CISA Now Flagging Vulnerabilities, Misconfigurations Exploited by Ransomware

The US cybersecurity agency CISA is stepping up its efforts to prevent ransomware by making it easier for organizations to learn about vulnerabilities and misconfigurations exploited in these attacks.

As part of its Ransomware Vulnerability Warning Pilot (RVWP) program launched in March, the agency has released two new resources to help organizations identify and eliminate security flaws and weaknesses known to be exploited by ransomware groups.

“Through the RVWP, CISA determines vulnerabilities that are commonly associated with known ransomware exploitation and warns critical infrastructure entities with those vulnerabilities, helping to enable mitigation before a ransomware incident occurs,” CISA notes.

The first of these resources is a new column in the Known Exploited Vulnerabilities catalog, which flags flaws that CISA is aware of being associated with ransomware campaigns.

The catalog lists more than 1,000 vulnerabilities for which CISA has solid evidence of in-the-wild exploitation, many of which have been targeted in ransomware attacks.

One of the most recent examples of such flaws is CVE-2023-40044, a deserialization of untrusted data bug in Progress Software’s WS_FTP server that could lead to the execution of remote commands on the underlying operating system.

The other new resource CISA is offering now is a new table on the StopRansomware project’s website, which lists information on the misconfigurations and weaknesses that ransomware operators have been observed targeting in their attacks.

Advertisement. Scroll to continue reading.

For each issue, the table also provides information on the Cyber Performance Goal (CPG) actions that organizations can take as part of their mitigation or compensation efforts.

“These two new resources will help organizations become more cybersecure by providing mitigations that protect against specific KEVs, misconfigurations, and weaknesses associated with ransomware,” CISA notes.

According to CISA, its RVWP has identified more than 800 vulnerable systems to date, within the networks of organizations in the energy, education facilities, healthcare and public health, and water systems industries.

“Ransomware has disrupted critical services, businesses, and communities worldwide and many of these incidents are perpetrated by ransomware actors using known common vulnerabilities and exposures. However, many organizations may be unaware that a vulnerability used by ransomware threat actors is present on their network,” CISA notes.

The agency encourages all organizations to take action to reduce the risk of ransomware by reviewing the available resources. Critical infrastructure entities are encouraged to enroll in CISA’s vulnerability scanning service to receive targeted notifications.

https://www.securityweek.com/cisa-now-flagging-vulnerabilities-misconfigurations-exploited-by-ransomware/

Juniper Networks Patches Over 30 Vulnerabilities in Junos OS

Networking equipment manufacturer Juniper Networks on Thursday announced patches for more than 30 vulnerabilities in Junos OS and Junos OS Evolved, including nine high-severity flaws.

The most severe of these issues is an incorrect default permissions bug that allows an unauthenticated attacker with local access to a vulnerable device to create a backdoor with root privileges.

Tracked as CVE-2023-44194 (CVSS score of 8.4), the flaw exists because a certain system directory has improper permissions associated with it.

Juniper’s patches also address six high-severity vulnerabilities in Junos OS and Junos OS Evolved that could lead to denial of service (DoS). Five of these can be exploited remotely, without authentication.

Impacting both Junos OS and Junos OS Evolved, the remaining two high-severity issues can be exploited to impact the stability of devices and the confidentiality and integrity of device operations, respectively.

All the remaining flaws resolved with this week’s Junos OS and Junos OS Evolved updates are medium-severity vulnerabilities that could lead to DoS conditions, bypass of intended access restrictions, impact on the integrity of systems or connected networks, impact on system availability, credentials leak, configuration changes leak, DMA memory leak, or the incorrect forwarding of MAC addresses.

Additionally, Juniper released patches for a series of medium-severity vulnerabilities in third-party software used within Junos OS and Junos OS Evolved, including NTP vulnerabilities and cryptographic algorithm issues.

Advertisement. Scroll to continue reading.

The networking products maker has released software updates that address these vulnerabilities for Junos OS and Junos OS Evolved versions 20.4, 21.1, 21.2, 21.3, 21.4, 22.1, 22.2, 22.3, 22.4, 23.1, 23.2, and 23.3.

Juniper Networks says it is not aware of any of these vulnerabilities being exploited in malicious attacks.

Users are advised to apply the available patches as soon as possible, given that vulnerabilities in networking products, including Juniper devices, are known to have been exploited in the wild.

Additional information can be found on Juniper’s support portal.

https://www.securityweek.com/juniper-networks-patches-over-30-vulnerabilities-in-junos-os/

Dozens of Squid Proxy Vulnerabilities Remain Unpatched 2 Years After Disclosure

Dozens of vulnerabilities affecting the Squid caching and forwarding web proxy remain unpatched two years after a researcher responsibly disclosed them to developers.

Squid is a widely used open source proxy. According to the official site, “Many of you are using Squid without even knowing it! Some companies have embedded Squid in their home or office firewall devices, others use Squid in large-scale web proxy installations to speed up broadband and dialup internet access. Squid is being increasingly used in content delivery architectures to deliver static and streaming video/audio to internet users worldwide.”

The Squid security holes were discovered in 2021 by researcher Joshua Rogers, who this week disclosed the technical details of his findings. Rogers identified 55 vulnerabilities by targeting various components with fuzzing, manual code review and static analysis.

According to the researcher, only a handful of flaws have been assigned CVE identifiers and 35 of them remain unpatched.

Many of the vulnerabilities can lead to a crash, but some can also be exploited for arbitrary code execution.

“The Squid Team have been helpful and supportive during the process of reporting these issues. However, they are effectively understaffed, and simply do not have the resources to fix the discovered issues. Hammering them with demands to fix the issues won’t get far,” Rogers said.

The researcher pointed out that there are more than 2.5 million Squid instances exposed on the internet.

Advertisement. Scroll to continue reading.

“With any system or project, it is important to regularly review solutions used in your stack to determine whether they are still appropriate,” the researcher said. “If you are running Squid in an environment which may suffer from any of these issues, then it is up to you to reassess whether Squid is the right solution for your system.”

SecurityWeek has reached out to Squid developers for comment and will update this article if they respond.

https://www.securityweek.com/dozens-of-squid-proxy-vulnerabilities-remain-unpatched-2-years-after-disclosure/

Unpatched Vulnerabilities Expose Yifan Industrial Routers to Attacks

Industrial routers made by Chinese company Yifan are affected by several critical vulnerabilities that can expose organizations to attacks, Cisco’s Talos threat intelligence and research group reported on Wednesday.

The vendor was notified in late June and given more than 90 days to release patches. However, no fixes appear to have been released and Cisco has made public the technical details in accordance with its vulnerability disclosure policy.

A Talos researcher discovered over a dozen vulnerabilities in Yifan’s YF325 cellular router. According to the vendor, the device has been deployed in various fields, including self-service terminals, intelligent transportation, industrial automation, smart grid, water supply, finance, and point-of-sale systems.

A majority of the flaws found in the router have been assigned ‘critical severity’ ratings and the remaining have been classified as ‘high severity’.

Talos said the most serious of the security holes can be exploited to execute an arbitrary shell on the targeted router (CVE-2023-32632), change the admin credentials of the device and obtain root access (CVE-2023-24479), and leverage leftover debug credentials to access the device with admin privileges (CVE-2023-32645).

The remaining weaknesses can be exploited for arbitrary code/command execution and denial-of-service (DoS) attacks.

All vulnerabilities can be exploited by sending specially crafted network requests to the targeted device.

SecurityWeek has reached out to Yifan for comment and will update this article if the company responds.

Advertisement. Scroll to continue reading.

https://www.securityweek.com/unpatched-vulnerabilities-expose-yifan-industrial-routers-to-attacks/

Critical SOCKS5 Vulnerability in cURL Puts Enterprise Systems at Risk

The maintainers of the cURL data transfer project on Wednesday rolled out patches for a severe memory corruption vulnerability that exposes millions of enterprise OSes, applications and devices to malicious hacker attacks.

According to an high-risk bulletin, the flaw poses a direct threat to the SOCKS5 proxy handshake process in cURL and can be exploited remotely in some non-standard configurations.

The bug, tracked as CVE-2023-38545, exists in the libcurl library that handles data exchange between devices and servers.

From the advisory:

“When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that hostname can be is 255 bytes.

If the hostname is detected to be longer than 255 bytes, curl switches to local name resolving and instead passes on the resolved address only to the proxy. Due to a bug, the local variable that means “let the host resolve the name” could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long hostname to the target buffer instead of copying just the resolved address there.”

Swedish open source developer and curl maintainer Daniel Stenberg explained that the bug was introduced in February 2020 during related coding work on cURL’s SOCKS5 support.

Advertisement. Scroll to continue reading.

“An attacker that controls an HTTPS server that a libcurl using client accesses over a SOCKS5 proxy (using the proxy-resolver-mode) can make it return a crafted redirect to the application via a HTTP 30x response,” Stenberg explained, warning that in certain conditions, a heap buffer overflow is triggered.

“This problem is the worst security problem found in [libcurl] in a long time,” Stenberg said. The issue was reported via the HackerOne platform by Jay Satiro and paid out $4,600, the largest cURL bug bounty to date.

Affected versions have been flagged as libcurl versions 7.69.0 to 8.3.0. The project said the issue has been fixed in cURL 8.4.0.

cURL provides both a library (libcurl) and command-line tool (curl) for transferring data with URL syntax, supporting various network protocols, including SSL, TLS, HTTP, FTP, SMTP, among others.

Earlier this week, cURL released a pre-patch advisory urging organizations to urgently inventory and scan all systems utilizing curl and libcurl and prepare to apply the patches in cURL 8.4.0.

According to curl’s maintainers, the vulnerability potentially impacts all projects relying on libcurl, although some software may use it in a way that does not allow exploitation. “Updating the shared libcurl library should be enough to fix this issue on all operating systems.”

https://www.securityweek.com/critical-socks5-vulnerability-in-curl-puts-enterprise-systems-at-risk/

Citrix Patches Critical NetScaler ADC, Gateway Vulnerability

Citrix on Tuesday announced patches for a critical-several vulnerability impacting multiple versions of NetScaler Application Delivery Controller (ADC) and NetScaler Gateway.

Tracked as CVE-2023-4966 (CVSS score of 9.4), the security defect could lead to sensitive information disclosure, the tech giant notes in an advisory.

According to Citrix, the issue can be exploited without authentication on appliances that are configured as a Gateway or an AAA virtual server.

The flaw affects NetScaler ADC and NetScaler Gateway versions 14.1, 13.1, 13.0, and NetScaler ADC 13.1-FIPS, 12.1-FIPS, and 12.1-NDcPP.

Citrix has released NetScaler ADC and NetScaler Gateway versions 14.1-8.50, 13.1-49.15, 13.0-92.19, and NetScaler ADC 13.1-FIPS 13.1-37.164, 12.1-FIPS 12.1-55.300, and 12.1-NDcPP 12.1-55.300 to address the vulnerability.

“NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL) and is vulnerable. Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities,” Citrix says.

The company also notes that only customer-managed NetScaler ADC and Gateway products are impacted and should be updated to a patched release.

Advertisement. Scroll to continue reading.

The updates also address a high-severity denial-of-service (DoS) flaw – CVE-2023-4967, CVSS score of 8.2 – impacting products configured as gateways or AAA virtual servers.

On Tuesday, Citrix also announced hotfixes for five vulnerabilities in Citrix Hypervisor 8.2 CU1 LTSR that could allow malicious code running in a guest VM to compromise the host, crash the host, crash another VM running on the host, or access information from code running on the same CPU core.

Four of these issues (CVE-2023-20588, CVE-2023-34324, CVE-2023-34326, and CVE-2023-3432) only impact systems running on AMD CPUs, while the fifth (CVE-2022-1304) can only be exploited when a host administrator uses a restore sub-option in the on-host xsconsole interface.

“Note that there is not a one-to-one correlation between these hotfixes and the addressed issues; we recommend that you always apply all of the hotfixes,” the tech giant’s advisory reads.

Citrix makes no mention of any of these vulnerabilities being exploited in the wild, but threat actors are known to have targeted publicly disclosed NetScaler ADC and Gateway vulnerabilities in malicious attacks.

The US cybersecurity agency CISA warns that attackers could exploit one of these vulnerabilities to take control of affected systems and encourages administrators to review Citrix’s advisories and apply the necessary patches.

https://www.securityweek.com/citrix-patches-critical-netscaler-adc-gateway-vulnerability/

Chrome 118 Patches 20 Vulnerabilities

Google on Tuesday announced the release of Chrome 118 to the stable channel with fixes for 20 vulnerabilities, including 14 reported by external researchers.

The most severe of the externally reported flaws is CVE-2023-5218, a critical bug described as a use-after-free issue in Site Isolation, Chrome’s component responsible for preventing sites from stealing other sites’ data.

Implemented in Chrome as an additional security measure on top of the code that enforces the Same Origin Policy, Site Isolation groups pages from different domains in different processes that run in their own sandboxes.

While Google does not provide details on CVE-2023-5218, use-after-free bugs in Site Isolation can typically allow attackers to perform a sandbox escape via a crafted HTML page, which could potentially allow them to execute arbitrary code.

The internet giant notes in its advisory that it has yet to determine the bug bounty reward for this vulnerability.

Chrome 118 also resolves eight medium-severity flaws reported by external researchers, six of which are inappropriate implementation issues in Fullscreen, Navigation, DevTools, Intents, Downloads, and Extensions API.

A use-after-free vulnerability in Blink History and a heap buffer overflow bug in PDF, both medium-severity flaws, were also resolved.

Advertisement. Scroll to continue reading.

The remaining five externally reported issues patched in this browser release are low-severity vulnerabilities: four inappropriate implementations and a use-after-free.

Google says it has handed out over $30,000 in bug bounty rewards to the reporting researchers. However, the final amount might be much higher, once the reward for the critical-severity vulnerability is determined.

The internet giant makes no mention of any of these vulnerabilities being exploited in malicious attacks.

The latest Chrome release is now rolling out as version 118.0.5993.70 for macOS and Linux, and as versions 118.0.5993.70/.71 for Windows.

https://www.securityweek.com/chrome-118-patches-20-vulnerabilities/

Organizations Respond to HTTP/2 Zero-Day Exploited for DDoS Attacks

Major tech companies and other organizations have rushed to respond to the newly disclosed HTTP/2 zero-day vulnerability that has been exploited to launch the largest distributed denial-of-service (DDoS) attacks seen to date.

The existence of the attack method, named HTTP/2 Rapid Reset, and the underlying vulnerability, tracked as CVE-2023-44487, were disclosed on Tuesday by Cloudflare, AWS and Google.

Each of the tech giants saw DDoS attacks aimed at customers peaking at hundreds of millions of requests per second, far more than they had previously seen. One noteworthy aspect is that the attacks came from relatively small botnets powered by just tens of thousands of devices.

While their existing DDoS protections were largely able to block the attacks, Google, Cloudflare and AWS implemented additional mitigations for this specific attack vector. In addition, they notified web server software companies, which have started working on patches.

The new attack method abuses an HTTP/2 feature called ‘stream cancellation’. Attackers repeatedly send a request and immediately cancel it, which results in a DoS condition capable of taking down servers and applications running standard HTTP/2 implementations.

Several organizations have published blog posts, advisories and alerts on Tuesday in response to the HTTP/2 Rapid Reset vulnerability.

CISA

Advertisement. Scroll to continue reading.

The US cybersecurity agency CISA has released an alert to warn organizations about the threat posed by HTTP/2 Rapid Reset, providing links to various useful resources, including its own guidance for mitigating DDoS attacks.

Microsoft

Microsoft published an advisory to inform customers that it’s aware of the HTTP/2 Rapid Reset attack. The tech giant has advised users to install the available web server updates and provided a couple of workarounds that involve disabling the HTTP/2 protocol using the Registry Editor, and limiting applications to HTTP1.1 using protocol settings for each Kestral endpoint.

NGINX

NGINX warned that the HTTP/2 Rapid Reset vulnerability can — under certain conditions — be exploited to launch a DoS attack on NGINX Open Source, NGINX Plus, and related products that implement the server-side portion of the HTTP/2 specification. Users have been advised to immediately update their NGINX configuration.

OpenSSF

The Open Source Security Foundation (OpenSSF) has published a blog post calling attention to the underlying vulnerability, pointing out that the issue highlights the need for rapid response.

F5 said the vulnerability allows a remote, unauthenticated attacker to cause an increase in CPU usage that can lead to a DoS condition on BIG-IP systems. The company’s advisory contains a list of affected products and mitigations.

Netty

Developers of Netty, a framework designed for the development of network applications such as protocol servers and clients, announced the release of version 4.1.100.Final, which fixes the HTTP/2 DDoS attack vector.

Apache

Apache Tomcat developers have confirmed that Tomcat’s HTTP/2 implementation is vulnerable to the Rapid Reset attack. Apache Tomcat 10.1.14 fixes CVE-2023-44487.

Swift

Swift, the programming language for Apple applications, has informed users that if they run a publicly accessible HTTP/2 server using ‘swift-nio-http2’ they should immediately update to version 1.28.0.

Linux distributions

Linux distributions such as Red Hat, Ubuntu and Debian have also published advisories for CVE-2023-44487.

https://www.securityweek.com/organizations-respond-to-http-2-zero-day-exploited-for-ddos-attacks/

CISA Warns of Attacks Exploiting Adobe Acrobat Vulnerability

The US cybersecurity agency CISA on Tuesday announced that it has added five more security defects to its Known Exploited Vulnerabilities catalog, warning organizations of attacks exploiting an Adobe Acrobat and Reader flaw that came to light earlier this year.

The Adobe Acrobat and Reader issue is CVE-2023-21608, a use-after-free vulnerability which can be exploited to achieve remote code execution (RCE) with the privileges of the current user.

Adobe released patches for this flaw in January 2023, but numerous proof-of-concept (PoC) exploits and technical write-ups have been published since, creating opportunities for threat actors to start targeting the issue in attacks.

Although there appear to be no public reports describing in-the-wild exploitation of CVE-2023-21608, CISA says it only adds CVEs to the KEV list based on solid proof that exploitation has occurred.

CISA also expanded KEV with CVE-2023-20109, an out-of-bounds write flaw in the Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS and IOS XE.

Also leading to RCE, the bug was patched at the end of September, when Cisco warned that it had observed exploitation attempts targeting it.

On the same day that Microsoft released patches for two zero-days impacting Skype for Business (CVE-2023-41763) and WordPad (CVE-2023-36563), CISA added both flaws to KEV. Neither Microsoft nor CISA have provided details on the observed attacks.

Advertisement. Scroll to continue reading.

The fifth vulnerability that CISA has added to KEV on Tuesday is a zero-day in the HTTP/2 protocol, which has been exploited in some of the largest distributed denial-of-service (DDoS) attacks to date.

Referred to as HTTP/2 Rapid Reset, the attack method involves repeatedly sending requests and immediately canceling them. All applications and servers running the standard implementation of HTTP/2 are vulnerable to this attack.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA’s warning reads.

As per the Binding Operational Directive (BOD) 22-01, federal agencies have 21 days to identify the vulnerable products within their networks and apply the available patches and mitigations.

CISA’s BOD 22-01 only applies to federal agencies, but CISA encourages all organizations to review the KEV catalog and prioritize remediation of the security defects in it, or discontinue the use of the vulnerable products if mitigations are not available.

https://www.securityweek.com/cisa-warns-of-attacks-exploiting-adobe-acrobat-vulnerability/

Microsoft Blames Nation-State Threat Actor for Confluence Zero-Day Attacks

Researchers at Microsoft say a known nation-state threat actor is behind the zero-day exploits hitting Atlassian’s Confluence Data Center and Server products.

A note from Redmond linked the ongoing attacks to an APT group tracked as Storm-0062 and warned that malicious activity dates back to September 14, a full three weeks before Atlassian’s public disclosure of the issue.

“Microsoft has observed nation-state threat actor Storm-0062 exploiting CVE-2023-22515 in the wild since September 14, 2023. CVE-2023-22515 was disclosed on October 4, 2023. Storm-0062 is tracked by others as DarkShadow or Oro0lxy,” the company said.

According to SecurityWeek sources, the Storm-0062 hacking team has been observed conducting cyberespionage operations for China’s Ministry of State Security, a state intelligence agency.

Microsoft shared four IP addresses that were seen sending related exploit traffic targeting the critical CVE-2023-22515 privilege escalation vulnerability.

“Any device with a network connection to a vulnerable application can exploit CVE-2023-22515 to create a Confluence administrator account within the application,” Microsoft said, confirming earlier warnings from Atlassian that patches should be applied with urgency.

“Organizations with vulnerable Confluence applications should upgrade as soon as possible to a fixed version: 8.3.3, 8.4.3, or 8.5.2 or later. Organizations should isolate vulnerable Confluence applications from the public internet until they are able to upgrade them,” the company added.

Advertisement. Scroll to continue reading.

Atlassian updated its own advisory to confirm it has evidence that a known nation-state actor is actively exploiting the bug.

On October 4, Atlassian rushed out an urgent patch for the issue alongside a notice that “a handful of customers” were hit by remote exploits.

“Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances,” the Australian company said.

The vulnerability, tracked as CVE-2023-22515, is described as a remotely exploitable privilege escalation issue affecting on-prem instances of Confluence Server and Confluence Data Center.

“Instances on the public internet are particularly at risk, as this vulnerability is exploitable anonymously,” Atlassian warned. “If an instance has already been compromised, upgrading will not remove the compromise.”

Atlassian published an FAQ urging business users to immediately check all affected Confluence instances for the following indicators of compromise:

Unexpected members of the confluence-administrator group
Unexpected newly created user accounts
Requests to /setup/*.action in network access logs
Presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory

“If it is determined that your instance has been compromised, our advice is to immediately shut down and disconnect the server from the network/Internet. Also, you may want to immediately shut down any other systems which potentially share a user base or have common username/password combinations with the compromised system,” Atlassian added.

Security problems in Atlassian’s software products have been targeted in the past by both cybercriminal and state-sponsored threat actors. In CISA’s KEV (Known Exploited Vulnerabilities) catalog, there are six distinct Confluence vulnerabilities marked for urgent attention.

https://www.securityweek.com/microsoft-blames-nation-state-threat-actor-for-confluence-zero-day-attacks/