PT-2024-1828 · Zscaler · Zscaler Internet Access

Published 2024-01-31 · Updated 2024-02-09 · CVE-2023-28807

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Zscaler Internet Access (ZIA) (affected versions not specified)

Description The issue is related to a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) in Zscaler Internet Access (ZIA), which enables attackers to evade network security controls by hiding their communications within legitimate traffic. This can be exploited to perform a man-in-the-middle attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

BDU:2024-01573

CVE-2023-28807

Affected Products

Zscaler Internet Access

References · 9

• https://osv.dev/vulnerability/CVE-2023-28807 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28807 · Security Note
• https://t.me/cvenotify/69469 · Telegram Post
• https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization · Note
• https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting · Note
• https://twitter.com/CVEnew/status/1752774381644763576 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1752809868979777997 · Twitter Post
• https://trust.zscaler.com/zscaler.net/posts/17646 · Note