CVE-2023-52252: Unified Remote - Web Triggerable Remote Code Execution

Field	Value
CVE	CVE-2023-52252
Affected Software	Unified Remote Server (Windows), versions up to and including 3.13.0
Vulnerability Type	Path Traversal leading to Arbitrary File Write and Remote Code Execution
CVSS 3.1 Estimate	9.8 (Critical) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor	Unified Intents AB
Status	Fixed in later releases

Summary

Unified Remote Server versions up to 3.13.0 contain a path traversal vulnerability in the built-in web server component. The web interface, which serves static files for the browser-based remote control panel, does not adequately validate requested file paths. An unauthenticated attacker on the local network - or any network where the Unified Remote web port is reachable - can exploit this flaw to read arbitrary files from the host system and, critically, write arbitrary files to attacker-controlled paths. The write primitive enables straightforward escalation to remote code execution.

Background

Unified Remote is a popular application that turns a smartphone into a remote control for a Windows PC. It runs a persistent background server on the target machine, typically listening on TCP port 9510 (for the proprietary remote protocol) and TCP port 9512 (for the web-based management interface). The web interface allows configuration and also serves as a fallback remote when native apps are unavailable.

By design, the web server component serves static assets (HTML, CSS, JavaScript) from a known directory within the Unified Remote installation folder. When a browser requests a resource, the server resolves the file path relative to this base directory and returns its contents.

Vulnerability Details

The path resolution logic in the Unified Remote web server did not properly sanitize user-supplied path components. Specifically, the server failed to reject or neutralize directory traversal sequences such as ../ within HTTP request URIs. This meant that a crafted request could escape the intended web root and reference any file accessible to the process.

Because the Unified Remote server typically runs with the privileges of the logged-in user - and in many configurations, with elevated privileges - the traversal grants access to a wide range of sensitive files on the system.

More significantly, certain API endpoints exposed by the web server accepted file write operations. These endpoints were intended for legitimate management functions such as updating configuration files. However, the same path traversal flaw applied to these write-capable endpoints, meaning an attacker could place arbitrary content at any writable path on the filesystem.

Attack Scenario

An attacker with network access to port 9512 could exploit this vulnerability through the following general approach:

Reconnaissance - Send a crafted GET request with traversal sequences to confirm the vulnerability and identify the server's installation path and operating system details. For example, reading the win.ini file or other known Windows system files confirms both the traversal and the OS environment.
File Write - Use a write-capable endpoint with traversal sequences to place a payload in a location that will be automatically executed. Suitable targets include:
- The current user's Startup folder (AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup)
- Scheduled task definitions
- Unified Remote's own plugin directory, where .lua scripts are loaded and executed by the server
Execution - Depending on the chosen write target, code execution occurs either immediately (plugin directory) or upon next login/reboot (Startup folder). The payload runs with the same privileges as the Unified Remote server process.

The entire chain requires no authentication. The web server interface does not enforce any credential checks in the affected versions. An attacker needs only network reachability to the web port.

Network Exposure

While Unified Remote's web server binds to the local network interface by default, several factors increase the practical attack surface:

Many users configure port forwarding to access their machine remotely, exposing the web port to the internet.
In corporate environments, the port may be reachable across internal network segments without additional firewall rules.
On shared networks (cafes, hotels, coworking spaces), any device on the same subnet can reach the port.

In configurations where the web port is exposed to the internet, this vulnerability is exploitable by any remote attacker with no prior access, justifying the Critical severity rating.

Impact

Successful exploitation allows an unauthenticated attacker to:

Read arbitrary files from the host system, including configuration files, credentials, documents, and private keys.
Write arbitrary files to any writable location on the filesystem.
Execute arbitrary code on the host system with the privileges of the Unified Remote server process, typically the logged-in user account.

This constitutes a full compromise of the affected system from a network-adjacent or remote position, depending on network configuration.

Proof of Concept

A proof of concept was developed to validate the vulnerability. The PoC consisted of standard HTTP requests with directory traversal sequences in the URI path. A simple Python script using the requests library was sufficient to demonstrate both the read and write primitives. The write PoC placed a benign text file outside the web root to confirm arbitrary file write without causing harm to the test system.

Weaponized exploit code is intentionally withheld from this advisory.

Disclosure Timeline

Date	Event
Late 2022	Vulnerability discovered during routine assessment of desktop remote control applications
January 2023	Initial vendor notification sent via available contact channels
February 2023	Follow-up communication with vendor
March 2023	Public disclosure after coordination period
January 2024	CVE-2023-52252 assigned by MITRE

Vendor Response

The Unified Remote development team was notified through their available communication channels. The vendor acknowledged the report. Users are advised to update to the latest available version of Unified Remote Server and to review their network configuration to ensure the web management port is not unnecessarily exposed.

Remediation

Update Unified Remote Server to the latest available version.
Restrict network access to the web management interface (port 9512) using host-based firewall rules. Bind the listener to localhost if remote web access is not required.
Audit firewall and port forwarding rules to ensure the Unified Remote web port is not exposed to untrusted networks.
Monitor the Unified Remote installation directory and Windows Startup folders for unexpected file modifications.