Hackers are mass infecting servers worldwide by exploiting a patched hole

Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit" — Getty Images

An explosion of cyberattacks is infecting servers around the world with crippling ransomware by exploiting a vulnerability that was patched two years ago, it was widely reported on Monday.

The hacks exploit a flaw in ESXi, a hypervisor VMware sells to cloud hosts and other large-scale enterprises to consolidate their hardware resources. ESXi is what’s known as a bare-metal, or Type 1, hypervisor, meaning it’s essentially its own operating system that runs directly on server hardware. By contrast, servers running the more familiar Type 2 class of hypervisors, such as VMware’s VirtualBox, run as apps on top of a host operating system. The Type 2 hypervisors then run virtual machines that host their own guest OSes such as Windows, Linux or, less commonly, macOS.

Enter ESXiArgs

Advisories published recently by computer emergency response teams (CERT) in France, Italy, and Austria report a “massive” campaign that began no later than Friday and has gained momentum since then. Citing results of a search on Census, CERT officials in Austria, said that as of Sunday, there were more than 3,200 infected servers, including eight in that country.

“Since ESXi servers provide a large number of systems as virtual machines (VM), a multiple of this number of affected individual systems can be expected,” the officials wrote.

The vulnerability being exploited to infect the servers is CVE-2021-21974, which stems from a heap-based buffer overflow in OpenSLP, an open network-discovery standard that’s incorporated into ESXi. When VMware patched the vulnerability in February 2021, the company warned it could be exploited by a malicious actor with access to the same network segment over port 427. The vulnerability had a severity rating of 8.8 out of a possible 10. Proof-of-concept exploit code and instructions for using it became available a few months later.

Over the weekend, French cloud host OVH said that it doesn’t have the ability to patch the vulnerable servers set up by its customers.

“ESXi OS can only be installed on bare metal servers,” wrote Julien Levrard, OVH’s chief information security officer. “We launched several initiatives to identify vulnerable servers, based on our automation logs to detect ESXI installation by our customers. We have limited means of action since we have no logical access to our customer servers.”

In the meantime, the company has blocked access to port 427 and is also notifying all customers it identifies as running vulnerable servers.

Levrard said the ransomware installed in the attacks encrypts virtual machine files, including those ending in .vmdk, .vmx, .vmxf, .vmsd, .vmsn, .vswp, .vmss, .nvram, and .vmem. The malware then tries to unlock the files by terminating a process known as VMX. The function isn’t working as its developers intended, resulting in the files remaining locked.

Researchers have dubbed the campaign and the ransomware behind it ESXiArgs because the malware creates an additional file with the extension “.args” after encrypting a document. The .args file stores data used to decrypt encrypted data.

Researchers from the YoreGroup Tech Team, Enes Sonmez and Ahmet Aykac, reported that the encryption process for ESXiArgs can make mistakes that allow victims to restore encrypted data. OVH’s Levrard said his team tested the restoration process the researchers described and found it successful in about two-thirds of the attempts.

Anyone who relies on ESXi should stop whatever they’re doing and check to ensure patches for CVE-2021-21974 have been installed. The above-linked advisories also provide more guidance for locking down servers that use this hypervisor.

https://arstechnica.com/?p=1915481

Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping

A critical vulnerability affecting wireless communication base stations from Baicells Technologies can be exploited to cause disruption in telecom networks or take complete control of data and voice traffic, according to a researcher.

Baicells Technologies is a US-based telecommunications equipment provider for 4G and 5G networks. The company says more than 100,000 of its base stations are deployed across 64 countries around the world.

Cyber offensive researcher Rustam Amin discovered that at least some of Baicells’ Nova base station products are affected by a critical command injection vulnerability that can be exploited remotely without authentication by sending specially crafted HTTP requests to the targeted device.

Exploitation of the vulnerability, tracked as CVE-2023-24508, can allow an attacker to run shell commands with root privileges and take complete control of a device, Amin told SecurityWeek.

The researcher explained that an attacker could, for instance, easily shut down a device to cause disruption. In addition, they could take full control over the traffic and phone calls going over a targeted network. A hacker could obtain information such as phone numbers, IMEI, and location data.

However, conducting such an attack is not an easy task and it requires specific knowledge of the targeted network.

Amin told SecurityWeek that there are more than 1,150 devices exposed to the internet, mostly located in the United States.

Baicells published an advisory to inform customers about the vulnerability on January 24. The researcher said the vendor was quick to respond to his notification and quick to issue a patch.

Nova 227, 233, 243 and 246 base stations are affected. The security hole has been patched with the release of version 3.7.11.3.

The vendor’s advisory only mentions Nova products as being impacted, but the researcher believes other products could be impacted as well.

The US Cybersecurity and Infrastructure Security Agency (CISA) published an advisory last week to inform organizations about CVE-2023-24508.

Amin recently also discovered serious vulnerabilities in Econolite EOS traffic controller software, which can be exploited to control traffic lights.

https://www.securityweek.com/critical-baicells-device-vulnerability-can-expose-telecoms-networks-to-snooping/

VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability

Unpatched and unprotected VMware ESXi servers around the world have been targeted over the past few days in a large-scale ransomware attack exploiting a vulnerability patched in 2021.

The attacks, dubbed ESXiArgs, are still being analyzed by the cybersecurity community, but based on the information available to date, it appears that threat actors are exploiting CVE-2021-21974, a high-severity ESXi OpenSLP heap-overflow vulnerability that VMware patched in February 2021.

“A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution,” VMware said in its advisory at the time.

Proof-of-concept (PoC) code and technical details on CVE-2021-21974 were made public a couple of months after the patches were announced, but there do not appear to be any previous reports of the vulnerability being exploited in the wild.

In the ransomware attacks that surged over the weekend, threat actors exploited the flaw to hack ESXi servers and deploy a piece of malware that encrypts files associated with virtual machines, including files with the .vmdk, .vmx, .vmxf, .vmsd, .vmsn, .vswp, .vmss, .nvram, .vmem extensions, according to an analysis by French cloud company OVH.

The attacks seem to target vulnerable ESXi servers that are exposed to the internet on port 427.

OVH noted that the malware shuts down VM processes before initiating its encryption routine, but the function does not seem to work properly. In some cases, files are only partially encrypted, allowing victims to recover them without paying a ransom. There is no evidence of data being stolen in the attacks.

Researcher Enes Sonmez has found a way to recover some of the files encrypted by the ransomware.

The attacks were initially incorrectly attributed to ransomware named Nevada and Cheerscrypt (Emperor Dragonfly), but they were later linked to a new ransomware operation named ESXiArgs.

More than two thousand ESXi instances appear to be impacted according to Censys. Shodan shows roughly 800 compromised servers.

At the time of writing, many antivirus engines cannot detect the ESXiArgs malware.

Government agencies in the United States and Europe are looking into these attacks and assessing their impact.

While the malware does not appear to have file exfiltration capabilities, the ransom note dropped in the ESXiArgs attack informs victims that their data will be sold unless a payment is made. Victims are instructed to pay 2 bitcoins ($48,000) to receive the encryption key needed to recover files.

Ransomware expert Soufiane Tahiri has been keeping track of the Bitcoin wallet addresses used by the cybercriminals.

While it has become increasingly common for threat actors to target ESXi servers, the exploitation of ESXi vulnerabilities is rare.

https://www.securityweek.com/many-vmware-esxi-servers-targeted-in-ransomware-attack-via-old-vulnerability/

Atlassian Warns of Critical Jira Service Management Vulnerability

Atlassian this week warned of a critical-severity authentication vulnerability in Jira Service Management Server and Data Center that could allow attackers to impersonate Jira users.

Tracked as CVE-2023-22501 (CVSS score of 9.4), the flaw impacts Jira Service Management Server and Data Center versions 5.3.0, 5.3.1, 5.3.2, 5.4.0, 5.4.1, and 5.5.0.

“An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances,” Atlassian notes in its advisory.

“With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into,” the company continues.

The attacker can obtain access to these tokens if they are included in Jira issues or requests with these users, or if the attacker obtains emails containing ‘View Request’ links from these users.

According to Atlassian, bot accounts are most likely to be targeted in such attacks. However, external customer accounts on instances with single sign-on may also be affected if account creation is open to anyone.

The vulnerability does not impact Jira sites that are hosted by Atlassian, and which are accessed via an atlassian.net domain.

Patches for this vulnerability were included in Jira Service Management Server and Data Center versions 5.3.3, 5.4.2, 5.5.1, and 5.6.0.

Users are advised to update their Jira installations as soon as possible.

https://www.securityweek.com/atlassian-warns-of-critical-jira-service-management-vulnerability/

High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation

VMware has informed users about the availability of patches for a Workstation vulnerability that could be exploited by malicious hackers for privilege escalation.

The flaw, tracked as CVE-2023-20854 and rated ‘high severity’, has been described by VMware as an arbitrary file deletion vulnerability affecting version 17.x on Windows.

“A malicious actor with local user privileges on the victim’s machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed,” VMware said in its advisory for CVE-2023-20854.

The virtualization giant has credited Frederik Reiter of German cybersecurity firm Cirosec for reporting the vulnerability.

In a message posted on Twitter, Cirosec said the security hole can be exploited by an attacker to escalate privileges to System. The company said it will release technical details in the upcoming period.

While this vulnerability might never be exploited in the wild, VMware users have been warned about a series of recently patched vRealize Log Insight flaws for which exploit code is available. The cybersecurity industry is keeping an eye out for any exploitation attempts involving the vulnerabilities.

https://www.securityweek.com/high-severity-privilege-escalation-vulnerability-patched-in-vmware-workstation/

Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication

Exploitation attempts targeting a critical-severity Oracle E-Business Suite vulnerability have been observed shortly after proof-of-concept (PoC) code was published.

One of the major Oracle product lines, the E-Business Suite is a set of enterprise applications that help organizations automate processes such as supply chain management (SCM), enterprise resource planning (ERP), and customer relationship management (CRM).

Tracked as CVE-2022-21587 (CVSS score of 9.8), the exploited flaw was identified in the Web Applications Desktop Integrator of Oracle’s enterprise product and was addressed as part of Oracle’s October 2022 Critical Patch Update.

According to a NIST advsory, unauthenticated attackers with network access via HTTP can easily exploit the security defect to compromise the Web Applications Desktop Integrator and take it over.

This week, CISA added CVE-2022-21587 to its Known Exploited Vulnerabilities (KEV) catalog, urging Oracle customers to apply the available patches as soon as possible.

The first exploitation attempts, however, were observed on January 21, Shadowserver warned last week.

“Since Jan 21st we are seeing exploitation attempts in our honeypot sensors for Oracle E-Business Suite CVE-2022-21587 (CVSS 9.8 RCE) shortly after a PoC was published,” Shadowserver said.

The PoC came from Vietnam-based cybersecurity firm Viettel Cyber Security, which on January 16 published a detailed analysis of the vulnerability and potential exploitation venues.

According to Shadowserver data, the number of observed exploitation attempts is currently low. However, threat actors are known to target unpatched Oracle products, and the number of attacks may increase shortly.

This week, CISA also warned of observed exploitation of CVE-2023-22952, a high-severity remote code execution flaw in SugarCRM.

Impacting the EmailTemplates, the vulnerability is described as a missing input validation defect that allows an attacker to inject custom PHP code using crafted requests. Patches for this vulnerability were released on January 11, 2023.

In January, shortly after exploitation began, Censys reported seeing hundreds of SugarCRM servers being hacked using CVE-2023-22952.

https://www.securityweek.com/exploitation-of-oracle-e-business-suite-vulnerability-starts-after-poc-publication/

GoAnywhere MFT Users Warned of Zero-Day Exploit

Users of the GoAnywhere secure managed file transfer (MFT) software have been warned about a zero-day exploit that malicious actors can target directly from the internet.

The GoAnywhere MFT is made by Fortra, known until recently as HelpSystems, and it’s designed to enable organizations to automate and secure the exchange of data with their trading partners.

Cybersecurity blogger Brian Krebs broke the news about the zero-day vulnerability on Thursday, saying that the company had temporarily implemented a service outage in response.

An advisory obtained by Krebs — it can only be accessed by authenticated users — describes it as a zero-day remote code injection exploit and says that “the attack vector of this exploit requires access to the administrative console of the application”.

According to the vendor, the vulnerable admin console should in most cases only be accessible from within a company’s network, through a VPN, or only by trusted IP addresses. However, the company has admitted that some GoAnywhere users may be exposing the console to the public internet.

Fortra noted that the web client interface, which is typically accessible from the internet, is not affected by the exploit.

The advisory doesn’t clearly say that the vulnerability has been exploited in the wild, but active exploitation is likely, considering that it has been described as a zero-day. In addition, the vendor provides instructions on how customers can check if their system has been compromised.

The best indicator of compromise (IoC), according to the advisory, is the presence of suspicious administrator accounts that may have been created by malicious actors.

The advisory does not mention a patch, but it does recommend mitigations that should prevent exploitation. There is also no mention of a CVE identifier for the vulnerability in the advisory obtained by Krebs.

Security researcher Kevin Beaumont has conducted a Shodan search and found roughly 1,000 internet-exposed systems, a majority located in the United States. However, some of the results are clearly labeled as being associated with the web client, which Fotra says is not impacted.

https://www.securityweek.com/goanywhere-mft-users-warned-of-zero-day-exploit/

Google Shells Out $600,000 for OSS-Fuzz Project Integrations

Google this week announced an extension to its OSS-Fuzz rewards program, an initiative meant to reward contributors for integrating projects into OSS-Fuzz.

Launched in 2016, OSS-Fuzz is meant to help identify vulnerabilities in open source software through continuous fuzzing, with a declared goal of making common software infrastructure more secure.

Six months after the launch, Google announced that it was offering rewards between $1,000 and $20,000 for integrating projects into OSS-Fuzz, and now says that it has paid over $600,000 to more than 65 different contributors as part of the program.

The internet search marketing giant has now increased the highest reward available for new project integration to $30,000, which can be awarded depending on ‘the criticality of the project’.

Launched last year and already integrated into OSS-Fuzz, the tool performs analysis of functions, static call graphs, and runtime coverage information to provide insights into fuzzing coverage blockers.

“The Fuzz Introspector tool provides these insights by identifying complex code blocks that are blocked during fuzzing at runtime, as well as suggesting new fuzz targets that can be added,” Google says.

By increasing payouts and expanding the OSS-Fuzz rewards program, Google seeks to strengthen OSS-Fuzz to find more vulnerabilities before they are exploited.

https://www.securityweek.com/google-shells-out-600000-for-oss-fuzz-project-integrations/

F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution

F5 warns of a high-severity format string vulnerability in BIG-IP that could allow an authenticated attacker to cause a denial-of-service (DoS) condition and potentially execute arbitrary code.

Tracked as CVE-2023-22374, the security defect impacts iControl SOAP, an open API that enables communication between systems, which runs as root.

The SOAP interface is accessible from the network, either via the BIG-IP management port and/or self IP addresses, and is restricted to administrative accounts.

Rapid7, which identified the bug, explains that exploitation is possible by inserting format string specifiers into specific parameters that are passed into the syslog function, resulting in the service reading and writing memory addresses referenced from the stack.

However, the cybersecurity firm explains, the attacker cannot read the memory unless they have access to the syslog.

“It is difficult to influence the specific addresses read and written, which makes this vulnerability very difficult to exploit (beyond crashing the service) in practice,” Rapid7 explains.

An attacker could crash the service by using the ‘%s’ specifier, and could use the ‘%n’ specifier to write arbitrary data to any pointer in the stack, which could potentially lead to remote code execution, the cybersecurity firm says.

According to F5’s advisory, an attacker looking to exploit the flaw for code execution would first need to harvest information about the environment running the vulnerable component. However, only the control plane, but not the data plane, is exposed by this bug.

“The most likely impact of a successful attack is to crash the server process. A skilled attacker could potentially develop a remote code execution exploit, which would run code on the F5 BIG-IP device as the root user,” Rapid7 notes.

The vulnerability impacts BIG-IP versions 13.1.5, 14.1.4.6 to 14.1.5, 15.1.5.1 to 15.1.8, 16.1.2.2 to 16.1.3, and 17.0.0. No patch is currently available for the vulnerability, but F5 says an engineering hotfix is available.

Because the flaw can only be exploited by authenticated users, access to the iControl SOAP API should be restricted to trusted users.

CVE-2023-22374 has a CVSS score of 7.5 for BIG-IP systems in standard deployment mode, and a CVSS score of 8.5 for BIG-IP instances in application mode.

BIG-IP SPK, BIG-IQ, F5OS-A, F5OS-C, NGINX, and Traffix SDC are not affected.

*updated to clarify that an engineering hotfix is already available. The headline has also been updated

https://www.securityweek.com/f5-working-on-patch-for-big-ip-flaw-that-can-lead-to-dos-code-execution/

Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots

Cisco on Wednesday announced patches for a high-severity command injection vulnerability in the IOx application hosting environment that could allow malicious code to persist across reboots.

Tracked as CVE-2023-20076, the security defect exists because parameters that are passed for the activation of an application are not completely sanitized.

“An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying host operating system,” the tech giant explains in an advisory.

According to Trellix, the cybersecurity firm that discovered the vulnerability, the issue resides in the DHCP Client ID option within the Interface Settings, which is not being correctly sanitized, leading to command injection.

Furthermore, the bug bypasses mitigations to prevent persistence across reboots and system resets.

“CVE-2023-20076 gains unrestricted access, allowing malicious code to lurk in the system and persist across reboots and firmware upgrades. Side-stepping this security measure means that if an attacker exploits this vulnerability, the malicious package will keep running until the device is factory reset or until it is manually deleted,” Trellix explains.

The bug impacts all Cisco devices running IOS XE Software with the IOx feature enabled, if they do not support native docker, including 800 series industrial ISRs, Catalyst Access Points (COS-APs), CGR1000 compute modules, IC3000 industrial compute gateways, and IR510 WPAN industrial routers.

Cisco has released security updates for the impacted industrial ISRs (software version 15.9(3)M7), COS-APs (versions 17.3.8, 17.9.2, and 17.11.1), IC3000 gateways (version 1.2.1), and for IOS XE-based devices configured with IOx (versions 17.3.8, 17.9.2, and 17.11.1).

Updates for CGR1000 compute modules and IR510 WPAN industrial routers are planned for February 2023.

Customers are advised to update their Cisco products as soon as possible. No workarounds exist to mitigate the bug.

In addition to CVE-2023-20076, Trellix security researchers identified a security check bypass during tar archive extraction, which could allow an attacker to write on the underlying host operating system as root.

The issue, however, impacts a compression algorithm that Cisco is planning to deploy for future application packaging support, and cannot be exploited. The tech giant has resolved this bug as well.

Cisco says it is not aware of any attempts to exploit CVE-2023-20076 in malicious attacks. In addition, Trellix noted that an attacker has to be authenticated with admin privileges on the system in order to exploit the vulnerabilities discovered by its researchers.

This week, Cisco also issued patches for several medium-severity bugs impacting Identity Services Engine (ISE) and Prime Infrastructure Software, and warned of a medium-severity file upload issue impacting RV340, RV340W, RV345, and RV345P routers, which have reached end-of-life (EOL) and no longer receive security patches.

Additional information on these vulnerabilities can be found on Cisco’s security website.

https://www.securityweek.com/flaw-in-cisco-industrial-appliances-allows-malicious-code-to-persist-across-reboots/