CVE-2020-3580

Cisco ASA / FTD reflected XSS in the WebVPN SAML SP ACS endpoint (/+CSCOE+/saml/sp/acs). Patched in cisco-sa-asaftd-xss-multiple-FCB3vPZe.

This repo contains:

• xss.html — a human-verifiable PoC for authorized targets.
• src/ — a discovery + scope-aware validation pipeline.
• docs/ — methodology and ethics.

What the pipeline does

┌──────────┐   ┌──────────────┐   ┌────────────────────┐   ┌────────────────┐   ┌──────────────┐
│ Shodan   │ → │ scope match  │ → │ manual approval    │ → │ canary check   │ → │ MD report    │
│ (3 dorks)│   │ (H1, BC, +)  │   │ deny-by-default    │   │ no JS exec     │   │ drafts       │
└──────────┘   └──────────────┘   └────────────────────┘   └────────────────┘   └──────────────┘

Each stage writes an inspectable JSON artifact and runs independently.

The validator does not fire alert(). It POSTs a unique canary string containing raw <>"' and grades the response body. Confirmed hits get a Markdown draft with the original xss.html included for the program reviewer to verify in their own browser.

Validation is approval-gated. A scope match is only a starting point; the current program brief is the contract. Before active validation, review the program policy and set the target's approval flags in data/validation_approvals.json.

Setup

git clone https://github.com/cruxN3T/CVE-2020-3580
cd CVE-2020-3580
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
cp creds.env.example creds.env
$EDITOR creds.env   # add your Shodan key, optionally H1/BC tokens

creds.env is gitignored. The .gitignore blocks any file matching *.env (except *.env.example), plus data/ and reports/ to keep target lists and validation excerpts off the public repo.

Usage

The default end-to-end command intentionally stops before validation:

python -m src.pipeline run

That writes data/validation_approvals.json with all approval flags set to false. Review each current program brief and set all three fields to true only when the target is still in scope and this type of validation is allowed:

{
  "manual_policy_reviewed": true,
  "automated_testing_allowed": true,
  "cve_testing_allowed": true
}

Then validate and generate report drafts:

python -m src.pipeline validate
python -m src.pipeline report

Or stage-by-stage:

python -m src.pipeline discover            # Shodan → data/shodan_hits.json
python -m src.pipeline scope               # match → data/in_scope.json
python -m src.pipeline approve-template    # → data/validation_approvals.json
python -m src.pipeline validate            # approved canary checks only
python -m src.pipeline report              # → reports/<host>__CVE-2020-3580.md

For private lab targets only, validate --allow-unapproved bypasses the approval file. For legacy appliances where certificate validation is impossible, validate --allow-insecure-tls disables TLS verification for that run.

The scope stage works without any API keys — it pulls from arkadiyt/bounty-targets-data. Adding H1_USERNAME + H1_API_TOKEN to creds.env can augment that with fresh data from the HackerOne Hacker API when H1_LIVE=true is set.

Configuration

Everything lives in creds.env. See creds.env.example for the full list. The knobs worth knowing:

• SCOPE_PLATFORMS — comma-separated. Defaults to hackerone,bugcrowd. Add intigriti and yeswehack if you want broader coverage.
• TARGET_RPM — per-host requests per minute. Default 10. Don't raise this without a reason.
• TLS_VERIFY — defaults to true.
• REQUIRE_VALIDATION_APPROVAL — defaults to true.

Read these before running it

• docs/ETHICS.md — what scope match does and doesn't authorize, and what the validator deliberately does not do.
• docs/METHODOLOGY.md — how reflection grading works and why each stage exists.

What this repo is not

Not a mass-exploitation tool. Not a 0day. Not a substitute for reading the program brief on the platform before you submit. The scope matcher is a starting point; the policy text is the contract.

License

MIT. See LICENSE.