is, however I imagine it would be possible to find it by using ProcMon, applying the appropriate filters, and then restarting the Cisco AnyConnect process and looking for any attempts to load a configuration file. From there it would then just be a case of figuring out the configuration file format.

Unfortunately without knowing the configuration file format, its a little hard to say how tough this vulnerability is to exploit. Given that you can load an arbitrary DLL file though I imagine the file format must not be too stringent, as otherwise such behavior would be blocked, but this says nothing as to whether the file is a binary format, a text format, or something else or if there are many fields that need to be filled in for the exploit to succeed or just a few.

Given this I’m giving this exploitability rating a 3/5 to play on the safe side of things. Its probably possible but without further info its possible it may take some effort to form a valid configuration file which could make exploitation of this vulnerability considerably more difficult.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • Cisco

Products

  • Cisco AnyConnect Secure Mobility Client

Additional Info

Technical Analysis