# [CVE-2018-0296] Cisco VPN path traversal on the https://██████████

Unpatched DoD Cisco ASA VPN instance vulnerable to CVE-2018-0296 path traversal, letting unauthenticated attackers list files and disclose VPN session data.

- Payout: hidden
- Severity: medium
- Program: U.S. Dept Of Defense
- Found by: sp1d3rs
- Disclosed: 2024-06-18
- CVE: CVE-2018-0296
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/694865
- Library page: https://bugbountylibrary.com/r/h1%3A694865
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium technique:recon vuln:info-disclosure vuln:path-traversal

**Target:** Cisco ASA/AnyConnect VPN web interface
**Root cause:** Improper URL path normalization in the ASA web server allows `/+CSCOU+/../+CSCOE+/` traversal to reach the file_list.json endpoint without authentication.
**Steps:**
1. Request `curl -i -k "https://TARGET/+CSCOU+/../+CSCOE+/files/file_list.json" --path-as-is` to list files unauthenticated
2. Append `?path=/sessions` to enumerate active VPN session data
3. Confirm patched hosts return 404 for the same request
**How found:** Researcher scanned DoD network for hosts matching the known CVE-2018-0296 signature and found an unpatched instance still accepting password auth instead of cert auth.
**Exploitation:** Unauthenticated attacker sends crafted traversal URL to the ASA web interface to list files and query /sessions, disclosing VPN session info and usernames; DoS possible under some conditions.
**Insight:** Known-CVE sweeps on large government IP ranges still pay off: fingerprint the ASA login page, then test the `/+CSCOU+/../+CSCOE+/files/file_list.json` traversal with `--path-as-is` to bypass client-side normalization.