CVE-2023-28461: Array Networks ArrayOS AG RCE Vulnerability

CVE-2023-28461 Overview

CVE-2023-28461 is a critical remote code execution vulnerability affecting Array Networks Array AG Series and vxAG SSL VPN gateway appliances running ArrayOS AG version 9.4.0.481 and earlier. The vulnerability allows unauthenticated remote attackers to browse the filesystem on the SSL VPN gateway by manipulating a flags attribute in an HTTP header. Once filesystem access is achieved, the product can be further exploited through a vulnerable URL, ultimately enabling remote code execution without any prior authentication.

This vulnerability is particularly dangerous because SSL VPN gateways are typically exposed to the internet and serve as critical access points for enterprise networks. Successful exploitation could allow attackers to gain complete control over the VPN appliance, potentially compromising the entire corporate network.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Unauthenticated attackers can achieve remote code execution on internet-facing SSL VPN appliances, potentially compromising enterprise network security perimeters.

Affected Products

• Array Networks ArrayOS AG (versions 9.4.0.481 and earlier)
• Array Networks AG1000, AG1000T, AG1000V5
• Array Networks AG1100V5, AG1150
• Array Networks AG1200, AG1200V5
• Array Networks AG1500, AG1500FIPS, AG1500V5
• Array Networks AG1600, AG1600V5
• Array Networks vxAG (virtual appliance)

Discovery Timeline

• 2023-03-09 - Array Networks releases vendor security advisory
• 2023-03-15 - CVE-2023-28461 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2023-28461

Vulnerability Analysis

This vulnerability falls under two critical CWE categories: CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function). The flaw exists in how the Array Networks SSL VPN gateway handles HTTP requests, specifically in the processing of certain HTTP header attributes.

The vulnerability allows an unauthenticated attacker to bypass authentication mechanisms entirely. By crafting malicious HTTP requests with specially manipulated flags attributes in the header, an attacker can traverse the filesystem of the SSL VPN gateway without providing valid credentials. This authentication bypass serves as the initial foothold that enables subsequent exploitation.

The attack is particularly severe because SSL VPN gateways are designed to be internet-accessible, providing remote access to internal networks. When these devices can be compromised without authentication, they transform from security infrastructure into attack vectors.

Root Cause

The root cause of CVE-2023-28461 lies in missing authentication checks for critical functionality within the ArrayOS AG firmware. The HTTP request handler fails to properly validate authentication state before processing certain request types, allowing the flags attribute manipulation to bypass security controls. Additionally, there appears to be insufficient input validation on HTTP header values, enabling the filesystem traversal component of the attack.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the SSL VPN gateway's web interface can exploit this vulnerability in the following manner:

1. The attacker identifies an internet-facing Array Networks AG Series or vxAG appliance
2. A specially crafted HTTP request is sent containing a manipulated flags attribute in the HTTP header
3. The malformed request bypasses authentication checks and allows filesystem browsing
4. The attacker identifies vulnerable URLs or sensitive configuration files
5. Through further exploitation of the vulnerable URL, remote code execution is achieved

The vulnerability requires no privileges, no user interaction, and can be exploited remotely over the network with low attack complexity. Due to the lack of verified exploit code, specific technical implementation details should be referenced from the Array Networks Security Advisory.

Detection Methods for CVE-2023-28461

Indicators of Compromise

• Unusual HTTP requests to the SSL VPN gateway containing malformed or unexpected flags attributes in headers
• Evidence of filesystem traversal attempts or access to sensitive system files via web requests
• Unexpected processes spawned by the VPN gateway web server
• Outbound network connections from the VPN appliance to suspicious external IP addresses
• Unauthorized configuration changes or new user accounts on the VPN appliance

Detection Strategies

• Monitor HTTP access logs for requests with unusual header attributes or patterns indicative of authentication bypass attempts
• Implement web application firewall (WAF) rules to detect and block requests with suspicious flags attributes in HTTP headers
• Deploy network intrusion detection systems (NIDS) with signatures for known CVE-2023-28461 exploitation patterns
• Enable and review authentication logs on Array Networks appliances for failed or bypassed authentication events

Monitoring Recommendations

• Configure real-time alerting for any unauthenticated access attempts to management interfaces
• Monitor process creation on VPN appliances for unexpected child processes of the web server
• Track network traffic anomalies from VPN gateway appliances, especially unexpected outbound connections
• Review system integrity by comparing filesystem snapshots against known-good baselines

How to Mitigate CVE-2023-28461

Immediate Actions Required

• Immediately upgrade all affected Array Networks AG Series and vxAG appliances to a patched firmware version above 9.4.0.481
• If patching is not immediately possible, restrict network access to the SSL VPN management interface to trusted IP addresses only
• Review access logs and system configurations for evidence of prior exploitation
• Implement additional network segmentation to limit lateral movement in case of compromise
• Monitor CISA KEV catalog updates and prioritize remediation as this vulnerability is actively exploited

Patch Information

Array Networks has released patched firmware versions to address this vulnerability. The vendor advisory dated 2023-03-09 indicated that new Array AG releases with the fix would be available. Organizations should obtain the latest firmware from the Array Networks Security Advisory or through the Array Networks support portal.

As this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance are required to remediate this vulnerability according to mandated timelines.

Workarounds

• Implement strict IP-based access control lists (ACLs) to limit VPN gateway access to known trusted networks
• Deploy a web application firewall (WAF) in front of the SSL VPN gateway to filter malicious HTTP requests
• Enable enhanced logging and monitoring on all Array Networks appliances to detect exploitation attempts
• Consider temporarily taking affected devices offline if they cannot be patched and alternative VPN solutions are available
• Conduct incident response investigation on any potentially compromised appliances before returning to production

# Example: Restrict management access via firewall rules (adjust for your environment)
# Block direct internet access to VPN management interface
iptables -A INPUT -p tcp --dport 443 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 443 -s <TRUSTED_ADMIN_NETWORK> -j ACCEPT

# Enable comprehensive logging for Array Networks appliance
# Consult Array Networks documentation for device-specific logging commands