Pierluigi Paganini December 21, 2019

Cisco has warned customers that hackers continue to target Cisco ASA and Firepower Appliance products by exploiting the CVE-2018-0296 flaw.

Experts warn that threat actors continue to exploit the CVE-2018-0296 flaw to target Cisco ASA and Firepower Appliance. The vulnerability could be exploited by a remote, unauthenticated attacker to gain access to sensitive information through directory traversal attacks, the exploitation of the issue can also trigger a denial-of-service (DoS) condition.

“A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.” read the security advisory published by Cisco. “It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques.”

The root cause of the issue is the lack of proper input validation of the HTTP URL, it could be exploited by an attacker by sending a specially-crafted HTTP request to a vulnerable device.

The vulnerability affects the following Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products:

• 3000 Series Industrial Security Appliance (ISA)
• ASA 1000V Cloud Firewall
• ASA 5500 Series Adaptive Security Appliances
• ASA 5500-X Series Next-Generation Firewalls
• ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• Adaptive Security Virtual Appliance (ASAv)
• Firepower 2100 Series Security Appliance
• Firepower 4100 Series Security Appliance
• Firepower 9300 ASA Security Module
• FTD Virtual (FTDv)

The vulnerability was patched more than a year ago, in early June 2018, since its disclosure many proof-of-concept (PoC) exploits have been released online.

The vulnerability was initially classified as high severity, but recently Cisco rated it as critical severity.

Now experts at Cisco Talos are warning of a spike in cyberattacks exploiting the vulnerability.

“Cisco Talos has recently noticed a sudden spike in exploitation attempts against a specific vulnerability in our Cisco Adaptive Security Appliance (ASA) and Firepower Appliance. The vulnerability, CVE-2018-0296, is a denial-of-service and information disclosure directory traversal bug found in the web framework of the appliance.” reads the advisory published by Cisco Talos.

“This isn’t a new vulnerability, but as exploitation continues to increase, customers need to be aware of the risk of both a denial-of-service or unauthenticated information disclosure. Additionally, as we head into the holidays, people take time off, but adversaries do not.”

Admins could determine if they are vulnerable by running the following commands:

show asp table socket | include SSL|DTLS 

If the command shows any listening sockets, the device is potentially at risk. To determine if the vulnerable process is running the admins could run the following command:

show processes | include Unicorn

If the process is shown as running, the likelihood of a vulnerability existing is elevated and the administrator should validate the running version of code on the appliance to determine if it is one of the affected versions listed in the advisory.

Cisco already released security updates to address the issue.

Pierluigi Paganini

(SecurityAffairs – Cisco ASA, CVE-2018-0296)

[adrotate banner=”5″]

[adrotate banner=”13″]