Exploit for Improper Input Validation in Cisco Adaptive Security Appliance Software

githubexploit · 2021-02-03

Description

Cisco ASA / FTD Web Services Traversal Vulnerability, CVE-2020-3452, Directory Traversal, Sensitive File Rea

Entry point

Parametertype · query param

Path/+CSCOT+/translation-table

Path traversal via crafted requests to translation-table endpoint exposing web services file system contents.

Affected Cisco Adaptive Security Appliance Software versions

Cisco Adaptive Security Appliance Software< 9.6.4.42, 9.8.4.20, 9.9.2.74, 9.10.1.42, 9.12.3.12, 9.13.1.10, 9.14.1.10

All known vulnerabilities by product

Cisco Asa Cisco Ftd

CVSS 7.5 for CVE-2020-3452

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

Working code

100%confidence this exploit runs

Based on 3 file(s) in the source

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2024-04-25 05:17

Last Seen:2025-08-31 20:50

Reporter:fuzzlove

Written in:Python

Last commit:2021-02-03

Tags

cisco asaftdweb servicestraversalvulnerabilityCVE-2020-3452directorysensitive file readremote attack

Other exploits for CVE-2020-3452

Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software

2026-05-16 curtishoughtonGITHUB

ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

2021-12-27 KitPloitKITPLOIT

ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

2021-12-01 KitPloitKITPLOIT

Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software

2021-02-04 faisalfs10xGITHUB

Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software

2021-01-24 NULLGITEE

Exploit for Improper Input Validation in Cisco Adaptive_Security_Appliance_Software

2021-01-05 darklotuskdbGITHUB

Cisco ASA 9.14.1.10 and FTD 6.6.0.1 - Path Traversal (2)

2020-12-15 FreakyclownEXPLOITDBPython

Cisco ASA 9.14.1.10 / FTD 6.6.0.1 Path Traversal

2020-12-15 FreakyclownPACKETSTORMPython

Exploit Code

README26 lines

## https://sploitus.com/exploit?id=486B7BFA-C5C7-5FA9-AF20-76F859ABFD6D
# Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability

# CVE-2020-3452

Usage: CVE-2020-3452.py https://target

Vulnerability description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.

Sample output:
```
➜  Cisco-ASA-FTD-Web-Services-Traversal git:(main) ✗ python CVE-2020-3452.py https://target
+-------------------------------------------------------------+

- [ Cisco ASA / FTD Web Services Traversal Vulnerability ]

-       -[ CVE-2020-3452 - PoC by: LiquidSky ^_^ ]-

+-------------------------------------------------------------+
[*] Checking potential target : https://target
[+] https://target is vulnerable... 
[+] Grabbing logo.gif from the host.
[+] https://target is vulnerable... 
[+] Grabbing http_auth.html from the host.
[+] https://target is vulnerable...
```