Clientless SSL VPN products break web browser domain-based security models
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Multiple clientless SSL VPN products that run in web browsers, including Stonesoft StoneGate; Cisco ASA; SonicWALL E-Class SSL VPN and SonicWALL SSL VPN; SafeNet SecureWire Access Gateway; Juniper Networks Secure Access; Nortel CallPilot; Citrix Access Gateway; and other products, when running in configurations that do not restrict access to the same domain as the VPN, retrieve the content of remote URLs from one domain and rewrite them so they originate from the VPN's domain, which violates the same origin policy and allows remote attackers to conduct cross-site scripting attacks, read cookies that originated from other domains, access the Web VPN session to gain access to internal resources, perform key logging, and conduct other attacks. NOTE: it could be argued that this is a fundamental design problem in any clientless VPN solution, as opposed to a commonly-introduced error that can be fixed in separate implementations. Therefore a single CVE has been assigned for all products that have this design
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Adaptive Security Appliance Web SSL VPN | all versions | — | No fix listed | CNA |
| Palo Alto | PAN OS Web SSL VPN | all versions | — | No fix listed | CNA |
- Adaptive Security Appliance Web SSL VPN VendorCisco Affected all versions Fixed in — No fix listed CNA
- PAN OS Web SSL VPN VendorPalo Alto Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:aladdin:safenet_securewire_access_gateway:*:*:*:*:*:*:*:* | all versions | Vulnerable | Aladdin |
| cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* | all versions | Vulnerable | Cisco |
| cpe:2.3:h:sonicwall:e-class_ssl_vpn:*:*:*:*:*:*:*:* | all versions | Vulnerable | SonicWall |
| cpe:2.3:h:sonicwall:ssl_vpn:*:*:*:*:*:*:*:* | all versions | Vulnerable | SonicWall |
| cpe:2.3:h:stonesoft:stonegate:*:*:*:*:*:*:*:* | all versions | Vulnerable | Stonesoft |
- cpe:2.3:h:aladdin:safenet_securewire_access_gateway:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Aladdin
- cpe:2.3:h:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Cisco
- cpe:2.3:h:sonicwall:e-class_ssl_vpn:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SonicWall
- cpe:2.3:h:sonicwall:ssl_vpn:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·SonicWall
- cpe:2.3:h:stonesoft:stonegate:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Stonesoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2631
- 2026-10-03 Alias added: GHSA-jvhh-4rp5-cfmm
References
Advisory 8
- http://www.sonicwall.com/us/2123_14882.html
- http://www.sonicwall.com/us/2123_14883.html
- http://www.stonesoft.com/en/support/security_advisories/2009_03_12.html
- http://www.vupen.com/english/advisories/2009/3567
- http://www.vupen.com/english/advisories/2009/3568
- http://www.vupen.com/english/advisories/2009/3569
- http://www.vupen.com/english/advisories/2009/3570
- http://www.vupen.com/english/advisories/2009/3571
More Cisco Adaptive Security Appliance vulnerabilities
- TI-2020-02861 Uncontrolled resource consumption in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
- TI-2021-17312 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability CVSS 3.1HIGH 8.6
- TI-2020-03115 Uncontrolled resource consumption in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
- TI-2020-03075 Uncontrolled resource consumption in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
- TI-2020-02985 Unrestricted file upload in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
- TI-2021-17313 Stack-based buffer overflow in Cisco Adaptive Security Appliance Software CVSS 3.1HIGH 8.6
Sources
- CVE-2009-2631 · CVE Program
- CVE-2009-2631 · NVD
- FIRST EPSS
- GHSA-jvhh-4rp5-cfmm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences