# Local File Disclosure /Delete On [us-az-vpn.acronis.com]

Outdated Cisco ASA VPN on Acronis exposed unauthenticated path traversal in translation-table and session_password endpoints, letting attackers read and delete arbitrary server files.

- Payout: hidden
- Severity: medium
- Program: Acronis
- Found by: 10nf
- Disclosed: 2021-06-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/924407
- Library page: https://bugbountylibrary.com/r/h1%3A924407
- Tags: area:devices domain:network impact:data-leak impact:dos kind:bounty platform:hackerone sev:medium tech:nginx technique:source-review vuln:dos vuln:info-disclosure vuln:path-traversal

**Target:** Cisco ASA VPN web portal (+CSCOE+/+CSCOT+ endpoints)
**Root cause:** Outdated Cisco ASA software fails to sanitize the textdomain and token parameters, allowing ../ traversal to arbitrary filesystem paths.
**Steps:**
1. Confirm vulnerable version by requesting `GET /+CSCOE+/session_password.html`; 200 means unpatched, 404 means patched.
2. Read arbitrary file: `GET /+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../`
3. Delete arbitrary file: `GET /+CSCOE+/session_password.html` with `Cookie: token=../../../../../../+CSCOE+/wrong_url.html`
4. File content is stored in webvpn cookie then deleted; re-requesting the read endpoint confirms deletion.
**How found:** Researcher identified the ASA version as outdated, downloaded the vulnerable code and compared it to a local build to confirm identical code, then used the presence of +CSCOE+/session_password.html as a version fingerprint before testing traversal locally.
**Exploitation:** Unauthenticated attacker sends crafted GET requests to the VPN portal; the translation-table endpoint returns file contents via traversal in textdomain, and the session_password endpoint with a traversal token cookie reads then deletes the target file. Files restore only after VPN restart.
**Escalation:** Deleting LUA source files breaks the VPN web portal, preventing user authentication (DoS).
**Insight:** Cisco ASA's +CSCOE+/session_password.html endpoint presence is a reliable fingerprint for this unpatched traversal; test destructive file-delete bugs on a local ASA build since production testing breaks the VPN.