An authenticated, local attacker may be able to cause a targeted AnyConnect user to execute a malicious script if a vulnerability known as CVE-2020-3556 in the InterProcess Communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software is exploited. This vulnerability was discovered and disclosed by the California-based technology giant Cisco via advisory CVE-2020-3556. The advisory can be found here. Through the IPC channel of the Cisco AnyConnect Secure Mobility Client Software, an authorized adversary may have the ability to coerce an AnyConnect user into executing malicious scripts without his awareness. The vulnerability exists because there is not currently any authentication being performed on the IPC listener. An adversary might exploit this vulnerability by delivering specially designed IPC messages to the AnyConnect client IPC listener. By doing so, the adversary could force the user who is being targeted to run a script. This script would run with the privileges of the AnyConnect user that was the victim of the attack.
At the time of the attack, the user who is going to be targeted has to have an active session of AnyConnect open in order for this vulnerability to be exploited effectively. In order for an attacker to take advantage of this vulnerability, they would also need to possess valid user credentials on the computer that is being used to execute the AnyConnect client.
All versions of the Cisco AnyConnect Secure Mobility Client Software that have a vulnerable configuration and are running on any of the following systems are susceptible to the vulnerability.
- Cisco AnyConnect Secure Mobility Client for Linux
- Cisco AnyConnect Secure Mobility Client for MacOS
- Cisco Secure Client-AnyConnect for Android
- Cisco Secure Client AnyConnect VPN for iOS
- Cisco Secure Client for Linux
- Cisco Secure Client for MacOS
Cisco has not yet provided any software updates to combat this vulnerability, and the company has said that there are no solutions to address CVE-2020-3556. Nevertheless, the risk may be reduced by turning off the Auto Update function, which is one of the features that is affected by the vulnerability.
In the event that the Auto-update function is unable to be turned off, eliminating the Enable Scripting configuration parameter would decrease the surface area that may be exploited by an attacker. Both Auto Update and Enable Scripting are turned off by default. Auto Update is the default setting. Cisco has plans to address and remedy this issue in a future version of Cisco AnyConnect Secure Mobility Client Software. In the near future, the company will provide free software updates to address and fix this vulnerability. Customers will be able to download and install these updates for the versions of Cisco AnyConnect Secure Mobility Client Software that they are now using.
Information security specialist, currently working as risk infrastructure specialist & investigator.
15 years of experience in risk and control process, security audit support, business continuity design and support, workgroup management and information security standards.