CVE-2020-3452
Cisco ASA and FTD Read-Only Path Traversal Vulnerability
Description
CVE-2020-3452 is a HIGH read-only path traversal vulnerability affecting Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software, carrying a CVSS 3.1 score of 7.5. The vulnerability allows an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files within the web services file system on targeted devices configured with WebVPN or AnyConnect features. Affected products include Cisco ASA Software (multiple version ranges from 9.6 through 9.14) and Cisco FTD Software (multiple version ranges from 6.2.3 through 6.6.0). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.94437 (99.99th percentile), this vulnerability demonstrates extremely high real-world exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | >= 9.6, < 9.6.4.42; >= 9.8, < 9.8.4.20; >= 9.9, < 9.9.2.74; >= 9.10, < 9.10.1.42; >= 9.12, < 9.12.3.12; >= 9.13, < 9.13.1.10; >= 9.14, < 9.14.1.10 |
| cisco | secure firewall threat defense | >= 6.2.3, < 6.2.3.16; >= 6.3.0, < 6.3.0.6; >= 6.4.0, < 6.4.0.10; >= 6.5.0, < 6.5.0.5; >= 6.6.0, < 6.6.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158647/Cisco-Adaptive-Security-Appliance-Software-9.11-Local-File-Inclusion.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/160497/Cisco-ASA-9.14.1.10-FTD-6.6.0.1-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3452(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-3452 is classified under CWE-22 — Path Traversal and CWE-20 — Improper Input Validation. Path Traversal occurs when software uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize elements such as ".." that can cause the pathname to resolve outside of that directory. This enables attackers to access files and directories that are stored outside the intended location.
In the context of Cisco ASA and FTD, this weakness allows unauthenticated attackers to read arbitrary files within the web services file system by sending crafted HTTP requests containing directory traversal sequences. While the vulnerability is limited to the web services file system and cannot access ASA/FTD system files or underlying OS files, exposed data can include WebVPN configuration, bookmarks, web cookies, partial web content, and HTTP URL information.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2020-3452 carries a CVSS 3.1 score of 7.5 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows attackers to read sensitive files within the web services file system, potentially exposing VPN configuration details, session tokens, bookmarks, and other sensitive information that could facilitate further attacks.
Integrity (NONE): This is a read-only vulnerability. Attackers cannot modify files or system configurations through this exploit path.
Availability (NONE): The vulnerability does not enable denial-of-service attacks or impact system availability.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning impact is confined to the web services file system on the affected Cisco ASA or FTD device.
With an EPSS score of 0.94437 (99.99th percentile), this vulnerability ranks among the most exploited vulnerabilities tracked. Despite being a read-only information disclosure, the data exposed can enable lateral movement and further compromise of the network.
Exploit Maturity
CVE-2020-3452 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Multiple public exploits and proof-of-concept code are widely available for this vulnerability. The trivial nature of the exploit — a simple crafted HTTP request — means virtually any attacker can attempt exploitation. The EPSS score of 0.94437 (99.99th percentile) reflects the extremely high exploitation activity.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2020-3452. However, the information disclosed through exploitation can serve as a stepping stone for more severe attacks, including credential theft and network compromise.
Attack surface: Cisco ASA and FTD devices configured with WebVPN or AnyConnect features and exposed to the internet are directly vulnerable. These devices frequently serve as network perimeter security appliances, making them high-value targets for initial access.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations running affected ASA or FTD versions should prioritize patching immediately.
Remediation
- Apply Cisco security patches immediately. Update Cisco ASA Software and FTD Software to fixed versions as specified in Cisco Security Advisory cisco-sa-asaftd-ro-path-KJuQhB86. Consult the advisory for version-specific upgrade paths.
- Identify all affected ASA and FTD devices. Inventory all Cisco ASA and FTD devices in your environment, particularly those configured with WebVPN or AnyConnect features. Verify running software versions against the affected version ranges.
- Restrict web services access. If immediate patching is not feasible, restrict access to the ASA/FTD web services interface to trusted management networks only. Disable WebVPN or AnyConnect features on devices where they are not required.
- Monitor for exploitation attempts. Review web server logs on affected devices for HTTP requests containing directory traversal sequences (e.g., %2e%2e/, ../, or encoded variants). Enable enhanced logging to detect ongoing exploitation.
- Assess potential data exposure. If exploitation may have occurred, evaluate what data within the web services file system could have been exposed. Rotate any credentials or session tokens that may have been compromised.
- Update IDS/IPS signatures. Ensure network intrusion detection and prevention systems have updated signatures to detect path traversal attempts against Cisco ASA and FTD web services interfaces.
Technical Details
CVE-2020-3452 is a HIGH-severity vulnerability in Cisco ASA and FTD Software that can be exploited remotely over the network without physical access. The attack complexity is low, requiring no specialized conditions. No prior authentication or privileges are needed to initiate the attack. No user interaction is required, enabling fully automated exploitation.
Technical mechanism: The vulnerability exists in the web services interface of Cisco ASA and FTD Software due to improper input validation of URLs in HTTP requests. When an affected device is configured with WebVPN or AnyConnect features, the web services interface fails to properly sanitize directory traversal character sequences in incoming HTTP requests. An attacker can send specially crafted HTTP requests containing encoded traversal sequences to read files outside the intended web root directory.
Scope limitations: The vulnerability is limited to the web services file system and cannot be used to access ASA or FTD system files or the underlying operating system files. Exposed content may include WebVPN configuration, portal customization data, bookmarks, web cookies, and partial web content.
Affected configurations: Only devices configured with WebVPN or AnyConnect features are vulnerable. Devices without these features enabled are not affected.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a network-accessible attack with low complexity, no privileges required, no user interaction needed, high confidentiality impact, but no integrity or availability impact.
Frequently Asked Questions
Is CVE-2020-3452 being actively exploited?
Yes, CVE-2020-3452 is actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has an EPSS score of 0.94437 (99.99th percentile), confirming extremely high exploitation activity. Multiple public exploits are available, making the barrier to exploitation very low.
What products are affected by CVE-2020-3452?
Cisco Adaptive Security Appliance (ASA) Software versions 9.6 through 9.14 and Cisco Firepower Threat Defense (FTD) Software versions 6.2.3 through 6.6.0 are affected, but only when configured with WebVPN or AnyConnect features. Specific fixed versions vary by release train — consult Cisco's security advisory for detailed version information.
How do I fix CVE-2020-3452?
Apply the security patches provided by Cisco as described in advisory cisco-sa-asaftd-ro-path-KJuQhB86. If immediate patching is not possible, restrict access to the web services interface and disable WebVPN or AnyConnect features where not required. Monitor for exploitation attempts and assess potential prior data exposure.
How severe is CVE-2020-3452?
CVE-2020-3452 is rated HIGH with a CVSS 3.1 score of 7.5. While it is a read-only path traversal (no integrity or availability impact), the ability to access sensitive configuration data and session information on critical network security appliances makes it a high-priority vulnerability. The EPSS score of 0.94437 places it in the 99.99th percentile for exploitation likelihood.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.