CVE-2023-29492

What it actually does

CVE-2023-29492 is an unauthenticated remote code execution vulnerability affecting Novi Survey versions before 8.9.43676. A remote attacker can send crafted requests to the application and cause arbitrary code to run on the underlying server in the context of the Novi Survey service account. Because exploitation requires no authentication, no user interaction, and has low attack complexity, successful exploitation can provide control over the application host, including the ability to execute commands, modify application files, deploy malware or web shells, and pivot using the permissions available to the service account. The vendor notes that exploitation does not directly provide access to stored survey or response data, but compromise of the server may still expose configuration files, credentials, integrations, logs, and adjacent systems.

Why it matters to the business

This is a high-severity, internet-exploitable server compromise risk for organizations running Novi Survey before 8.9.43676. Since it is listed in CISA KEV with a remediation due date of 2023-05-04 and has been observed exploited in the wild, exposed systems should be treated as urgent even though the EPSS score is moderate. A successful attack could disrupt survey operations, deface or alter hosted content, install persistence, use the server as a foothold for broader intrusion, or damage trust in survey workflows. While the advisory states survey and response data are not directly exposed by the flaw itself, a compromised server can still create operational, legal, and reputational risk depending on what the host can access.

How an attack unfolds

An attacker identifies a publicly reachable Novi Survey instance and determines that it is running a vulnerable version earlier than 8.9.43676. The attacker sends a specially crafted request that triggers the vulnerable code path and causes the server to execute attacker-controlled commands under the Novi Survey service account. After initial code execution, the attacker typically performs discovery to determine the operating system, application path, service account privileges, network access, and available tools. If the server is Windows/IIS-hosted, post-exploitation often involves launching child processes from the web worker process, writing web shells or scripts into writable web directories, staging payloads through PowerShell or command-line download utilities, and attempting persistence. Because this vulnerability is in CISA KEV and has active in-the-wild exploitation, defenders should assume public-facing unpatched instances may have been probed or compromised and should review logs and host artifacts, not only apply the update.

How to fix it

Upgrade Novi Survey to version 8.9.43676 or later immediately. If an upgrade cannot be completed at once, remove the application from direct internet exposure, restrict access to trusted source IPs through a VPN or reverse proxy, and apply web application firewall controls to block suspicious crafted requests where feasible. Rotate credentials and secrets accessible to the Novi Survey service account, including database, SMTP, API, and integration credentials, after patching if compromise is suspected. Review and harden the service account so it has only the minimum privileges required, cannot perform interactive logon, and has limited write access outside required application directories. For systems exposed before remediation, perform compromise assessment before returning them to normal service because patching does not remove web shells, scheduled tasks, malware, or stolen credentials.

How to confirm the fix worked

Confirm the deployed Novi Survey version is 8.9.43676 or later through the application administration interface, installed product metadata, vendor-provided version files, or package inventory. Validate that no externally reachable instance remains on a version before 8.9.43676 by scanning public attack surface and internal network ranges. Confirm the web server and application pools/services have been restarted after upgrade. Test that unauthenticated requests to the application do not trigger unexpected server-side errors, command execution behavior, or anomalous child processes. Review file integrity in the Novi Survey application directories for recently modified ASPX, ASHX, DLL, config, script, archive, or executable files. If exposure existed while vulnerable, validate remediation with both vulnerability scanning and host-based forensic review rather than relying on version checks alone.

Typical attack path

1. Scan the internet or target network ranges for exposed Novi Survey applications.
2. Fingerprint the application version or infer vulnerability from response behavior and exposed assets.
3. Send a crafted unauthenticated request that triggers remote code execution.
4. Execute a simple command to validate control of the server process.
5. Run discovery commands to identify the host, user context, application paths, privileges, and network reachability.
6. Drop a web shell, script, or second-stage payload into a writable location if possible.
7. Use command interpreters or scripting engines such as cmd.exe, powershell.exe, or cscript.exe to download tools and establish persistence.
8. Attempt credential access, lateral movement, or further compromise using the permissions available to the service account.

How to detect it

To determine whether exploitation already occurred, review web server access logs, Novi Survey application logs, Windows Event Logs, endpoint detection telemetry, and file-system changes around the application directories. Focus on the period before patching and any time the application was reachable from untrusted networks. In IIS environments, inspect W3C logs for unusual unauthenticated POST requests, abnormal query strings or request bodies, repeated 500 responses, requests followed by new files appearing in web directories, and requests from scanning infrastructure. Correlate suspicious HTTP requests with process creation events showing the web worker process or Novi Survey service account launching command shells, scripting engines, download utilities, archive tools, or living-off-the-land binaries. Review Windows Security Event ID 4688, Sysmon Event ID 1, PowerShell logs, IIS logs, application pool logs, antivirus/EDR alerts, scheduled task creation, service creation, and outbound network connection telemetry. Hunt for recently created or modified ASPX/ASHX/ASMX files, DLLs, EXEs, scripts, archives, or suspicious configuration changes in the Novi Survey installation and web root. Check for signs of persistence such as new scheduled tasks, new services, startup-folder items, registry Run keys, unauthorized local users, or modified application files. Because active exploitation is known, absence of a public exploit string in logs should not be considered proof of safety; prioritize behavioral evidence such as web-to-command execution and unexpected file writes.

• w3wp.exe spawned cmd.exe
• w3wp.exe spawned powershell.exe
• w3wp.exe spawned powershell_ise.exe
• w3wp.exe spawned cscript.exe
• w3wp.exe spawned wscript.exe
• w3wp.exe spawned mshta.exe
• w3wp.exe spawned rundll32.exe
• w3wp.exe spawned regsvr32.exe
• w3wp.exe spawned certutil.exe
• w3wp.exe spawned bitsadmin.exe
• w3wp.exe spawned curl.exe
• w3wp.exe spawned wget.exe
• w3wp.exe spawned whoami.exe
• w3wp.exe spawned net.exe
• w3wp.exe spawned net1.exe
• w3wp.exe spawned nltest.exe
• w3wp.exe spawned ipconfig.exe
• w3wp.exe spawned tasklist.exe
• w3wp.exe spawned schtasks.exe
• w3wp.exe spawned sc.exe
• Event ID 4688 w3wp.exe cmd.exe
• Event ID 4688 w3wp.exe powershell.exe
• Sysmon Event ID 1 w3wp.exe cmd.exe
• Sysmon Event ID 1 w3wp.exe powershell.exe
• powershell.exe -EncodedCommand
• powershell.exe -enc
• powershell.exe -nop -w hidden
• certutil.exe -urlcache -split -f
• bitsadmin /transfer
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• cmd.exe /c schtasks
• cmd.exe /c powershell
• C:\inetpub\wwwroot\*.aspx
• C:\inetpub\wwwroot\*.ashx
• C:\inetpub\wwwroot\*.asmx
• C:\inetpub\wwwroot\App_Data\*.aspx
• C:\Windows\Temp\*.aspx
• C:\Windows\Temp\*.exe
• C:\Windows\Temp\*.ps1
• C:\Users\Public\*.exe
• C:\ProgramData\*.exe
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Immediately inventory all Novi Survey deployments, including internet-facing, internally hosted, test, and legacy instances.
• Patch all Novi Survey installations to 8.9.43676 or later; prioritize internet-facing systems first because this vulnerability is in CISA KEV and has active exploitation.
• If immediate patching is not possible, isolate the application from the internet and restrict access to known trusted networks until upgraded.
• Perform threat hunting on any instance that was exposed before patching, focusing on web server logs, application logs, process creation telemetry, new or modified files, and outbound network connections.
• Look for web server worker processes spawning command interpreters, scripting engines, archive tools, or network download utilities.
• Rotate credentials and secrets stored on or used by the Novi Survey server if there is evidence of exploitation or if logging is insufficient to rule it out.
• Review service account permissions and remove unnecessary local administrator rights, broad file-system write permissions, and unnecessary network access.
• Add monitoring rules for suspicious child processes from IIS or the Novi Survey service account and for unexpected writes to web-accessible directories.
• Preserve forensic images, relevant logs, and suspicious files before cleanup if compromise is suspected.
• Track CISA KEV status and ensure remediation records reflect that the KEV due date was 2023-05-04 for covered organizations.