cisco-sa-uswg-fdbps-xtTRKpp6: Cisco Umbrella Secure Web Gateway File Decryption Bypass Vulnerability
First published: Wed Apr 20 2022(Updated: )
A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SSL decryption and content filtering policies on an affected system. This vulnerability is due to how the decryption function uses the TLS Sever Name Indication (SNI) extension of an HTTPS request to discover the destination domain and determine if the request needs to be decrypted. An attacker could exploit this vulnerability by sending a crafted request over TLS from a client to an unknown or controlled URL. A successful exploit could allow an attacker to bypass the decryption process of Cisco Umbrella SWG and allow malicious content to be downloaded to a host on a protected network. There are workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uswg-fdbps-xtTRKpp6
Credit: the security researchers Alexandre Samuel AxiansDamien Foulde Axians
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Umbrella |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-uswg-fdbps-xtTRKpp6?
The cisco-sa-uswg-fdbps-xtTRKpp6 vulnerability is considered to have a high severity due to the potential for an attacker to bypass SSL decryption and content filtering.
How do I fix cisco-sa-uswg-fdbps-xtTRKpp6?
To mitigate the cisco-sa-uswg-fdbps-xtTRKpp6 vulnerability, ensure you apply the latest patches and updates from Cisco for the Umbrella Secure Web Gateway.
Who is affected by cisco-sa-uswg-fdbps-xtTRKpp6?
Organizations using the Cisco Umbrella Secure Web Gateway are affected by the cisco-sa-uswg-fdbps-xtTRKpp6 vulnerability.
What can an attacker do with cisco-sa-uswg-fdbps-xtTRKpp6?
An authenticated adjacent attacker can exploit cisco-sa-uswg-fdbps-xtTRKpp6 to bypass SSL decryption and content filtering policies.
Is authentication required to exploit cisco-sa-uswg-fdbps-xtTRKpp6?
Yes, an authenticated user must be present for the exploitation of the cisco-sa-uswg-fdbps-xtTRKpp6 vulnerability.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/remedy
- agent/references
- agent/title
- agent/weakness
- agent/author
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco umbrella