CVE-2023-20040 Path traversal in Cisco Network Services Orchestrator
An authenticated admin can cause denial of service by uploading crafted packages that write or delete arbitrary files via NETCONF.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-20040?
CVE-2023-20040 is a medium-severity path traversal vulnerability in Cisco Network Services Orchestrator, published on 19 Jan 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service (DoS) on an affected system that is running as the root user. To exploit this vulnerability, the attacker must be a member of the admin group. This vulnerability exists because user-supplied input is not properly validated when NETCONF is used to upload packages to an affected device. An attacker could exploit this vulnerability by uploading a specially crafted package file. A successful exploit could allow the attacker to write crafted files to arbitrary locations on the filesystem or delete arbitrary files from the filesystem of an affected device, resulting in a DoS condition. Note: By default, during install, Cisco NSO will be set up to run as the root user unless the --run-as-user option is used.
Which versions are affected by CVE-2023-20040?
It affects 1 product.
Products include Cisco Network Services Orchestrator.
How do I fix CVE-2023-20040?
No fix has been published for CVE-2023-20040 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-20040 being exploited?
There is no known exploitation of CVE-2023-20040 in the wild and no public exploit code.
Other vulnerabilities in Cisco Network Services Orchestrator
- CVE-2018-0274 Command injection in Cisco Network Services Orchestrator unknown
- CVE-2024-20366 Privilege escalation in Cisco Network Services Orchestrator
- CVE-2018-0463 Cisco Network Services Orchestrator Network Plug and Play Information Disclosure Vulnerability
- CVE-2021-1132 Cisco Network Services Orchestrator Path Traversal Vulnerability
- CVE-2024-20369 Open redirect in Cisco Network Services Orchestrator
Sources
Also known as GHSA-v96g-9h62-76pj.