CVE-2020-3452 flaw in Cisco ASA/FTD exploited within hours after the disclosure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-3452 | Read-Only Path Traversal in Cisco ASA and Firepower Threat Defense (FTD) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation flaw (CWE-20) in how HTTP requests process URLs. An attacker triggers it by sending a crafted HTTP request containing directory traversal character sequences to the web services interface of an affected device. A successful exploit is read-only: the attacker can view arbitrary files within the web services file system, potentially leaking sensitive device or configuration content, but cannot modify the device or take full control. Any organization running ASA or FTD software with the web services interface reachable — commonly an internet-facing VPN or web portal — is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with a reported ~100% EPSS probability of exploitation, indicating it is being actively exploited in the wild; ransomware use is unknown. Do: Apply Cisco's fixed software releases for ASA and FTD as directed in the vendor advisory. Until patched, restrict access to the device's web services/WebVPN interface to trusted source addresses or disable web services if not in use. Review device HTTP logs for crafted requests containing directory traversal sequences against the web portal, which would indicate exploitation attempts. | 7.5 | 100% | KEV PoC ×3 |
| masson the order of hundreds of thousands of potentially affected deployments (internet-exposed ASA/FTD devices) |
Full article532 words · extracted from securityaffairs.com · click to collapse
Cisco fixed CVE-2020-3452 high-severity path traversal flaw in its firewalls that can be exploited by remote attackers to obtain sensitive files from the targeted system.
Cisco addressed a high-severity path traversal vulnerability in its firewalls, tracked as CVE-2020-3452, that can be exploited by remote attackers to obtain potentially sensitive files from the targeted system.
Cisco pointed out that that attack only allows accessing files on the web services file system (i.e. WebVPN configuration, bookmarks, web cookies), not ASA or FTD system files or files on the underlying operating system.
The vulnerability impacts the web services interface of Cisco’s Adaptive Security Appliance (ASA) software and Firepower Threat Defense (FTD) software.
The vulnerability can be exploited by an unauthenticated remote attacker by sending an HTTP request with directory traversal character sequences to the targeted device.
The attack is effective only against devices that uses the AnyConnect or WebVPN feature with a certain configuration.
“A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.” reads the advisory published by Cisco.
“The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device.”
The issue is caused by the failure to properly verify inputs.
The CVE-2020-3452 flaw was independently reported to Cisco by Mikhail Klyuchnikov of Positive Technologies and Abdulrahman Nour and Ahmed Aboul-Ela from RedForce.
At the time of the disclosure of the flaw, Cisco revealed it was not aware of any attacks exploiting it. Unfortunately, the first attempts to exploit the vulnerability were observed within hours after the disclosure.
The availability online of PoC exploits for the vulnerability is increasing the risk of attacks on a large scale.
The researcher Aboul-Ela published a PoC exploit on Twitter, while Cognosec researchers published an NMAP script to exploit the flaw.
— Ahmed Aboul-Ela (@aboul3la) July 22, 2020Here is POC of CVE-2020-3452, unauthenticated file read in Cisco ASA & Cisco Firepower.
For example to read "/+CSCOE+/portal_inc.lua" file.
https://<domain>/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../
Happy Hacking! pic.twitter.com/aBA3R7akkC
Cisco has updated its advisory working of the active exploitation of the vulnerability in the wild.
Researchers from Rapid7 scanned the Internet for ASA/FTD devices, it reported the presence of 85,000 units, 398 of which are spread across 17% of the Fortune 500.
“Since it is difficult (if not impossible) to legally fingerprint Cisco ASA/FTD versions remotely, Rapid7 Labs revisited the “uptime” technique described in a 2016 blog post for another Cisco ASA vulnerability, which shows that only about 10% of Cisco ASA/FTD devices have been rebooted since the release of the patch. This is a likely indicator they’ve been patched (only 27 of the 398 detected in Fortune 500 companies appear to have been patched/rebooted):” states Rapid7.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, CVE-2020-3452)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/106313/hacking/cisco-cve-2020-3452-flaw.html