CVE-2023-28807: Bypass of ZIA domain fronting detection module through evasion technique
In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28807?
CVE-2023-28807 is classified as a high severity vulnerability due to its potential to allow attackers to evade security controls.
How do I fix CVE-2023-28807?
To remediate CVE-2023-28807, ensure that you are using a version of Zscaler Internet Access above 6.2r.290 and properly configure the Connect Host and SNI settings.
What impact does CVE-2023-28807 have on an organization?
CVE-2023-28807 can lead to unauthorized access and data exfiltration by hiding malicious traffic within legitimate communications.
Which software versions are affected by CVE-2023-28807?
CVE-2023-28807 affects Zscaler Secure Internet and SaaS Access versions up to but not including 6.2r.290.
How can I identify exploitation of CVE-2023-28807 in my network?
Monitor your network traffic for unusual patterns that suggest legitimate traffic is being used to conceal malicious activities related to CVE-2023-28807.