CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.

CVE-2024-20353 is a denial-of-service flaw in the management and VPN web servers of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software, caused by incomplete error checking when parsing an HTTP header (tracked as CWE-835, a loop-exit defect). An unauthenticated, remote attacker can trigger it by sending a crafted HTTP request to the device's web server, causing the firewall/VPN appliance to reload unexpectedly. A successful exploit yields no data theft from the flaw itself but takes the device offline, and repeated requests can sustain an outage of the edge firewall and VPN service. Any organization running ASA or FTD with these web servers reachable by attackers is exposed, which includes nearly every internet-facing Cisco edge deployment. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-04-24, is referenced in a public Cisco Talos writeup on the ArcaneDoor campaign, where suspected state-sponsored (China-linked) actors chained it with CVE-2024-20359 to backdoor ASA perimeter devices, and EPSS assigns it a 70.7% probability of exploitation within 30 days (99th percentile).

Do: Upgrade ASA and FTD to the fixed releases listed in Cisco's security advisory (version ranges not included in this data), and because attackers in the ArcaneDoor campaign may have persisted on devices via the related CVE-2024-20359 backdoor, check for unexpected configuration changes or persistence before and after patching. Restrict exposure of the ASA/FTD management and VPN web servers to trusted source addresses while remediation is pending. Per CISA's KEV required action, apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

CrushFTP contains a server-side template injection flaw (CWE-94, CWE-1336) that allows unauthenticated remote attackers to escape the Virtual File System (VFS) sandbox. The flaw is triggered by unauthenticated network requests to any CrushFTP server running versions before 10.7.1 or 11.1.0 on any platform. Successful exploitation lets an attacker read files from the filesystem outside the VFS sandbox, bypass authentication to gain administrative access, and execute arbitrary code on the server. All CrushFTP deployments on prior versions are affected, especially internet-exposed file transfer servers. The vulnerability is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-04-24, EPSS puts 30-day exploitation probability at 99.5%, and public scans have identified at least 1,400 vulnerable exposed servers.

Do: Upgrade immediately to CrushFTP 10.7.1 (10.x line) or 11.1.0 (11.x line) or later, as the vendor has urged, or apply the vendor's documented mitigations if patching is delayed. Prioritize internet-facing instances, and check them for signs of compromise such as unauthorized administrative access or unexpected file reads. Public proof-of-concept code exists, so assume unpatched exposed servers will be exploited.