Cisco ASA Software SharePoint RAMFS Integrity and Lua Injection Vulnerability

A vulnerability in the SSL VPN code of Cisco ASA Software could allow an authenticated, remote attacker to overwrite arbitrary files present on the RAMFS file system or inject Lua scripts.

The vulnerability is due to insufficient validation of the code that handles session information for the SSL VPN when a SharePoint handler is created. A SharePoint handler is created when a valid SharePoint connection is initiated. An attacker could exploit this vulnerability by sending crafted HTTP requests to the affected system. The SSL VPN feature must be configured for the system to be vulnerable.

An exploit could allow the attacker to overwrite arbitrary files on the RAMFS cache or inject Lua scripts, causing a denial of service (DoS) condition for the Clientless SSL VPN portal or causing the system to reload.

This vulnerability was reported to Cisco by Alec Stuart-Muirk.

Cisco has confirmed the vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker must authenticate to the targeted device. This access requirement may reduce the likelihood of a successful exploit. In addition, an attacker would need to determine whether the targeted device has the SSL VPN feature configured, which is a condition that must be met to achieve a successful exploit.