CVE-2023-29492
📋 TL;DR
CVE-2023-29492 is a critical remote code execution vulnerability in Novi Survey software that allows attackers to execute arbitrary commands on affected servers. This affects all organizations running vulnerable versions of Novi Survey, potentially compromising the entire server environment. The vulnerability does not provide direct access to survey data but allows full server control.
💻 Affected Systems
- Novi Survey
📦 What is this software?
Novi Survey by 3rdmill
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data exfiltration, ransomware deployment, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Attackers gain initial foothold on the server, install cryptocurrency miners or malware, and potentially pivot to other systems in the network.
If Mitigated
Attack is blocked at network perimeter, or server is isolated preventing lateral movement, limiting impact to single system.
🎯 Exploit Status
CISA has added this to their Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. The high CVSS score and CWE-94 (Code Injection) suggest straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.9.43676 and later
Vendor Advisory: https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx
Restart Required: Yes
Instructions:
1. Download Novi Survey version 8.9.43676 or later from official vendor sources. 2. Backup current installation and data. 3. Run the installer to upgrade. 4. Restart the Novi Survey service. 5. Verify the version is updated.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to Novi Survey instances using firewall rules
# Windows Firewall: New-NetFirewallRule -DisplayName "Block Novi Survey" -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Block
# Linux iptables: iptables -A INPUT -p tcp --dport 80 -j DROP && iptables -A INPUT -p tcp --dport 443 -j DROP
Application Layer Filtering
allImplement WAF rules to block suspicious requests
# Example ModSecurity rule: SecRule ARGS "@rx malicious_pattern" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Immediately isolate affected systems from the internet and restrict internal network access
- Implement strict network segmentation and monitor for suspicious outbound connections
🔍 How to Verify
Check if Vulnerable:
Check Novi Survey version in administration panel or by examining installed files. Versions below 8.9.43676 are vulnerable.Check Version:
Check Novi Survey web interface admin panel or examine version.txt in installation directoryVerify Fix Applied:
Verify version is 8.9.43676 or higher in administration interface and check that all services are running normally.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation events from Novi Survey service account
- Suspicious command execution in web server logs
- Failed authentication attempts followed by successful exploitation
Network Indicators:
- Outbound connections from Novi Survey server to suspicious IPs
- Unusual traffic patterns from Novi Survey ports
- Command and control beaconing behavior
SIEM Query:
source="novi-survey-logs" AND (event_type="process_creation" OR cmdline="*powershell*" OR cmdline="*cmd.exe*")