Clientless SSL VPN products vulnerable, says US-CERT
US-CERT this week warned of a vulnerability that impacts a host of clientless SSL VPN products and could lead to bypassed authentication and other internet attacks.
Clientless SSL products provide web-based access to intranet sites, internal file shares and remote desktops, without needing to install a traditional VPN client.
Many of these products operate in a way that bypasses fundamental web browser domain-based security mechanisms, US-CERT said. Products from Cisco, Citrix, McAfee, Intel and a number of other vendors are affected.
The security mechanism that is bypassed is the same-origin policy, which is enforced by web browsers to prevent active content, such as JavaScript, hosted on one site from accessing or modifying data on a different site. Many clientless VPN products retrieve content from different sites and then present that content as coming from the SSL VPN, circumventing the same-origin restrictions.