Cisco ASA/Firepower Threat Defense Legacy Capability code injection

Summaryinfo

A vulnerability, which was classified as critical, was found in Cisco ASA and Firepower Threat Defense. This affects an unknown part of the component Legacy Capability. Such manipulation leads to code injection. This vulnerability is documented as CVE-2024-20359. The attack needs to be performed locally. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco ASA and Firepower Threat Defense (affected version not known). Affected by this issue is some unknown functionality of the component Legacy Capability. The manipulation with an unknown input leads to a code injection vulnerability. Using CWE to declare the problem leads to CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2024-20359 since 11/08/2023. The exploitation is known to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

It is declared as attacked. This issue was added on 04/24/2024 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/01/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (881). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• ASA
• Firepower Threat Defense

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion