Summary

• A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature.

  This vulnerability is due to insufficient restrictions in the file inspection feature. An attacker could exploit this vulnerability by downloading a crafted payload through specific methods. A successful exploit could allow the attacker to bypass file inspection protections and download a malicious payload.

  There are no workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swg-fbyps-3z4qT7p

Affected Products

• Vulnerable Products

  This vulnerability affects Cisco Umbrella Secure Web Gateway, which is cloud based.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

Workarounds

• There are no workarounds that address this vulnerability. However, the following mitigations can be used to reduce the scope of this vulnerability:

  Option 1: Enable file type control using the Web Policy rulesets.

  1. Choose Policies > Management > Web Policy.
  2. Click Add or expand an existing ruleset.
  3. Under Ruleset Settings, for File Type Control, click Edit.
  4. Select the Executables file type.
  5. Click Save.

  For more information, see Enable File Type Control. 

  Option 2: Add web security settings to block access to sites that could potentially host malicious content.

  1. Choose Policies > Policy Components > Security Settings.
  2. Click Add.
  3. Choose Web Policies from the This Security List is Applied To drop-down list.
  4. Select Malware, Command Control Callbacks, Phishing Attacks.
  5. Click Save. 

  This new web security setting can now be added as a ruleset to the Web Policy. For more information, see Add a Web Security Setting. 

  While these mitigations have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• Cisco plans to address this vulnerability in Cisco Umbrella Secure Web Gateway, which is cloud based. No user action is required.

  Customers who need additional information are advised to contact Cisco Umbrella Support at umbrella-support@cisco.com or their contracted maintenance providers.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept is available for the vulnerability that is described in this advisory.

  The Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.

Source

• Cisco would like to thank Yosi Magor, security researcher at ThriveDX Labs, for reporting this vulnerability.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-swg-fbyps-3z4qT7p

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	—	Final	2022-FEB-02

  Show Less

---