{"uuid": "9e7d0f81-8c6f-45df-b110-538e738fe646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3580", "type": "seen", "source": "https://t.me/hacking_Attack/14538", "content": "Black Hat Ethical Hacking\nCisco ASA Bug Now Actively Exploited as PoC Drops\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Cisco ASA Bug Now Actively Exploited as PoC DropsPost Views: 113 \nReading Time: 1 Minute\nResearchers have dropped a proof-of-concept (PoC) exploit on Twitter for a known cross-site scripting (XSS) vulnerability in the Cisco Adaptive Security Appliance (ASA).\nResearchers at Positive Technologies published the PoC for the bug (CVE-2020-3580) on Thursday. One of the researchers there, Mikhail Klyuchnikov, noted that there were a heap of researchers now chasing after an exploit for the bug, which he termed \u201clow-hanging\u201d fruit.\nhttps://s.w.org/images/core/emoji/13.0.1/72x72/1f381.png PoC for XSS in Cisco ASA (CVE-2020-3580)\n\nPOST /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1\nHost: ciscoASA.local\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 44\nSAMLResponse=\"><svg pic.twitter.com/c53MKSK9bg\n\n \n\u2014 PT SWARM (@ptswarm) June 24, 2021\nMeanwhile, Tenable researchers published an alert about the PoC, noting that it has started to see cyberattacks using the vulnerability on targets in the wild.\n\n\u201cTenable has also received a report that attackers are exploiting CVE-2020-3580 in the wild,\u201d according to its Thursday alert. \u201cWith this new information, Tenable recommends that organizations prioritize patching CVE-2020-3580.\u201d\n\nAnd indeed, the PT PoC tweet was met with plenty of \u201cOoh thanks\u201d and \u201cthank you so much\u201d responses, presumably from would-be hackers.\nSee Also: New iPhone Bug Breaks Your WiFi: Here\u2019s The Fix\nMeanwhile, researchers at WebSec noted that the bug could be exploited for more than XSS:\nYou could have gotten 2 CVE numbers for this, as this is not just XSS but also CSRF.\n\n\u2014 WebSec (@websecnl) June 25, 2021\n\u201cResearchers often develop PoCs before reporting a vulnerability to a developer and publishing them allows other researchers to both check their work and potentially dig further and discover other issues,\u201d Claire Tills, senior research engineer at Tenable, told Threatpost. \u201cPoCs can also be used by defenders to develop detections for vulnerabilities. Unfortunately, giving that valuable information to defenders means it can also end up in the hands of attackers.\u201d\n\nGiven that a patch has been available for this vulnerability for several months, organizations are able to protect themselves which isn\u2019t the case with 0-day disclosures, she pointed out. \u201cHowever, unpatched vulnerabilities continue to haunt many organizations,\u201d Tillis added. \u201cThe public availability of a PoC is another stark reminder that effective patching is a vital step for organizations to protect themselves.\u201d Real-World Attacks for Cisco ASAThe Cisco ASA is a cybersecurity perimeter-defense appliance\u00a0that combines firewall, antivirus, intrusion prevention and virtual private network (VPN) capabilities, all meant to stop threats from making it onto corporate networks. A compromise of the device is akin to unlocking the front door of the castle for storming cyberattackers.\nSee Also: Offensive Security Tool: Pixload\nXSS attacks occur when malicious scripts are injected into otherwise benign and trusted websites; any visitors to the compromised websites are thus subject to drive-by attacks.\n\nSuccessful exploitation in this case means that unauthenticated, remote attackers could \u201cexecute arbitrary code within the [ASA] interface and access sensitive, browser-based information,\u201d Tenable added.\n\nOnce in, they could modify the device\u2019s configuration, according to Leo Pate, an application security consultant at nVisium.\n\nHowever, the target would need to be logged into the ASA for the attackers to see any joy. \u201cWhile th[...]", "creation_timestamp": "2026-09-01T20:02:34.765898Z"}