CVE-2020-3153

Related Files

Cisco AnyConnect Privilege Escalation

Posted Sep 30, 2020

Authored by Yorick Koster, Christophe de la Fuente, Antoine Goichot | Site metasploit.com

The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to 4.8.02042 is vulnerable to path traversal and allows local attackers to create/overwrite files in arbitrary locations with system level privileges. The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to 4.9.00086 is vulnerable to a DLL hijacking and allows local attackers to execute code on the affected machine with with system level privileges. Both attacks consist in sending a specially crafted IPC request to the TCP port 62522 on the loopback device, which is exposed by the Cisco AnyConnect Secure Mobility Agent service.

tags | exploit, arbitrary, local, tcp

systems | cisco, windows

advisories | CVE-2020-3153, CVE-2020-3433

SHA-256 | 74ae12d312c6c46fa9f122b2a106d803de515d0b707dfe34720c066dd56a2680

Download | Favorite | View

Cisco AnyConnect Path Traversal / Privilege Escalation

Posted Jun 25, 2020

Authored by Yorick Koster, Christophe de la Fuente, Antoine Goichot | Site metasploit.com

The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to version 4.8.02042 is vulnerable to path traversal and allows local attackers to create/overwrite files in arbitrary locations with system level privileges. The attack consists in sending a specially crafted IPC request to the TCP port 62522 on the loopback device, which is exposed by the Cisco AnyConnect Secure Mobility Agent service. This service will then launch the vulnerable installer component (vpndownloader), which copies itself to an arbitrary location before being executed with system privileges. Since vpndownloader is also vulnerable to DLL hijacking, a specially crafted DLL (dbghelp.dll) is created at the same location vpndownloader will be copied to get code execution with system privileges. This exploit has been successfully tested against Cisco AnyConnect Secure Mobility Client versions 4.5.04029, 4.5.05030 and 4.7.04056 on Windows 10 version 1909 (x64) and Windows 7 SP1 (x86).

tags | exploit, arbitrary, x86, local, tcp, code execution

systems | cisco, windows

advisories | CVE-2020-3153

SHA-256 | b6d44c2b494378ff342fef57be9d4be4564327103eadabb01ff166ae6dae9bff

Download | Favorite | View

Cisco AnyConnect Secure Mobility Client 4.8.01090 Privilege Escalation

Posted Apr 21, 2020

Authored by Yorick Koster, Securify B.V.

Cisco AnyConnect Secure Mobility Client for Windows version 4.8.01090 suffer from a privilege escalation vulnerability due to insecure handling of path names.

tags | exploit

systems | cisco, windows

advisories | CVE-2020-3153

SHA-256 | 8ee614424eee5c4644b331ca89e2c2afc6470c9c8941cb5e0f7d3280686ef76c

Download | Favorite | View