Loading vulnerability…
CVE-2020-3452 is a directory traversal vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The flaw is caused by improper input validation of URLs in HTTP requests processed by affected devices, allowing traversal character sequences to be interpreted in a way that exposes files outside the intended web resource scope. A remote, unauthenticated attacker can exploit the issue by sending crafted HTTP requests to the web services interface and cause the device to return arbitrary files from the web services file system. The vulnerable web services file system is present when WebVPN or AnyConnect functionality is configured. The issue is limited to the web services file system and does not provide access to ASA or FTD system files or to the underlying operating system files.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (8 hidden).
This repository contains a proof-of-concept exploit for CVE-2020-3452, a path traversal vulnerability in Cisco ASA and FTD devices. The main file, 'PoC.py', is a Python 3 script that automates exploitation by sending crafted HTTPS requests to the '/+CSCOT+/translation-table' endpoint on the target device. It attempts to read a curated list of known files from the device, saving up to 200 successful responses in a local 'output/' directory. The script is designed for authorized security testing and includes basic hygiene features such as output directory isolation and filename sanitization. The README provides detailed usage instructions, affected versions, and legal disclaimers. No hardcoded credentials or IPs are present; the user supplies the target at runtime. The exploit demonstrates the ability to read arbitrary files from vulnerable Cisco ASA/FTD devices over the network.
This repository provides a Bash script (SnE-CVE-2020-3452.sh) that automates the process of scanning for and exploiting Cisco ASA and FTD devices vulnerable to CVE-2020-3452. The exploit leverages Shodan to identify potential targets by searching for devices with the 'webvpn' cookie, then attempts to exploit the directory traversal vulnerability by sending crafted HTTP requests to specific endpoints. If successful, the script can read files from the web services file system of the target device. The repository also includes a simple update script and documentation. The exploit is operational, requiring only basic configuration and a Shodan API key, and is capable of identifying and exploiting vulnerable devices remotely over the network.
This repository provides proof-of-concept exploit scripts for CVE-2020-3452, a directory traversal vulnerability in Cisco ASA and FTD devices. The repository contains three files: a README.md with usage notes and references, a Bash script (poc.sh), and a PowerShell script (poc.ps1). Both scripts attempt to download sensitive files from a vulnerable Cisco VPN endpoint by exploiting the directory traversal flaw via crafted HTTPS GET requests. The scripts are simple POCs and require the user to specify the target's hostname or IP address. The exploit does not provide a post-exploitation payload but demonstrates the ability to read arbitrary files from the target device. The repository is focused and does not include detection scripts or fake content.
This repository provides a Bash script (cve-2020-3452.sh) that exploits the directory traversal vulnerability CVE-2020-3452 in Cisco ASA and FTD appliances. The exploit works by iterating over a list of known web directory files (provided in cisco_asa_file_list.txt and hardcoded in the script) and sending crafted HTTPS requests to the target device's web interface. The vulnerable endpoint '/+CSCOT+/translation-table?type=mst&textdomain=%2bCSCOE%2b/<file>&default-language&lang=../' is used to attempt to retrieve each file. Downloaded files are saved in a newly created local directory named 'cisco_asa_files'. The repository consists of three files: a README with usage instructions, a text file listing known files, and the Bash exploit script. The exploit is a proof-of-concept for file enumeration and download, not a weaponized tool.
This repository contains a proof-of-concept exploit for CVE-2020-3452, a directory traversal vulnerability in Cisco ASA and FTD web services. The main file, CVE-2020-3452.py, is a Python script that takes a target URL as input and attempts to retrieve a list of sensitive files from the target device by exploiting the /+CSCOT+/translation-table endpoint. The script reads file names from cisco_asa_file_list.txt and sends crafted GET requests with directory traversal parameters to download these files if the target is vulnerable. The README.md provides usage instructions and a brief description of the vulnerability. The exploit is unauthenticated and works remotely over HTTPS, targeting Cisco security appliances with unpatched web interfaces. The code is a functional proof-of-concept and does not include advanced payloads or post-exploitation features.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A directory traversal vulnerability in Cisco ASA and FTD web services mentioned as part of Cisco's prior security history.
A directory traversal vulnerability in the web services interface of Cisco ASA and Cisco Firepower Threat Defense software that allows an unauthenticated remote attacker to read sensitive files via crafted HTTP requests.
A Cisco vulnerability enabling local file read on VPN servers; the content notes Apple VPN servers were affected during scanning.
A directory traversal vulnerability in a security product caused by improper input validation; noted as exploited in the wild (CISA KEV).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.