CVE-2023-27753: MK-Auth 23.01K4.9 RCE Vulnerability

CVE-2023-27753 Overview

CVE-2023-27753 is an arbitrary file upload vulnerability in MK-Auth 23.01K4.9, an ISP management platform widely deployed by internet service providers. The flaw allows authenticated attackers to upload crafted PHP files and achieve arbitrary code execution on the underlying web server. The vulnerability is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 3.1 base score of 8.0. Public proof-of-concept code exists in a GitHub PoC Repository, increasing the risk of opportunistic exploitation against exposed MK-Auth instances.

Critical Impact
Successful exploitation yields arbitrary code execution as the web server user, enabling full compromise of the MK-Auth host and any subscriber data it manages.

Affected Products

MK-Auth 23.01K4.9
MK-Auth ISP management web interface
PHP-based upload handlers exposed by MK-Auth

Discovery Timeline

2026-05-12 - CVE-2023-27753 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2023-27753

Vulnerability Analysis

The vulnerability resides in an MK-Auth file upload handler that fails to validate the type, extension, or content of files submitted by authenticated users. Attackers can submit a PHP file through the upload endpoint and reach it directly via the web root. Because the handler stores uploads in a web-accessible directory and does not block executable script extensions, the server interprets and executes the attacker-controlled payload on request.

The CVSS vector indicates network-based exploitation, low attack complexity, low privileges, and user interaction. An attacker needs valid low-privileged credentials and must induce an action that triggers the upload workflow. Successful exploitation produces complete loss of confidentiality, integrity, and availability on the affected host.

The EPSS probability is 0.044% as of 2026-05-17, reflecting limited observed exploitation activity, though public proof-of-concept code is available.

Root Cause

The root cause is unrestricted file upload [CWE-434]. The application accepts files without enforcing an allowlist of extensions or validating MIME types, and it writes uploads to a directory served by the PHP interpreter. No server-side rewrite rules block .php execution under the upload path.

Attack Vector

An attacker with low-privileged MK-Auth credentials authenticates to the web interface, navigates to the vulnerable upload feature, and submits a crafted PHP webshell. The attacker then requests the uploaded file URL to execute commands in the context of the web server. Technical exploitation details are documented in the GitHub README Documentation.

Detection Methods for CVE-2023-27753

Indicators of Compromise

New or unexpected .php, .phtml, or .phar files created under MK-Auth upload directories or web roots.
Web access logs showing GET requests to recently created PHP files in upload paths, often followed by command-style query parameters (cmd=, exec=, c=).
Outbound connections from the MK-Auth web server process to unfamiliar IP addresses or reverse-shell listeners.
Unexpected child processes spawned by the PHP-FPM or Apache user, such as sh, bash, nc, wget, or curl.

Detection Strategies

Hunt for file write events from the web server user that create files with script extensions inside the MK-Auth document root.
Inspect HTTP request bodies submitted to MK-Auth upload endpoints for PHP tags (<?php) or known webshell signatures.
Correlate authentication events with subsequent upload activity to flag low-privileged accounts performing administrative-style actions.

Monitoring Recommendations

Enable verbose web server access logging and forward logs to a centralized analytics platform for retention and search.
Monitor process lineage on the MK-Auth host to flag shell processes descending from PHP workers.
Alert on integrity changes to MK-Auth installation directories using file integrity monitoring.

How to Mitigate CVE-2023-27753

Immediate Actions Required

Restrict access to the MK-Auth management interface to trusted management VLANs and VPN endpoints only.
Audit MK-Auth user accounts and rotate credentials for any low-privileged accounts that could reach the upload feature.
Inspect upload directories for unknown PHP files and remove any unauthorized artifacts immediately.

Patch Information

No vendor advisory or fixed version is referenced in the published CVE record. Administrators should consult the MK-Auth vendor directly for an updated build that supersedes 23.01K4.9 and addresses [CWE-434] in the upload handler.

Workarounds

Configure the web server to deny execution of PHP files within MK-Auth upload directories using php_admin_flag engine off in Apache or a location block with fastcgi_pass disabled in nginx.
Apply a server-side extension allowlist at a reverse proxy or web application firewall to block uploads of .php, .phtml, .phar, and double-extension files.
Run the MK-Auth web service under a low-privileged account with no write access to the document root outside of explicitly required directories.

bash

# Example nginx configuration to block PHP execution under MK-Auth upload paths
location ~* ^/mk-auth/uploads/.*\.(php|phtml|phar|php5|php7)$ {
    deny all;
    return 403;
}