CVE-2023-29492
Novi Survey Insecure Deserialization Vulnerability
Description
CVE-2023-29492 is a critical code injection vulnerability in Novi Survey, a web-based survey platform, affecting versions prior to 8.9.43676. This flaw allows remote attackers to execute arbitrary code on the server in the context of the service account without requiring any authentication or user interaction. While exploitation of CVE-2023-29492 does not provide direct access to stored survey or response data, it grants full control over the underlying server, enabling further lateral movement and compromise. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of May 4, 2023. The EPSS score of 17.2% (95th percentile) indicates a high probability of exploitation, making immediate patching essential for organizations running Novi Survey.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| 3rdmill | novi survey | < 8.9.43676 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29492(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
In the context of CVE-2023-29492, the Novi Survey application fails to properly sanitize or validate user-supplied input before incorporating it into dynamically generated code that is executed on the server. This code injection weakness allows remote attackers to inject and execute arbitrary code within the server's service account context, bypassing the intended application logic entirely.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2023-29492 carries a CVSS v3.1 score of 9.8 (Critical severity), representing one of the most dangerous vulnerability profiles possible. Attack Vector (Network): the vulnerability is remotely exploitable without physical access, meaning any attacker with network connectivity to the Novi Survey instance can attempt exploitation. Attack Complexity (Low): no special conditions, timing, or configuration are required to exploit this flaw. Privileges Required (None): the attacker does not need any authentication or account credentials on the Novi Survey platform. User Interaction (None): no action by any user or administrator is required for the attack to succeed. Confidentiality, Integrity, and Availability (all High): successful exploitation grants the attacker arbitrary code execution on the server under the service account, potentially allowing theft of sensitive server-side data, modification of system files and configurations, and complete disruption of the survey service. The EPSS score of 17.2% places this vulnerability in the 95th percentile, indicating a high likelihood of exploitation activity across exposed Novi Survey instances.
Exploit Maturity
CVE-2023-29492 has been confirmed as actively exploited in the wild by CISA, which added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 4, 2023. Active Exploitation: the inclusion in the KEV catalog indicates that threat actors have successfully leveraged this code injection vulnerability against production Novi Survey installations. The EPSS score of 17.2% (95th percentile) further corroborates the high exploitation probability, indicating that this vulnerability is being actively targeted across the internet. The ransomware association is currently classified as unknown. No tagged public exploit code was identified in the available references, though the critical severity and low exploitation complexity make weaponization straightforward for attackers.
Remediation
- Upgrade Novi Survey to version 8.9.43676 or later immediately. The vendor has released a security patch addressing CVE-2023-29492 as detailed in the Novi Survey security advisory. CISA requires mitigations to be applied by May 4, 2023, or the product must be discontinued if mitigations are unavailable.
- Restrict network access to the Novi Survey instance. Place the Novi Survey server behind a web application firewall (WAF) and restrict inbound access to trusted IP ranges only. Block direct internet exposure of the survey management interface where possible.
- Implement input validation and code execution restrictions. As an interim mitigation, review server-side configurations to enforce strict input validation rules and disable any unnecessary dynamic code execution features on the web server hosting Novi Survey.
- Monitor for indicators of compromise. Review web server logs for unusual requests targeting Novi Survey endpoints, check for unauthorized processes or files created under the service account, and scan for webshells or backdoors that may have been deployed through prior exploitation.
- Apply defense-in-depth measures. Run the Novi Survey service under a least-privilege account, enable application-level logging and alerting, and segment the survey server network to limit the blast radius of any future compromise.
Technical Details
CVE-2023-29492 is a code injection vulnerability (CWE-94) in Novi Survey versions before 8.9.43676, where the application fails to properly control the generation and execution of server-side code. Vulnerability Mechanism: the flaw allows remote attackers to inject arbitrary code that is executed by the server within the context of the Novi Survey service account, likely through insufficient sanitization of input parameters that are incorporated into dynamically evaluated code paths. CVSS Vector Analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): the network attack vector combined with no authentication requirement and no user interaction creates a fully unauthenticated remote code execution scenario. The low attack complexity means that exploitation does not require specialized knowledge or environmental conditions. While the scope remains unchanged, the high impact across all three CIA triad dimensions means that the attacker achieves complete control over the server's confidentiality, integrity, and availability through the service account. Notably, the NVD description specifies that exploitation does not grant direct access to stored survey or response data, suggesting the code execution occurs in a context that is somewhat sandboxed from the application's data layer.
Frequently Asked Questions
Is CVE-2023-29492 being actively exploited?
Yes, CVE-2023-29492 is confirmed to be actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of May 4, 2023. The EPSS score of 17.2% (95th percentile) further confirms the high likelihood of exploitation.
What products are affected by CVE-2023-29492?
CVE-2023-29492 affects Novi Survey versions prior to 8.9.43676. Any organization running an older version of the Novi Survey web-based survey platform is vulnerable to this remote code execution flaw.
How do I fix CVE-2023-29492?
To fix CVE-2023-29492, upgrade Novi Survey to version 8.9.43676 or later as described in the vendor's security advisory. If upgrading is not immediately possible, restrict network access to the Novi Survey instance and implement WAF rules to filter malicious input. See the Remediation section for detailed steps.
How severe is CVE-2023-29492?
CVE-2023-29492 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It allows unauthenticated remote code execution on the server without any user interaction. The EPSS score of 17.2% places it in the 95th percentile for exploitation probability, making it a top-priority vulnerability for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.