CVE-2023-20095: Cisco ASA Software DoS Vulnerability

CVE-2023-20095 Overview

A denial of service vulnerability exists in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. This vulnerability allows an unauthenticated, remote attacker to cause a denial of service (DoS) condition on affected devices by sending specially crafted HTTPS requests. The vulnerability stems from improper handling of HTTPS requests, which can lead to resource exhaustion and service disruption.

Critical Impact

Unauthenticated attackers can remotely exhaust system resources on Cisco ASA and FTD devices, causing denial of service conditions that could disrupt VPN connectivity for entire organizations.

Affected Products

• Cisco Adaptive Security Appliance (ASA) Software versions 9.8.x through 9.18.1
• Cisco Firepower Threat Defense (FTD) Software versions 6.2.3 through 7.1.0.2
• Network perimeter security appliances with remote access VPN enabled

Discovery Timeline

• November 1, 2023 - CVE-2023-20095 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-20095

Vulnerability Analysis

This vulnerability affects the remote access VPN feature in Cisco ASA and FTD software. When remote access VPN is configured, the affected devices expose HTTPS endpoints that handle VPN client connections and web-based VPN portal access. The vulnerability is triggered when an attacker sends maliciously crafted HTTPS requests to these endpoints.

The flaw is classified under CWE-772 (Missing Release of Resource after Effective Lifetime), indicating that the affected software fails to properly release resources after processing certain HTTPS requests. This resource management failure allows attackers to systematically consume system resources until the device can no longer service legitimate requests.

Root Cause

The root cause lies in improper resource handling within the HTTPS request processing component of the remote access VPN feature. When specific types of HTTPS requests are received, the software allocates resources to process these requests but fails to properly release them afterward. This missing resource release mechanism allows memory and other system resources to be gradually consumed without being freed.

The vulnerability specifically affects devices where the remote access VPN feature (including AnyConnect, clientless SSL VPN, or IKEv2 VPN with client services) is enabled. Without proper resource cleanup, repeated exploitation leads to resource exhaustion.

Attack Vector

The attack can be executed remotely over the network without requiring authentication. An attacker with network access to the VPN endpoint can send crafted HTTPS requests to trigger the vulnerability. The attack does not require any user interaction, making it particularly dangerous for internet-facing VPN concentrators.

The exploitation is relatively straightforward: an attacker identifies an exposed Cisco ASA or FTD device with remote access VPN enabled, then sends a series of malicious HTTPS requests. Each request causes resources to be allocated but not properly released. Over time, this causes resource exhaustion, degrading performance and eventually causing a complete denial of service.

The attack can originate from any network location that can reach the HTTPS interface of the affected device, typically targeting the standard VPN portal ports (TCP/443).

Detection Methods for CVE-2023-20095

Indicators of Compromise

• Unusual increase in HTTPS connection attempts to VPN endpoints from single or multiple source IPs
• Gradual memory utilization increase on ASA/FTD devices without corresponding legitimate traffic growth
• Abnormal patterns of incomplete or malformed HTTPS requests in VPN access logs
• System resource warnings or alerts indicating memory or connection table exhaustion

Detection Strategies

• Monitor HTTPS request rates and patterns to VPN endpoints for anomalous spikes or unusual request characteristics
• Implement network-based intrusion detection rules to identify crafted HTTPS packets targeting known vulnerable request patterns
• Configure SNMP or syslog monitoring for resource utilization thresholds on ASA and FTD appliances
• Deploy rate limiting and connection throttling on VPN interfaces to detect and slow down potential DoS attempts

Monitoring Recommendations

• Enable detailed logging for VPN connection attempts and HTTPS request handling on affected devices
• Configure real-time alerting for memory utilization exceeding 80% on VPN appliances
• Implement baseline monitoring of normal VPN traffic patterns to enable anomaly detection
• Review Cisco Security Manager or Firepower Management Center dashboards for unusual resource consumption trends

How to Mitigate CVE-2023-20095

Immediate Actions Required

• Review the Cisco Security Advisory for specific version guidance and fixed releases
• Identify all ASA and FTD devices in your environment running vulnerable software versions
• Prioritize patching internet-facing VPN concentrators that are most exposed to exploitation
• Consider implementing rate limiting on VPN interfaces as a temporary mitigation measure

Patch Information

Cisco has released fixed software versions that address this vulnerability. Organizations should upgrade to patched versions as specified in the Cisco Security Advisory. The advisory provides a comprehensive version checker tool and migration paths for affected software branches.

For Cisco ASA Software, consult the advisory for fixed releases in the 9.8.x, 9.12.x, 9.14.x, 9.15.x, 9.16.x, 9.17.x, and 9.18.x release trains. For Cisco FTD Software, fixed versions are available in the 6.2.3, 6.4.0, 6.6.x, 6.7.x, 7.0.x, and 7.1.x release trains.

Workarounds

• Implement IP-based access control lists to restrict access to VPN endpoints to known legitimate IP ranges where feasible
• Configure rate limiting for HTTPS connections on the VPN interface to slow potential exploitation attempts
• Enable threat detection features on ASA devices to automatically shun attacking hosts
• Consider deploying a web application firewall or DDoS protection service in front of internet-facing VPN endpoints

# Example: Configure threat detection on Cisco ASA
threat-detection basic-threat
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200