Headline
CVE-2022-20738: Cisco Security Advisory: Cisco Umbrella Secure Web Gateway File Inspection Bypass Vulnerability
A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspection feature. This vulnerability is due to insufficient restrictions in the file inspection feature. An attacker could exploit this vulnerability by downloading a crafted payload through specific methods. A successful exploit could allow the attacker to bypass file inspection protections and download a malicious payload.
There are no workarounds that address this vulnerability. However, the following mitigations can be used to reduce the scope of this vulnerability:
Option 1: Enable file type control using the Web Policy rulesets.
- Choose Policies > Management > Web Policy.
- Click Add or expand an existing ruleset.
- Under Ruleset Settings, for File Type Control, click Edit.
- Select the Executables file type.
- Click Save.
For more information, see Enable File Type Control.
Option 2: Add web security settings to block access to sites that could potentially host malicious content.
- Choose Policies > Policy Components > Security Settings.
- Click Add.
- Choose Web Policies from the This Security List is Applied To drop-down list.
- Select Malware, Command Control Callbacks, Phishing Attacks.
- Click Save.
This new web security setting can now be added as a ruleset to the Web Policy. For more information, see Add a Web Security Setting.
While these mitigations have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.