Cisco ASA/FTD Web Exploitation of CVE-2020-3452 (HTTP 200)

title: Cisco ASA/FTD Web Exploitation of CVE-2020-3452 (HTTP 200)
id: e2d9a0c6-2ba6-4f3c-a69a-1c3d6f114e20
status: test
description: This rule flags web requests against Cisco ASA/FTD endpoints containing translation-table and OEM customization parameters, where the HTTP response status code is 200. Successful 200 responses indicate the targeted exploit path may have been reached and processed. It relies on webserver telemetry capturing the full request URI query string and the response status code.
references:
  - https://twitter.com/aboul3la/status/1286012324722155525
  - https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-3452/web_cve_2020_3452_cisco_asa_ftd.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-07
modified: 2023-01-02
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2020-3452
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - +CSCOT+/translation-table
      - +CSCOT+/oem-customization
  selection_path_select:
    cs-uri-query|contains:
      - "&textdomain=/"
      - "&textdomain=%"
      - "&name=/"
      - "&name=%"
  select_status_code:
    sc-status: 200
  condition: selection_endpoint and selection_path_select and select_status_code
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: aba47adc-4847-4970-95c1-61dce62a8b29
    type: derived