CVE-2020-3452

What Are Cisco ASA and FTD?

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) are Cisco's flagship firewall and VPN gateway platforms, deployed at the network perimeter of a vast number of enterprises worldwide to control inbound and outbound traffic and terminate VPN connections. Their WebVPN feature — the clientless SSL VPN portal — is, by necessity, directly reachable from the internet, making any vulnerability in its request handling immediately exploitable at internet scale.

Overview

CVE-2020-3452 is a path traversal vulnerability (CWE-20/CWE-22) in how ASA and FTD's WebVPN feature processes URLs. A remote, unauthenticated attacker can send a crafted HTTP request containing directory traversal sequences to read arbitrary files within the device's web services filesystem (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High) — read-only, but including files that can expose session cookies or other sensitive data useful for further compromise.

Technical Details

The vulnerable code path fails to adequately sanitize directory-traversal sequences (such as ../) embedded in URL parameters used by the WebVPN portal, allowing requests crafted with these sequences to escape the intended web-content directory and read other files on the appliance's filesystem — files the web service process has permission to access, potentially including cached credentials or session data tied to the VPN service itself.

Discovery

Fixed by Cisco as part of its routine security advisory process for ASA and FTD.

Exploitation Context

Because ASA and FTD devices are, by design, internet-facing VPN and firewall gateways, mass scanning for vulnerable instances began within days of the July 2020 disclosure — one of the faster weaponization timelines for a Cisco perimeter-device vulnerability, reflecting both the simplicity of the exploitation primitive (a single crafted HTTP request, no authentication) and the value of the devices being targeted.

Remediation

1. Apply Cisco's fixed software release for your ASA or FTD platform immediately.
2. Restrict WebVPN portal exposure where feasible, or place additional monitoring in front of it given its necessary internet-facing role.
3. Rotate VPN session data and any credentials that could have been exposed via path traversal if the device was internet-facing and unpatched during the exposure window.
4. Review web services access logs for requests containing directory-traversal sequences targeting the WebVPN portal, particularly in the days immediately following the July 2020 disclosure.