A security researcher has recently disclosed an exploit for a previously patched Cisco vulnerability.
The vulnerability in question is identified as CVE-2023-20178 and is categorized as a privilege escalation bug.
Cisco’s advisory explains that the vulnerability affects the client update process of two software products: Cisco AnyConnect secure mobility client software for Windows and Cisco Secure Client software for Windows. It enables a low-privileged attacker who is already authenticated and has local access to elevate their privileges to SYSTEM level.
According to Cisco, the client update process takes place after a successful VPN connection is established. The vulnerability stems from improper permissions assigned to a temporary directory created during the update process. By exploiting a specific function of the Windows installer process, an attacker could execute code with SYSTEM privileges.
Filip Dragovic, credited with discovering the vulnerability, has shared a proof-of-concept on GitHub. Dragovic identifies the issue in the vpndownloader.exe process responsible for updating the client software during launch. The updater generates a temporary directory, which is deleted if no updates are available. Dragovic highlights the potential for abusing this behavior to perform arbitrary file deletion under the NT Authority\SYSTEM account. The arbitrary file deletion can then be exploited to initiate system cmd processes by manipulating Windows installer behavior.
This type of arbitrary delete vulnerability can lead to privilege escalation by removing a high-privilege directory and replacing it with a similarly named low-privilege directory, as explained in an article by the Zero Day Initiative.
It’s important to note that this vulnerability has already been patched by Cisco. However, the disclosure of the exploit highlights the significance of promptly installing security updates and patches to mitigate potential risks.
