Cisco Secure Client up to 5.1.1.42 SAML Authentication crlf injection

Summaryinfo

A vulnerability categorized as critical has been discovered in Cisco Secure Client. The impacted element is an unknown function of the component SAML Authentication. The manipulation results in crlf injection. This vulnerability is known as CVE-2024-20337. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Secure Client. Affected is an unknown functionality of the component SAML Authentication. The manipulation with an unknown input leads to a crlf injection vulnerability. CWE is classifying the issue as CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.

The weakness was published 03/06/2024 as cisco-sa-secure-client-crlf-W43V4G7. The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is traded as CVE-2024-20337 since 11/08/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/22/2025).

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Secure Client

Version

• 4.9.00086
• 4.9.01095
• 4.9.02028
• 4.9.03047
• 4.9.03049
• 4.9.04043
• 4.9.04053
• 4.9.05042
• 4.9.06037
• 4.10.00093
• 4.10.01075
• 4.10.02086
• 4.10.03104
• 4.10.04065
• 4.10.04071
• 4.10.05085
• 4.10.05095
• 4.10.05111
• 4.10.06079
• 4.10.06090
• 4.10.07061
• 4.10.07062
• 4.10.07073
• 5.0.00238
• 5.0.00529
• 5.0.00556
• 5.0.01242
• 5.0.02075
• 5.0.03072
• 5.0.03076
• 5.0.04032
• 5.0.05040
• 5.1.0.136
• 5.1.1.42

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion