CVE-2023-28799 – This vulnerability allows an attacker to inject... (How to Fix)

Q: What is the severity of CVE-2023-28799?

CVE-2023-28799 has a CVSS score of 8.2 (HIGH). This vulnerability allows an attacker to inject a malicious domain into a URL parameter during login, causing post-authentication redirection to the attacker's domain with the user's authorization token. This affects Zscaler Client Connector users across multiple platforms who haven't applied the security patches.

📋 TL;DR

This vulnerability allows an attacker to inject a malicious domain into a URL parameter during login, causing post-authentication redirection to the attacker's domain with the user's authorization token. This affects Zscaler Client Connector users across multiple platforms who haven't applied the security patches.

💻 Affected Systems

Products:

Zscaler Client Connector

Versions: Versions before the patched releases listed in vendor advisories

Operating Systems: Linux, Android, Chrome OS, iOS, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: Affects multiple platform versions as detailed in the provided Zscaler release notes. Windows may also be affected but not explicitly listed in provided references.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers steal valid authentication tokens and gain unauthorized access to protected resources, potentially leading to account takeover, data exfiltration, or lateral movement within the network.

🟠

Likely Case

Targeted phishing attacks where users are redirected to malicious sites that capture their authentication tokens, enabling session hijacking.

🟢

If Mitigated

With proper input validation and URL whitelisting, the injection is prevented and tokens remain secure within the intended domain.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires user interaction (login) but the injection itself is straightforward once the vulnerable parameter is identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux: 1.4+ (2022-10-31), Android: 1.10.2+ (2023-03-09), Chrome OS: 1.10.1+ (2023-03-10), iOS: 1.9.3+ (2023-03-03), macOS: 3.9+ (2023-01-25)

Vendor Advisory: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023

Restart Required: Yes

Instructions:

1. Identify your platform and current Zscaler Client Connector version. 2. Visit the Zscaler help portal for your platform. 3. Download and install the patched version listed in the release notes. 4. Restart the application or device as required.

🔧 Temporary Workarounds

Implement URL validation at proxy/WAF

all

Configure web application firewall or proxy to validate and sanitize URL parameters in login requests, blocking redirects to unauthorized domains.

Restrict redirect domains

all

Configure application to only allow redirects to pre-approved, trusted domains within the organization's control.

🧯 If You Can't Patch

Implement network segmentation to limit the impact of token theft
Enable multi-factor authentication to reduce risk from stolen tokens

🔍 How to Verify

Check if Vulnerable:

Check your Zscaler Client Connector version against the patched versions listed in the vendor advisories. If running older versions, you are vulnerable.

Check Version:

Platform dependent: Check application settings or use system commands like 'zscaler --version' on Linux or check About section in mobile apps.

Verify Fix Applied:

After updating, verify the installed version matches or exceeds the patched version for your platform. Test login flows to ensure redirects only go to approved domains.

📡 Detection & Monitoring

Log Indicators:

Unusual redirect URLs in authentication logs
Login attempts with malformed URL parameters containing external domains

Network Indicators:

HTTP 302 redirects to unexpected domains post-authentication
Authentication tokens being sent to non-approved domains

SIEM Query:

source="authentication_logs" AND (url_parameter CONTAINS "http://" OR url_parameter CONTAINS "https://") AND url_parameter NOT CONTAINS "trusted-domain.com"

📊 Metadata

CVE ID: CVE-2023-28799

CVSS v3 Score: 8.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE: CWE-1287

Published: June 22, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-28799, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Client Connector by Zscaler

Client Connector by Zscaler

Client Connector by Zscaler

Client Connector by Zscaler

Client Connector by Zscaler

Client Connector by Zscaler

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Implement URL validation at proxy/WAF

Restrict redirect domains

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities