CVE-2020-3187: Cisco Firepower Path Traversal Flaw

CVE-2020-3187 Overview

A directory traversal vulnerability exists in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to improper input validation of HTTP URL parameters, enabling attackers to use directory traversal character sequences to view or delete arbitrary files within the web services file system.

Critical Impact

Unauthenticated remote attackers can read and delete sensitive files on affected Cisco ASA and FTD devices configured with WebVPN or AnyConnect features, potentially compromising VPN infrastructure security.

Affected Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software
• Cisco ASA 5500 Series (5505, 5510, 5512-X, 5515-X, 5520, 5525-X, 5540, 5545-X, 5550, 5555-X, 5580, 5585-X)

Discovery Timeline

• May 6, 2020 - CVE-2020-3187 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-3187

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) affects the web services interface of Cisco ASA and FTD devices. The flaw exists because the web services component fails to properly validate and sanitize HTTP URL input before processing file operations. When WebVPN or AnyConnect features are enabled, the device exposes a web services file system that becomes vulnerable to path manipulation attacks.

An attacker can craft malicious HTTP requests containing directory traversal sequences (such as ../) to escape the intended directory structure and access files outside the designated web services directory. This allows both reading sensitive configuration files and deleting arbitrary files within the web services file system scope.

Importantly, this vulnerability is limited to the web services file system and cannot be used to access core ASA/FTD system files or the underlying operating system. Additionally, deleted files are automatically restored when the device is reloaded, providing a built-in recovery mechanism.

Root Cause

The root cause of CVE-2020-3187 is insufficient input validation in the HTTP URL handling component of the web services interface. The affected code fails to properly sanitize user-supplied path components, allowing directory traversal character sequences to be processed without adequate filtering. This missing validation enables attackers to construct malicious paths that reference files outside the intended directory boundaries.

Attack Vector

The attack is conducted remotely over the network without requiring authentication. An attacker targets Cisco ASA or FTD devices that have WebVPN or AnyConnect features enabled, sending specially crafted HTTP requests to the web services interface.

The attack flow involves:

1. Identifying a vulnerable Cisco ASA/FTD device with WebVPN or AnyConnect enabled
2. Crafting HTTP requests with directory traversal sequences embedded in URL parameters
3. Sending requests to read sensitive files or delete arbitrary files within the web services file system
4. Potentially disrupting VPN services by deleting critical configuration or session files

Public exploit code is available via Packet Storm Security, demonstrating arbitrary file deletion capabilities against ASA Software version 9.7.

Detection Methods for CVE-2020-3187

Indicators of Compromise

• HTTP requests to web services interface containing ../ or encoded directory traversal sequences (%2e%2e%2f, %252e%252e%252f)
• Unexpected file deletions or access attempts within the web services file system
• Unusual patterns of HTTP requests targeting /+CSCOE+/, /+CSCOT+/, or other WebVPN/AnyConnect endpoints
• Web service log entries showing path manipulation attempts

Detection Strategies

• Deploy network intrusion detection/prevention rules to identify HTTP requests with directory traversal patterns targeting ASA/FTD web interfaces
• Monitor web services logs for requests containing suspicious path sequences or encoded traversal characters
• Implement web application firewall rules to block known directory traversal attack signatures
• Enable detailed logging on ASA/FTD devices to capture HTTP request details for forensic analysis

Monitoring Recommendations

• Review ASA/FTD device logs regularly for signs of exploitation attempts
• Configure SIEM alerts for patterns associated with directory traversal attacks against network appliances
• Monitor for unexpected changes or deletions in web services file system directories
• Track connection attempts to WebVPN/AnyConnect endpoints from unusual source IP addresses

How to Mitigate CVE-2020-3187

Immediate Actions Required

• Apply Cisco security patches as specified in the Cisco Security Advisory
• Verify all Cisco ASA and FTD devices running WebVPN or AnyConnect features are updated to patched firmware versions
• Review access logs for evidence of prior exploitation attempts before patching
• Implement network access controls to limit exposure of web services interfaces to trusted networks only

Patch Information

Cisco has released security patches addressing this vulnerability. Organizations should consult the Cisco Security Advisory cisco-sa-asaftd-path-JE3azWw43 for specific patched software versions applicable to their ASA and FTD deployments. The advisory provides detailed version information and upgrade paths for affected products.

Workarounds

• Restrict access to the WebVPN/AnyConnect web services interface to trusted IP ranges using ACLs
• Consider disabling WebVPN or AnyConnect features temporarily if not required until patches can be applied
• Implement external web application firewall or reverse proxy with directory traversal filtering in front of ASA/FTD web interfaces
• Enable enhanced logging and monitoring to detect exploitation attempts while awaiting patch deployment

# Example ACL to restrict WebVPN interface access (apply to appropriate interface)
access-list WEBVPN-RESTRICT extended permit tcp <trusted-network> <netmask> host <asa-webvpn-ip> eq 443
access-list WEBVPN-RESTRICT extended deny tcp any host <asa-webvpn-ip> eq 443