Cisco ASA FTD Exploit CVE-2020-3452

title: Cisco ASA FTD Exploit CVE-2020-3452
id: aba47adc-4847-4970-95c1-61dce62a8b29
status: test
description: Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)
references:
    - https://twitter.com/aboul3la/status/1286012324722155525
    - https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter
author: Florian Roth (Nextron Systems)
date: 2021-01-07
modified: 2023-01-02
tags:
    - attack.t1190
    - attack.initial-access
    - cve.2020-3452
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-uri-query|contains:
            - '+CSCOT+/translation-table'
            - '+CSCOT+/oem-customization'
    selection_path_select:
        cs-uri-query|contains:
            - '&textdomain=/'
            - '&textdomain=%'
            - '&name=/'
            - '&name=%'
    select_status_code:
        sc-status: 200
    condition: selection_endpoint and selection_path_select and select_status_code
falsepositives:
    - Unknown
level: high