I have used Nessus to determine that a client's Cisco ASA is vulnerable to a Read-Only Path Traversal Vulnerability. So far I have tried viewing the logon portal page source code,
nmap -sV -A <host>, the nmap script
ssh -vvv -p port <host> with no luck at obtaining any information about the device, its OS, or patch status.
The advisory from Cisco states:
The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device.
This work is part of an external penetration test, and I do not have access to the device from their internal network.
Can anyone provide any additional techniques to obtain device information or describe how I may construct a HTTP request with path traversal characters in order to confirm this device is vulnerable?