Cisco ASA / FTD CVE-2020-3452 (unauthenticated read-only path traversal in the WebVPN/AnyConnect web services, actively exploited, CISA KEV): which releases fix it and what could be read?

What it is: CVE-2020-3452, published by Cisco in July 2020 (advisory cisco-sa-asaftd-ro-path-KJuQhB86, CVSS 7.5), is a directory traversal flaw in the web services interface of Cisco ASA and Firepower Threat Defense (FTD). An unauthenticated attacker can read files in the web services file system that exists when WebVPN or AnyConnect is enabled. Cisco says that can include WebVPN configuration, bookmarks, web cookies, partial web content and URLs, but not ASA/FTD system files or VPN user passwords. Exploit code was published within days and Cisco confirmed active exploitation; it's in CISA's KEV catalog. Old, unmaintained firewalls still turn up with it. Am I affected: - ASA with AnyConnect IKEv2 remote access with client services, AnyConnect SSL VPN, or clientless SSL VPN (webvpn enable), on releases before the fixed builds below. FTD 6.2.2 and later with AnyConnect remote access VPN. FMC isn't affected. - Check with show version and look for webvpn / crypto ikev2 enable ... client-services in the running config. Fix: 1. Upgrade. First fixed ASA releases: 9.6.4.42, 9.8.4.20, 9.9.2.74, 9.10.1.42, 9.12.3.12, 9.13.1.10, 9.14.1.10; releases before 9.6 and 9.7 must migrate. FTD: 6.2.3.16, 6.4.0.9 + hotfix or 6.4.0.10, 6.6.0.1; 6.2.2, 6.3.0 and 6.5.0 must move to a fixed release per the advisory. Today, move to a currently supported release, which also covers the many later ASA/FTD VPN fixes. 2. Cisco lists no workaround. Firepower users with SSL decryption can detect attempts with the Snort rules named in the advisory. 3. If an old appliance ran an affected release with VPN exposed, review what was in the web services file system: rotate any credentials or secrets referenced in WebVPN bookmarks or customization, and review VPN sessions for misuse. Verify: show version reports a fixed or current release, and vulnerability scans no longer flag CVE-2020-3452. Sources: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86 https://nvd.nist.gov/vuln/detail/CVE-2020-3452 https://www.cisa.gov/known-exploited-vulnerabilities-catalog