CVE-2020-3452

CVE-2020-3452 is a directory traversal vulnerability in the Cisco ASA web services layer that allowed unauthenticated attackers to read files within an isolated file system distinct from the underlying OS. The vulnerability scored EPSS 0.99992 and landed in the CISA KEV catalog — not because it compromised the operating system, but because the isolated file system it targeted contained the crown jewels: VPN configurations, session tokens, and credentials for connected services. This is the trap of compartmentalized security architecture. The ASA web services interface was added years after the appliance's core networking functionality, bolted on to support WebVPN and AnyConnect features. Cisco correctly identified that the web services layer should be isolated from system files — hence the separate file system. But the threat model stopped at that boundary. The question asked was 'can the attacker reach system files?' The question that was never asked: 'can an attacker traverse paths within the isolated file system itself?' This failure is not Cisco-specific. The same pattern — isolated file system created as a security boundary, path traversal left unmitigated within it, high-value data accumulating in the protected zone — appears across SSL VPN appliances, F5 BIG-IP, and multiple generations of network hardware. The isolation created organizational permission to store sensitive data there, and the isolation itself suppressed scrutiny of the code inside. Each successful exploitation confirmed the assumption that isolation equals safety, encouraging more sensitive data storage in exactly the wrong place. What to check: Review any network appliance where HTTP interfaces were added to non-web-native systems. Verify that path traversal protections exist not just at the isolation boundary but within any isolated component. Assume that data stored in any 'protected' file system accessible via HTTP is exposed to the internet. Treat the existence of an isolated file system as a signal to increase, not decrease, input validation scrutiny inside it.

Reviewed through automated stages and approved by a human before publication.