Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path
CVE-2020-3153 is a medium-severity uncontrolled search path element vulnerability in Cisco AnyConnect Secure Mobility Client from Cisco, with a CVSS 3.1 base score of 6.5 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. CISA added it to the Known Exploited Vulnerabilities catalogue on October 24, 2022, which means attacks have been observed in the wild, including in ransomware campaigns.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update Anyconnect Secure Mobility Client to 4.8.02042 or a later version.
- CISA's required action: Apply updates per vendor instructions.
- Read the advisory on tools.cisco.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Cisco | Cisco AnyConnect Secure Mobility Client | Not specified in the record | Not stated |
| Cisco | Anyconnect Secure Mobility Client | before 4.8.02042 | 4.8.02042 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- HighData or code can be modified at will.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 6.5 | Medium | NVD |
| CVSS 3.0 | 6.5 | Medium | CNA (cisco.com) |
| CVSS 2.0 | 4.9 | Medium | NVD |
Official description
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
How developers prevent this class of flaw
- Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
- When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
- Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
More Uncontrolled Search Path Element vulnerabilities (CWE-427)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Advisories
Third-party and government advisories
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3153US Government Resource
Technical write-ups (may include proof of concept)
- packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.h…Exploit, Third Party Advisory, VDB Entry
- packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- seclists.org/fulldisclosure/2020/Apr/43Exploit, Mailing List, Third Party Advisory
Other vulnerabilities in Cisco AnyConnect Secure Mobility Client
- 7.8 High severity
Spotted an error? Tell us.