CVE-2023-28365
📋 TL;DR
This vulnerability allows authenticated UniFi application administrators to execute arbitrary commands on the host system during backup restoration. It affects UniFi applications version 7.3.83 and earlier running on Linux systems.
💻 Affected Systems
- UniFi Network Application
- UniFi Protect
- UniFi Access
- UniFi Talk
- UniFi Connect
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level command execution, allowing attackers to install persistent backdoors, exfiltrate data, or pivot to other network systems.
Likely Case
Privilege escalation from application administrator to host system root access, enabling lateral movement within the network.
If Mitigated
Limited to application compromise if proper network segmentation and least privilege controls are implemented.
🎯 Exploit Status
Exploitation requires authenticated administrator access to the UniFi application interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.3.85 and later
Vendor Advisory: https://community.ui.com/releases/Security-Advisory-Bulletin-031-031/8c85fc64-e9a8-4082-9ec4-56b14effd545
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update UniFi application to version 7.3.85 or later. 3. Restart the UniFi application service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Backup File Sources
allOnly restore backup files from trusted sources and validate backup integrity before restoration.
Network Segmentation
allIsolate UniFi application servers from critical infrastructure using firewall rules.
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the UniFi application administration interface.
- Monitor for suspicious backup restoration activities and command execution attempts on the host system.
🔍 How to Verify
Check if Vulnerable:
Check UniFi application version via web interface or command line. If version is 7.3.83 or earlier on Linux, system is vulnerable.Check Version:
dpkg -l | grep unifi or check version in UniFi web interface under Settings > SystemVerify Fix Applied:
Confirm UniFi application version is 7.3.85 or later and test backup restoration functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual backup restoration activities
- Suspicious command execution in system logs following backup operations
- Authentication logs showing unexpected administrator access
Network Indicators:
- Unusual outbound connections from UniFi application server
- Traffic patterns indicating data exfiltration
SIEM Query:
source="unifi.log" AND ("backup restore" OR "command execution") OR source="syslog" AND process="unifi" AND ("exec" OR "system")