CVE-2020-3153
published 2020-02-19CVE-2020-3153: A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy…
PriorityP184medium6.5CVSS 3.1
AVLACLPRLUINSCCNIHAN
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-11-14
Exploited in the wild
EPSS
28.31%
97.9th percentile
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility | — | — |
| cisco | anyconnect_secure_mobility_client | < 4.8.02042 | 4.8.02042 |
| cisco | cisco_anyconnect_secure_mobility_client | >= unspecified < n/a | n/a |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert tcp any any -> any 62522 (msg:"ET EXPLOIT Cisco AnyConnect Path Traversal Priv Esc (CVE-2020-3153)"; flow:established,to_server; content:"OCSC"; depth:4; content:"vpndownloader.exe"; distance:0; content:"|5c 2e 2e 2f|dbghelp.dll"; fast_pattern; distance:0; reference:url,ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal; reference:url,gist.github.com/ykoster/aeaa893d68adbc5004aa873b3290acd1; reference:cve,2020-3153; classtype:attempted-admin; sid:2030280; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2020_06_10, cve CVE_2020_3153, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_06_10, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
bytes
OCSC (at depth:4 of TCP payload to port 62522)
bytes
|5c 2e 2e 2f| (backslash + ../ path traversal sequence in IPC payload)
- →Monitor TCP traffic to port 62522 on the loopback interface (Cisco AnyConnect Secure Mobility Agent IPC port). Exploit traffic begins with the 4-byte magic 'OCSC', followed by 'vpndownloader.exe' and a path-traversal sequence (\../) targeting dbghelp.dll. ↗
- →Alert on creation of dbghelp.dll in non-standard or user-writable directories, especially in paths co-located with vpndownloader.exe, as this is the DLL hijacking payload dropped by the exploit. ↗
- →Detect vpndownloader.exe being launched from unexpected or user-writable directories (outside its normal install path), which indicates the installer component has been redirected via path traversal. ↗
- →Check Point IPS signature 'Cisco AnyConnect Secure Mobility Client Privilege Escalation (CVE-2020-3153)' can be used for network-level detection. ↗
- ·CVE-2020-3153 affects Cisco AnyConnect Secure Mobility Client for Windows versions prior to 4.8.02042 only. Versions 4.8.02042 and later are patched. ↗
- ·Exploitation requires valid (authenticated) local credentials on the Windows system — this is a local privilege escalation, not a remote unauthenticated attack. ↗
- ·The Metasploit exploit was successfully tested against AnyConnect versions 4.5.04029, 4.5.05030, and 4.7.04056 on Windows 10 1909 (x64) and Windows 7 SP1 (x86); detection logic should account for these specific version/OS combinations. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:C/A:N
vulncheck6.5MEDIUM
cisa6.5MEDIUM
vendor_cisco6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
cisa·2022-10-24·CVSS 6.5
CVE-2020-3153 [MEDIUM] CWE-427 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Vulnerability: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Affected: Cisco AnyConnect Secure
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
Required Action: Apply updates per vendor instructions.
Notes: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj; https://nvd.nist.gov/vuln/detail/CVE-2020-3153
Remediation Due Date: 2022-11-14
Cisco
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
vendor_cisco·2020-02-19·CVSS 6.5
CVE-2020-3153 [MEDIUM] CWE-427 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges.
The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
Cisco ha
Cisco
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3153 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
CVE-2020-3153: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows sys
GHSA
GHSA-xpxv-rfwh-rcfc: A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy
ghsa_unreviewed·2022-05-24
CVE-2020-3153 [MEDIUM] CWE-427 GHSA-xpxv-rfwh-rcfc: A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
VulnCheck
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
vulncheck·2020·CVSS 6.5
CVE-2020-3153 [MEDIUM] CWE-427 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.
Affected: Cisco AnyConnect Secure
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://thehackernews.com/2022/10/oldgremlin-ransomware-targeted-over.html; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/beb12bd9f715; https://vulncheck.com
Suricata
ET EXPLOIT Cisco AnyConnect Path Traversal Priv Esc (CVE-2020-3153)
suricata·2020-06-10·CVSS 6.5
CVE-2020-3153 [MEDIUM] ET EXPLOIT Cisco AnyConnect Path Traversal Priv Esc (CVE-2020-3153)
ET EXPLOIT Cisco AnyConnect Path Traversal Priv Esc (CVE-2020-3153)
Rule: alert tcp any any -> any 62522 (msg:"ET EXPLOIT Cisco AnyConnect Path Traversal Priv Esc (CVE-2020-3153)"; flow:established,to_server; content:"OCSC"; depth:4; content:"vpndownloader.exe"; distance:0; content:"|5c 2e 2e 2f|dbghelp.dll"; fast_pattern; distance:0; reference:url,ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal; reference:url,gist.github.com/ykoster/aeaa893d68adbc5004aa873b3290acd1; reference:cve,2020-3153; classtype:attempted-admin; sid:2030280; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2020_06_10, cve CVE_2020_3153, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, t
http://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.htmlhttp://seclists.org/fulldisclosure/2020/Apr/43https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsjhttp://packetstormsecurity.com/files/157340/Cisco-AnyConnect-Secure-Mobility-Client-4.8.01090-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/158219/Cisco-AnyConnect-Path-Traversal-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/159420/Cisco-AnyConnect-Privilege-Escalation.htmlhttp://seclists.org/fulldisclosure/2020/Apr/43https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsjhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3153
2020-02-19
Published
2022-10-24
Added to CISA KEV
Exploited in the wild