CVE-2023-22773
📋 TL;DR
This CVE describes an authenticated path traversal vulnerability in ArubaOS command line interface that allows authenticated attackers to delete arbitrary files on the underlying operating system. It affects Aruba networking devices running vulnerable versions of ArubaOS. Attackers need valid credentials to exploit this vulnerability.
💻 Affected Systems
- ArubaOS
📦 What is this software?
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Sd Wan by Arubanetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to device bricking, service disruption, or enabling further attacks by removing security controls.
Likely Case
Service disruption through deletion of configuration files, logs, or application files, potentially causing network outages or loss of critical data.
If Mitigated
Limited impact with proper access controls, monitoring, and file integrity checks in place to detect and prevent unauthorized file deletions.
🎯 Exploit Status
Exploitation requires authenticated CLI access. The vulnerability is in the path validation logic of certain CLI commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ArubaOS 10.3.1.1, 10.2.2.1, 8.11.2.1, 8.10.0.8, 8.9.0.15, 8.8.0.14, 8.7.1.10, 8.6.0.20, 8.5.0.17, 8.4.0.11
Vendor Advisory: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt
Restart Required: Yes
Instructions:
1. Download appropriate patched version from Aruba support portal. 2. Backup current configuration. 3. Upload and install new firmware. 4. Reboot device. 5. Verify version and functionality.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit CLI access to trusted administrators only using role-based access controls and network segmentation.
configure terminal
aaa authentication login default local
aaa authorization exec default local
aaa authorization commands 15 default local
username admin privilege 15 secret yourpassword
Enable Command Authorization
allImplement command authorization to restrict which commands users can execute.
configure terminal
aaa authorization config-commands
aaa authorization commands 1 default local
aaa authorization commands 15 default local
🧯 If You Can't Patch
- Implement strict access controls and monitor for suspicious file deletion activities
- Deploy file integrity monitoring and regular backups of critical configuration files
🔍 How to Verify
Check if Vulnerable:
Check ArubaOS version via CLI: 'show version' and compare against affected versions list.Check Version:
show versionVerify Fix Applied:
Verify installed version is patched: 'show version' should show patched version. Test CLI commands that previously allowed path traversal.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in system logs
- Multiple failed authentication attempts followed by successful CLI access
- CLI commands with unusual file paths or '../' sequences
Network Indicators:
- Unusual CLI access patterns from unexpected IP addresses
- Increased management interface traffic
SIEM Query:
source="aruba_logs" AND (event_type="file_deletion" OR command="*../*")