NoxField QuickMiner Insecure Update Mechanism Leads to RCE (CVE-2023-6666)

Key Information Vulnerability Overview Vulnerability Name: Hacking the Miner: Evil Clickjacking in NoxField QuickMiner Discovery Date: 2023-07-01 Disclosure Date: 2023-08-01 Security Type: Critical Security Code Execution Discoverer: Prince Philip (Independent Security Researcher) Vulnerability Details Vulnerability Type: Improper Input Validation / Insecure Update Mechanism CVE ID: CVE-2023-6666 Impact: Remote Code Execution (RCE) Risk Level: Informal Risk Score Description Attack Vector: The attacker can trick a user into clicking on a malicious link. Update Mechanism: When the update mechanism performs software updates over HTTP instead of HTTPS, it fails to validate digital signatures or hash checks. This allows an adversary to inject a rogue update with malware. Technical Description When the software checks for updates, if the update server does not use HTTPS encryption, certificate signature verification, or digital signature/hash validation, a vulnerability is introduced. Attackers can then automatically execute malicious code. Affected Products Vendor: NoxField Product: QuickMiner Version: 4.15.0 (20230701 build) Exploitation Steps 1. Attacker gains control of DNS resolution or network path (e.g., local network poisoning, MITM). 2. Victim's QuickMiner instance requests updates from update.noxfield.com. 3. Attacker serves malicious update.json + payload. 4. QuickMiner executes the payload automatically → remote code execution achieved. Mitigation Measures Install update released by NoxField. Block untrusted access to noxfield.com. Only update software manually from trusted sources. Enforce HTTPS throughout client and network gateways. Use endpoint protection to monitor unauthorized process executions. Timeline 2023-07-01: Vulnerability discovered in QuickMiner build. 2023-08-01: Vendor contacted and confirmed issue. 2023-09-01: Assigned CVE-2023-6666. 2023-10-01: Release via Medium and CVE request. References Medium advisory: Hacking the Miner - Zero-Click RCE in NoxField QuickMiner CVE Records: CVE-2023-6666 Reserved Acknowledgments Research & Discovery: Prince Philip (Independent Researcher)

Goal Reached Thanks to every supporter — we hit 100%!

NoxField QuickMiner Insecure Update Mechanism Leads to RCE (CVE-2023-6666)