CVE-2023-41721: UniFi Network Application Auth Bypass

CVE-2023-41721 Overview

CVE-2023-41721 is an improper access control vulnerability affecting Ubiquiti's UniFi Network Application when running on UniFi Gateway Console devices. Versions 7.5.176 and earlier implement device adoption with improper access control logic, creating a risk of unauthorized access to device configuration information by malicious actors who already have network access.

This vulnerability specifically impacts the device adoption process, which is a critical function in UniFi network infrastructure that allows network administrators to add and configure new devices. The flawed access control implementation could allow an attacker with preexisting network access to obtain sensitive device configuration data without proper authorization.

Critical Impact

Attackers with network access can potentially retrieve device configuration information through the improperly secured device adoption mechanism, exposing sensitive network infrastructure details.

Affected Products

• UniFi Network Application versions 7.5.176 and earlier (when run on UniFi Gateway Console)
• UniFi Dream Machine (UDM)
• UniFi Dream Machine Pro (UDM-PRO)
• UniFi Dream Machine Special Edition (UDM-SE)
• UniFi Dream Router (UDR)
• UniFi Dream Wall (UDW)

Discovery Timeline

• October 25, 2023 - CVE-2023-41721 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-41721

Vulnerability Analysis

The vulnerability resides in the device adoption workflow of the UniFi Network Application. Device adoption is the process by which UniFi network controllers discover and configure network devices such as access points, switches, and gateways. This process inherently involves the exchange of configuration data between the controller and the adopting device.

The improper access control implementation fails to adequately validate whether requests to access device configuration information during the adoption process originate from authorized sources. This design flaw means that an attacker who has already gained access to the network could potentially intercept or request device configuration data.

The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the software does not properly restrict access to resources from unauthorized actors.

Root Cause

The root cause of CVE-2023-41721 is improper access control logic in the device adoption mechanism. The UniFi Network Application versions 7.5.176 and earlier do not implement sufficient authorization checks when processing device adoption requests. This allows network-adjacent attackers to potentially access configuration information that should be restricted to authenticated administrators.

The flaw appears to be a design-level issue where the assumption was made that network access alone provides sufficient authorization for device adoption activities, without implementing proper authentication and authorization controls.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker must first obtain access to the target network where the vulnerable UniFi Gateway Console is operating. Once on the network, the attacker can exploit the improper access control in the device adoption process.

The attack does not require user interaction or elevated privileges to execute once network access is established. However, the scope is limited to information disclosure rather than system compromise, as the vulnerability only exposes device configuration information rather than enabling code execution or system modification.

Detection Methods for CVE-2023-41721

Indicators of Compromise

• Unusual device adoption requests from unknown network endpoints
• Unexpected queries to UniFi Network Application APIs related to device configuration
• Network traffic anomalies indicating unauthorized device discovery or adoption attempts
• Log entries showing device adoption activities from unauthorized IP addresses

Detection Strategies

• Monitor UniFi Network Application logs for suspicious device adoption activities from unexpected sources
• Implement network segmentation monitoring to detect unauthorized access to management network segments
• Deploy network traffic analysis to identify anomalous communication patterns with UniFi controller endpoints
• Review access logs for configuration data requests that don't correlate with legitimate administrative activities

Monitoring Recommendations

• Enable verbose logging on UniFi Network Application to capture detailed device adoption events
• Configure alerts for device adoption activities occurring outside of maintenance windows
• Implement continuous monitoring of network segments where UniFi Gateway Consoles reside
• Regularly audit device adoption history for any unauthorized or suspicious entries

How to Mitigate CVE-2023-41721

Immediate Actions Required

• Update UniFi Network Application to version 7.5.187 or later immediately
• Audit current device adoption logs for any suspicious activity
• Verify that management network segments are properly isolated from untrusted networks
• Review and restrict network access to UniFi Gateway Console management interfaces

Patch Information

Ubiquiti has released UniFi Network Application version 7.5.187 which addresses this vulnerability. The patch implements proper access control logic for the device adoption process, ensuring that only authorized actors can access device configuration information.

Administrators should update their UniFi Network Application to version 7.5.187 or later through the standard update mechanism on their UniFi Gateway Console devices. Detailed patch information is available in the UI Security Advisory Bulletin 036.

Workarounds

• Implement strict network segmentation to isolate UniFi management traffic from general network access
• Use VLAN isolation to restrict access to the network segments where device adoption occurs
• Implement firewall rules to limit access to UniFi controller ports from trusted management IPs only
• Enable additional authentication mechanisms at the network level for management access

# Example: Network isolation configuration for UniFi management
# Restrict access to UniFi controller management ports
# Apply these rules on your network firewall/router

# Block external access to UniFi controller ports
# Port 8443 - UniFi Application HTTPS Portal
# Port 8080 - Device communication (adoption)
# Port 8880 - HTTP portal redirect
# Port 8843 - HTTPS portal redirect

# Only allow management traffic from trusted admin VLAN (example: 192.168.10.0/24)
# Deny all other access to these ports from untrusted networks