Unauthenticated Arbitrary File Deletion (CVE-2020-3187)

How it was found

Summary:

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences.

Vulnerable Endpoint:

https://129.0.176.5/+CSCOE+/session_password.html

Steps To Reproduce:

1. First I performed a curl request to validate that /session_password.html gave a 200 response.
2. Example to delete logo file "/+CSCOU+/csco_logo.gif".

curl -k -H "Cookie: token=../+CSCOU+/csco_logo.gif" https://129.0.176.5/+CSCOE+/session_password.html

WHOIS

{F1113009}

NOTE: No destructive behavior was performed on target.

Impact

An exploit could allow the attacker to view or delete arbitrary files on the system.