QID 38854

Date Published: 2021-12-06

QID 38854: Symantec Advanced Secure Gateway (ASG) and ProxySG Authentication Bypass Vulnerability

Symantec ProxySG (SWG) is a proxy or web security gateway hardware/virtual appliance for content filtering, authentication, caching, ICAP relay.
The Symantec Advanced Secure Gateway provides comprehensive protection and control over web traffic to support your security and application performance requirements.

Symantec ProxySG and ASG is prone:
CVE-2021-30648:Authentication Bypass Vulnerability

Affected ASG Versions.
ASG 6.6 and 6.7 prior to 6.7.5.12.
ASG 7.2 prior to 7.2.7.2.
ASG 7.3 prior to 7.3.3.3.

Affected ProxySG Versions.
ProxySG 6.5, 6.6, and 6.7 prior to 6.7.5.12.
ProxySG 7.2 prior to 7.2.7.2.
ProxySG 7.3 prior to 7.3.3.3.

Qid Detection Logic
The QID checks for vulnerable versions of ProxySG and ASG, the version is retrieved via SNMP.

An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as Critical - 9 severity.
    • Solution
    Customers are advised to refer to SYMSA18331 for information pertaining to this vulnerability.Workaround:
    CVE-2021-30648 is exploitable in ASG and ProxySG only if the attacker can send HTTP/HTTPS requests to the web management console. Customers can mitigate this vulnerability using existing network infrastructure, such as network partitioning and firewalls, to restrict access to the web management console to a trusted network.
    CVE-2021-30648 is not exploitable to perform arbitrary code execution. ASG and ProxySG only provide a restricted CLI and not a general operating system shell. The CLI commands an attacker can execute are restricted to the commands provided by the CLI.
    Vendor References

    CVEs related to QID 38854

    CVE-2021-30648 |
    Software Advisories
    Advisory ID Software Component Link
    SYMSA18331 URL Logo support.broadcom.com/security-advisory/content/security-advisories/0/SYMSA18331
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].