QID 317400

A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to intercept the SAML assertion of a user who is authenticating to a remote access VPN session.

Affected Products
9.18.3 prior to 9.18.3.53
9.19.1.5 prior to 9.19.1.18
Note: This QID checks for the configuration using command "show running-config tunnel-group" . This command works in only Privileged EXEC mode

QID Detection Logic (Authenticated):
The check matches Cisco ASA OS version retrieved via Unix Auth using version command. and executes the following commands provided in the Cisco Security advisory

A successful exploit could allow the attacker to intercept a successful SAML assertion and use that assertion to establish a remote access VPN session toward the affected device with the identity and permissions of the hijacked user, resulting in access to the protected network.