CVE-2023-28461

What it actually does

CVE-2023-28461 is an unauthenticated critical-function authentication bypass in Array Networks Array AG Series and vxAG SSL VPN gateways running ArrayOS 9.4.0.481 and earlier. A remote attacker can send crafted HTTP requests containing a malicious flags attribute in an HTTP header to browse the appliance filesystem without logging in. That file-access primitive can expose sensitive appliance files, configuration, credentials, session material, or keys, and may be chained through a vulnerable URL to achieve remote code execution on the VPN gateway. Because the device is commonly internet-facing and sits at the network edge, successful exploitation can give an attacker a foothold on a trusted access appliance.

Why it matters to the business

Compromise of an SSL VPN gateway can expose remote-access credentials, enable unauthorized access into internal networks, disrupt employee and third-party connectivity, and support ransomware intrusion paths. This vulnerability is listed in CISA KEV, has been exploited in the wild, is associated with ransomware activity, and had a CISA remediation due date of 2024-12-16, making any remaining exposed instance a high-priority operational risk. Affected products include Array Networks AG Series appliances and vxAG virtual gateways across multiple AG models, so organizations using Array remote-access infrastructure should assume broad exposure until versions and controls are verified.

How an attack unfolds

An attacker first identifies an internet-exposed Array AG or vxAG SSL VPN service, typically by scanning for the appliance web interface or TLS/service fingerprints. The attacker then sends unauthenticated HTTP requests to the vulnerable VPN gateway, adding a crafted flags attribute in an HTTP header to cause the appliance to read or browse filesystem content. The attacker uses this access to enumerate sensitive files such as configuration, credentials, keys, logs, session data, or other appliance internals. If exploitable paths are present, the attacker then sends requests to the vulnerable URL path to move from file access to command execution. After code execution, the attacker may deploy a web shell or backdoor, harvest VPN credentials and session tokens, pivot through the trusted remote-access device into internal networks, and use the appliance as a staging point for ransomware or broader intrusion activity.

How to fix it

Upgrade affected Array Networks AG Series and vxAG appliances running ArrayOS 9.4.0.481 or earlier to a vendor-fixed release. If a fixed version is not clearly identified in asset inventory or vendor documentation, contact Array Networks support and apply the latest security-maintenance release available for the exact appliance model. Treat all exposed versions at or below 9.4.0.481 as vulnerable until proven otherwise. If immediate upgrade is not possible, remove the SSL VPN interface from direct internet exposure, restrict access to trusted source IP ranges, place the service behind protective controls where feasible, block requests containing suspicious flags header attributes and traversal patterns, disable unnecessary administrative interfaces, and increase monitoring. Because the vulnerability is in CISA KEV and associated with ransomware campaigns, do not rely on network filtering as a long-term substitute for patching. For appliances that show signs of compromise, preserve forensic evidence, rotate VPN credentials and appliance secrets, review active sessions and accounts, and consider rebuilding or replacing the appliance from trusted media after applying fixed firmware.

How to confirm the fix worked

Confirm each Array AG or vxAG appliance model and ArrayOS version through the appliance management interface, CLI, or vendor-supported inventory method, and verify it is no longer running 9.4.0.481 or earlier. Validate that the internet-exposed SSL VPN service is either upgraded, restricted to approved source networks, or removed from exposure. From a controlled test host, send benign unauthenticated requests containing a flags header attribute and confirm the appliance does not disclose filesystem content and returns an expected denial or safe error response. Review external attack-surface scans to ensure no forgotten AG or vxAG appliances remain exposed. Validate WAF, reverse-proxy, IDS, or firewall rules by confirming that requests with flags header attributes, directory traversal strings, and sensitive file probes are logged or blocked. For post-remediation assurance, compare appliance file integrity, user accounts, scheduled tasks, startup scripts, and configuration against a known-good baseline.

Typical attack path

1. Scan the internet for exposed Array Networks AG Series or vxAG SSL VPN web services.
2. Fingerprint the appliance and determine whether it is running ArrayOS 9.4.0.481 or earlier, or otherwise appears unpatched.
3. Send unauthenticated HTTP requests containing a crafted flags attribute in an HTTP header to trigger unauthorized filesystem browsing.
4. Read sensitive files from the appliance, such as configuration, credential, key, log, or session-related files.
5. Use exposed information and the vulnerable URL path to attempt remote code execution on the gateway.
6. Establish persistence through a web shell, modified startup scripts, new accounts, or other appliance-resident backdoors.
7. Harvest VPN credentials or session material and use the compromised gateway to access downstream internal systems.
8. Conduct lateral movement, data theft, disruption, or ransomware deployment.

How to detect it

Hunt for prior exploitation in SSL VPN HTTP access logs, reverse-proxy logs, WAF logs, firewall logs, IDS/IPS telemetry, ArrayOS administrative and system logs, authentication logs, and network flow data. Focus on unauthenticated external requests containing a flags attribute in an HTTP header, especially when paired with directory traversal strings, attempts to read Unix-like sensitive files, unusual 200 responses to unauthenticated requests, or bursts of filesystem-enumeration activity. Review logs for requests to vulnerable VPN URLs followed by process execution, configuration changes, new files, suspicious downloads, or outbound connections from the appliance. If command execution occurred, look for web-server or VPN-service parent processes spawning shells or utilities such as sh, bash, wget, curl, chmod, busybox, nc, or python. Examine appliance filesystem artifacts for unexpected files in web-accessible directories, temporary directories, modified startup scripts, unauthorized accounts, altered VPN configuration, and unexpected SSH keys. Correlate suspicious requests with subsequent successful VPN logins, new administrative sessions, credential changes, MFA bypass events, internal scanning, or ransomware precursor behavior. Given KEV and ransomware association, absence of a single explicit IOC should not be treated as proof of safety; combine version validation, exposure history, and forensic review.

• flags=
• flags:
• ../
• ..%2f
• %2e%2e%2f
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• /proc/mounts
• /var/log/
• /tmp/
• /var/tmp/
• /bin/sh
• /bin/bash
• wget
• curl
• chmod +x
• busybox
• nc -e
• ArrayOS 9.4.0.481

What your security team should do

• Immediately inventory all Array Networks AG Series and vxAG appliances, including virtual appliances, internet-facing appliances, and appliances in standby or disaster-recovery roles.
• Prioritize remediation for any ArrayOS instance running 9.4.0.481 or earlier, especially internet-exposed SSL VPN gateways.
• Apply the latest vendor-fixed ArrayOS release or obtain model-specific remediation guidance from Array Networks support where fixed-version metadata is not available.
• Because this issue is in CISA KEV, actively exploited, and associated with ransomware, treat any still-vulnerable public appliance as potentially compromised until reviewed.
• If patching cannot be completed immediately, restrict access to the SSL VPN service to trusted source IP ranges and block suspicious flags header and path traversal requests at perimeter controls.
• Perform retrospective threat hunting across VPN, web access, reverse proxy, IDS, firewall, and endpoint telemetry for unauthenticated requests using flags headers, filesystem traversal, and sensitive file access attempts.
• Rotate appliance administrative credentials, VPN user credentials, API secrets, certificates, and keys if exploitation is suspected or cannot be ruled out.
• Review the appliance for unauthorized accounts, active sessions, web shells, modified configuration, unknown startup entries, and unexpected outbound connections.
• Consider rebuilding or replacing any appliance with strong indicators of compromise rather than relying only on cleanup.
• Add continuous external attack-surface monitoring for Array AG/vxAG exposure and alert on reappearance of vulnerable versions.