Cisco ASA and FTD Web Services Interface XSS Enables Script Execution and Browser Information Access

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

Technical details

The defect is insufficient validation of user-supplied input by the device web services interface and is classified as CWE-79. The attack is reachable over the network without attacker authentication, but requires a user of the interface to click a crafted link. On ASA, Cisco identifies AnyConnect Internet Key Exchange Version 2 remote access with client services, AnyConnect SSL VPN, and clientless SSL VPN as vulnerable configurations; on FTD, it identifies AnyConnect Internet Key Exchange Version 2 remote access with client services and AnyConnect SSL VPN. The advisory gives the relevant configuration checks as `crypto ikev2 enable` with `client-services port` and `webvpn` with `enable`, depending on the feature. The available evidence does not establish the exact input field, request parameter, or script delivery details.

Impact

Successful exploitation can execute arbitrary script code in the web services interface context or expose sensitive browser-based information. Because execution occurs in the interface context, the affected user's browser session and accessible data may be abused, with confidentiality and integrity consequences for the interface. The available evidence does not establish device operating-system code execution, administrative privilege escalation, or service availability impact. The actual outcome depends on the privileges and data available in the browser of the user who clicks the crafted link.

Remediation

Upgrade affected ASA installations to the branch-specific first fixed release: 9.8.4.34 for 9.8, 9.9.2.85 for 9.9, 9.12.4.13 for 9.12, 9.13.1.21 for 9.13, 9.14.2.8 for 9.14, and 9.15.1.15 for 9.15. For the ASA branches Cisco marks for migration, move to a supported fixed release rather than remaining on that branch. Upgrade FTD 6.4.0 to 6.4.0.12, FTD 6.6.0 to the recommended 6.6.4, and FTD 6.7.0 to 6.7.0.2; migrate the other listed FTD branches to a supported fixed release. Cisco states that no workaround addresses these vulnerabilities. For FTD managed by FMC or FDM, install the upgrade through the relevant management interface and reapply the access control policy after installation. Confirm memory capacity and configuration support before upgrading, and contact Cisco TAC or the maintenance provider if the branch mapping is unclear.

Detection

Inventory every ASA and FTD device, record its software branch and release, and compare the result with the branch-specific fixed releases. On ASA, inspect `show running-config` for `crypto ikev2 enable` with `client-services port`, and for `webvpn` with `enable`; these settings help identify the AnyConnect IKEv2, AnyConnect SSL VPN, and clientless SSL VPN configurations described by Cisco. On FTD, verify whether AnyConnect remote-access VPN or AnyConnect SSL VPN is enabled through FMC or FDM and record the FTD release. Deploy or review Snort rule 57857, which Cisco documents as detecting initial exploit traffic for this XSS issue. Review web services and browser telemetry for suspicious requests or unexpected script activity as a precaution, but the available evidence does not define a complete IOC set or a log event whose absence proves safety.