CVE-2020-3153 PoC — Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

Source

https://github.com/raspberry-pie/CVE-2020-3153

Associated Vulnerability

Title: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability (CVE-2020-3153)
Description:A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

Description

PoC for CVE-2020-3153 Cisco AnyConnect Secure Mobility Client EoP

Readme

# CVE-2020-3153 Cisco AnyConnect Secure Mobility Client EoP PoC

Thanks to Yorick Koster for publishing details. This is a proof of concept for a path traversal vulnerability in Cisco AnyConnect Secure Mobility Client.
Tested with Windows 7 and Windows 10 and AnyConnect version 4.5.x and 4.6.x. For version 4.7.04x and 4.8.x you need to run anypoc_4.7.exe.


Copy the files from [anyconnect.zip](anyconnect.zip) to C:\anyconnect\

1. search and download "anyconnect-win-4.6.03049-predeploy-k9.zip" from the internet

2. unzip anyconnect-win-4.6.03049-predeploy-k9.zip

3. download 7-zip_portable, https://portableapps.com/apps/utilities/7-zip_portable

4. extract anyconnect-win-4.6.03049-posture-predeploy-k9.msi with 7-zip_portable

5. copy cstub.exe to C:\anyconnect\

Run C:\anyconnect\anypoc.exe

or run C:\anyconnect\anypoc_4.7.exe for version 4.7.04x and above

## Links

* https://seclists.org/fulldisclosure/2020/Apr/43
* https://nvd.nist.gov/vuln/detail/CVE-2020-3153
* https://ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →