Exploit released for Cisco AnyConnect bug giving SYSTEM privileges

Proof-of-concept exploit code is now available for a high-severity flaw in Cisco Secure Client Software for Windows (formerly AnyConnect Secure Mobility Client) that can let attackers elevate privileges to SYSTEM.

Cisco Secure Client helps employees to work from anywhere using a secure Virtual Private Network (VPN) and provides network admins with telemetry and endpoint management features.

The vulnerability (tracked as CVE-2023-20178) can let authenticated threat actors escalate privileges to the SYSTEM account used by the Windows operating system in low-complexity attacks that don't require user interaction.

Successful exploitation requires abusing what Cisco describes as a "specific function of the Windows installer process."

Cisco released security updates to address this security bug last Tuesday when it said its Product Security Incident Response Team (PSIRT) did not have evidence of malicious use or public exploit code targeting the bug in the wild.

CVE-2023-20178 was fixed with the release of AnyConnect Secure Mobility Client for Windows 4.10MR7 and Cisco Secure Client for Windows 5.0MR2.

​Earlier this week, proof-of-concept (PoC) exploit code was published by security researcher Filip Dragović who found and reported the Arbitrary File Delete vulnerability to Cisco.

As Dragović explains, this PoC was tested against Cisco Secure Client (tested on 5.0.01242) and Cisco AnyConnect (tested on 4.10.06079).

"When a user connects to vpn, vpndownloader.exe process is started in [the] background, and it will create [a] directory in c:\windows\temp with default permissions in [the] following format: <random numbers>.tmp," the researcher says.

"After creating this directory vpndownloader.exe will check if that directory is empty, and if it's not, it will delete all files/directories in there. This behavior can be abused to perform arbitrary file delete as NT Authority\SYSTEM account."

The attacker can then spawn a SYSTEM shell through arbitrary file deletion by taking advantage of this Windows installer behavior and the fact that a client update process is executed after each successful VPN connection, using the technique described here to escalate privileges.

In October, Cisco warned customers to patch two more AnyConnect security flaws (with public exploit code and fixed three years before) because of active exploitation in attacks.

Two years ago, Cisco patched an AnyConnect zero-day with public exploit code in May 2021, six months after its initial disclosure in November 2020,