I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host>, the nmap script http-cisco-anyconnect and ssh -vvv -p port <host> with no luck at obtaining any information about the device, its OS, or patch status.

The advisory from Cisco states:

The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device.

This work is part of an external penetration test, and I do not have access to the device from their internal network.

Can anyone provide any additional techniques to obtain device information or describe how I may construct a HTTP request with path traversal characters in order to confirm this device is vulnerable?

  • Doesn't Nessus provide that info? It usually provides proof or ways to replicate the finding.
    – schroeder
    Commented Jul 30, 2021 at 18:09

1 Answer 1


There are publicly posted Proof of Concept URLs that can be used to test for this vulnerability:




You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .