Vulnerability News - October 27, 2023

Snapshot

Oct. 21, 2023 - Oct. 27, 2023

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2023-5631	Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.	MEDIUM	Roundcube	Oct. 26, 2023
CVE-2023-20273	Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.	HIGH	Cisco	Oct. 23, 2023
Newswires
Critical Vulnerability in F5 BIG-IP Configuration Utility Allows Remote Code Execution Attacks A severe security flaw, tracked as CVE-2023-46747, has been discovered in the F5 BIG-IP configuration utility.				Oct. 27, 2023
Critical Vulnerability in Mirth Connect Threatens to Expose Sensitive Healthcare Data Mirth Connect, a data integration platform developed by NextGen HealthCare, is under threat from a severe remote code execution vulnerability that can be exploited without any form of authentication.				Oct. 26, 2023
Russian APT28 Hackers Breach Critical Networks in France The Russian APT28 hacking group, also known as 'Strontium' or 'Fancy Bear', has been actively infiltrating numerous critical networks in France.				Oct. 26, 2023
Unprecedented 100 Million RPS DDoS Attack Exploits HTTP/2 Rapid Reset Vulnerability Cloudflare has reported an unprecedented series of hyper-volumetric HTTP distributed denial-of-service (DDoS) attacks that exploited a recently revealed vulnerability known as HTTP/2 Rapid Reset.				Oct. 26, 2023
Russian Hackers Exploit Roundcube Zero-Day to Target European Governments Winter Vivern, a Russian hacking group, has been leveraging a zero-day vulnerability in Roundcube Webmail to attack European government entities and think tanks since at least October 11.				Oct. 25, 2023
VMware Addresses Critical Code Execution Vulnerability in vCenter Server VMware has rolled out security patches to rectify a critical flaw in its vCenter Server, which if exploited, could enable remote code execution attacks on vulnerable servers.				Oct. 25, 2023
Rockwell Automation Alerts Customers of Cisco Zero-Day Impacting Stratix Switches Rockwell Automation has issued a warning to its customers regarding the impact of a currently exploited Cisco IOS XE zero-day vulnerability on its Stratix industrial switches.				Oct. 24, 2023
VMware Alerts Users to Public Exploit for vRealize RCE Vulnerability On Monday, VMware warned its customers about the existence of a proof-of-concept (PoC) exploit code for an authentication bypass flaw in its product, vRealize Log Insight, now renamed as VMware Aria Operations for Logs.				Oct. 24, 2023
Unmasking Operation Triangulation: In-depth Analysis of iOS Zero-Day Attacks Kaspersky's investigation into a sophisticated attack on Apple iOS devices, known as Operation Triangulation, has revealed the use of a malicious implant called TriangleDB.				Oct. 24, 2023
Microsoft Exchange Server Vulnerability: PoC Exploit for CVE-2023-36745 Published A Proof-of-Concept (PoC) exploit has been made public for a Microsoft Exchange Server vulnerability, identified as CVE-2023-36745, which can enable remote attackers to execute code.				Oct. 24, 2023
Citrix Urges Immediate Patching of NetScaler CVE-2023-4966 Vulnerability Amid Ongoing Attacks Citrix has alerted administrators today to secure all NetScaler ADC and Gateway appliances against ongoing attacks that exploit the CVE-2023-4966 vulnerability.				Oct. 23, 2023
Cisco Addresses Zero-Day Vulnerabilities in IOS XE Devices Cisco has remedied two vulnerabilities (CVE-2023-20198 and CVE-2023-20273) that were recently exploited by a threat actor to breach a multitude of IOS XE devices.				Oct. 23, 2023
Hackers Modify Cisco IOS XE Backdoor to Evade Detection The number of infected Cisco IOS XE devices has significantly dropped from over 50,000 to a few hundred after hackers updated a malicious backdoor to evade detection.				Oct. 22, 2023
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2023-20198 (19)	Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software wh...	CRITICAL	Cisco	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2023-34048 (10)	vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.	CRITICAL		Remote Code Execution
CVE-2023-46747 (6)	Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-...	CRITICAL		Remote Code Execution Public Exploits Available
CVE-2023-32434 (8)	An integer overflow was addressed with improved input validation.	HIGH	Apple	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2023-4966 (7)	Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway or AAA ?virtual?server.	HIGH	Citrix	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2023-20273 (16)	A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject comman...	HIGH	Cisco	CISA Known Exploited
CVE-2020-35730 (9)	An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.	MEDIUM	Debian, Fedoraproject, Roundcube	CISA Known Exploited
CVE-2023-5631 (11)	Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a craf...	MEDIUM	Debian, Roundcube	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2023-34056 (10)	vCenter Server contains a partial information disclosure vulnerability.	MEDIUM		Risk Context N/A
CVE-2023-34051 (6)	VMware Aria Operations for Logs contains an authentication bypass vulnerability.	N/A		Remote Code Execution Public Exploits Available

CISA Known Exploited Vulnerabilities

CISA added two vulnerabilities to the known exploited vulnerabilities list.

Roundcube — Webmail

CVE-2023-5631 / Added: Oct. 26, 2023

MEDIUM CVSS 5.40 EPSS Score 0.34 EPSS Percentile 68.15

Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.

Headlines

Oct. 26, 2023 - Winter Vivern Targets Roundcube's Zero-Day Vulnerability
Oct. 26, 2023 - Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks
Oct. 25, 2023 - Pro-Russia group exploits zero-day in attacks on gov emails
Oct. 25, 2023 - Winter Vivern: Zero-Day XSS Exploit Targets Roundcube Servers
Oct. 25, 2023 - Winter Vivern APT Blasts Webmail Zero-Day Bug With One-Click Exploit
Oct. 25, 2023 - Russian Hackers Caught Exploiting Roundcube Webmail Zero-Day
Oct. 25, 2023 - Nation State Hackers Exploiting Zero-Day in Roundcube Webmail Software
Oct. 25, 2023 - Roundcube webmail zero-day exploited to spy on government entities (CVE-2023-5631)
Oct. 25, 2023 - Russian hackers exploit Roundcube zero-day to steal govt emails
Oct. 25, 2023 - European govt email servers hacked using Roundcube zero-day
Oct. 25, 2023 - Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

Cisco — Cisco IOS XE Web UI

CVE-2023-20273 / Added: Oct. 23, 2023

HIGH CVSS 7.20 EPSS Score 1.18 EPSS Percentile 83.51

Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.

Headlines

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2023-20198

CRITICAL CVSS 10.00 EPSS Score 1.90 EPSS Percentile 87.20

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 16, 2023

Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. For steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory Cisco will provide updates on the status of this investigation and when a software patch is available.

Vendor Impacted: Cisco

Products Impacted: Ios Xe Web Ui, Ios Xe

Quotes

Issued a privilege 15 command
Malware delivery via fake browser updates
Hinders identification of compromised systems
Our investigation has determined that the actors exploited two previously unknown issues
Investigated network traffic to a compromised device has shown that the threat actor has upgraded the implant to do an extra header check
Enhanced guidance to detect the presence of the implant, after uncovering a new variant that hinders identification of compromised systems
We have observed that the implant placed on tens of thousands of Cisco devices has been altered to check for an Authorization HTTP header value before responding
Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks
It was investigated early on because a Snort signature fired early (it was seen in the telemetry), but as more information was gathered on the exploit it was determined it was not correlated
While Rockwell Automation has no evidence of active exploitation against the Stratix product line, this vulnerability was discovered by Cisco Talos during an incident response for a Cisco customer
Fixes for both CVE-2023-20198 and CVE-2023-20273 are estimated to be available on October 22. The CVE-2021-1435 that had previously been mentioned is no longer assessed to be associated with this activity
The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access
For the second day in a row, we see the number of implants have drastically dropped in a short time (see screenshots attached). Basically, they appear to have been practically all rebooted (as the known implant doesn't survive a reboot) or have been updated

Headlines

CVE-2023-34048

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 12.81

Remote Code Execution

Published: Oct. 25, 2023

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Quotes

In ITIL parlance this would be considered an emergency change, and your organisation should consider acting quickly
A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data
A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution
An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution
VCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8
While VMware does not mention end-of-life products in VMware Security Advisories, due to the critical severity of this vulnerability and lack of workaround VMware has made a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x
Due to the critical severity of this vulnerability and lack of workaround VMware has made a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x. For the same reasons, VMware has made additional patches available for vCenter Server 8.0U1

Headlines

CVE-2023-46747

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 38.53

Remote Code Execution Public Exploits Available

Published: Oct. 26, 2023

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Quotes

We went to report to F5 at the beginning of the month and had some back and forth with them over the disclosure timeline
This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. There is no data plane exposure; this is a control plane issue only
This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. There is no data plane exposure; this is a control plane issue only

Headlines

CVE-2023-32434

HIGH CVSS 7.80 EPSS Score 0.07 EPSS Percentile 30.74

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: June 23, 2023

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Vendor Impacted: Apple

Products Impacted: Watchos, Ipados, Multiple Products, Macos, Iphone Os

Quotes

May have been actively exploited against versions of iOS released before iOS 15.7
These validators collect various information about the victim device and send it to the C2 server
The vulnerabilities that allow an application to be able execute code with Kernel privileges could allow almost complete control of the device
The hardware-based security features of devices with newer Apple chips significantly bolster their resilience against cyber-attacks. But they are not invulnerable
The implant, christened TriangleDB, becomes operative once attackers gain root access on a targeted iOS device, exploiting the kernel vulnerability. Intriguingly, this implant operates in-memory, erasing its footprint once the device is rebooted
Ever since it was introduced [in iOS 14], the feature was completely useless. While iOS replaces the device’s real MAC address in the data link layer with a generated address per network, it includes the real MAC address in the AirPlay discovery requests that an iPhone starts sending when it joins a network

Headlines

CVE-2023-4966

HIGH CVSS 7.50 EPSS Score 17.99 EPSS Percentile 95.58

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 10, 2023

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.

Vendor Impacted: Citrix

Products Impacted: Netscaler Gateway, Netscaler Adc And Netscaler Gateway, Netscaler Application Delivery Contr

Quotes

Malware delivery via fake browser updates
It's a remote access solution in the vast majority of places and, as a result, it's exposed to the Internet most of the time
An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution
We now have reports of incidents consistent with session hijacking, and have received credible reports of targeted attacks exploiting this vulnerability
If you are using affected builds and have configured NetScaler ADC as a gateway (VPN virtual server, ICA proxy, CVPN, RDP proxy) or as an AAA virtual server, we strongly recommend that you immediately install the recommended builds
Exploits of CVE-2023-4966 on unmitigated appliances have been observed. Cloud Software Group strongly urges customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions of NetScaler ADC and NetScaler Gateway as soon as possible

Headlines

CVE-2023-20273

HIGH CVSS 7.20 EPSS Score 1.18 EPSS Percentile 83.51

CISA Known Exploited

Published: Oct. 25, 2023

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Vendor Impacted: Cisco

Product Impacted: Cisco Ios Xe Web Ui

Quotes

Issued a privilege 15 command
Hinders identification of compromised systems
Our investigation has determined that the actors exploited two previously unknown issues
Investigated network traffic to a compromised device has shown that the threat actor has upgraded the implant to do an extra header check
Enhanced guidance to detect the presence of the implant, after uncovering a new variant that hinders identification of compromised systems
The attacker then exploited [CVE-2023-20273] leveraging the new local user to elevate privilege to root and write the implant to the file system
We have observed that the implant placed on tens of thousands of Cisco devices has been altered to check for an Authorization HTTP header value before responding
Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks
It was investigated early on because a Snort signature fired early (it was seen in the telemetry), but as more information was gathered on the exploit it was determined it was not correlated
While Rockwell Automation has no evidence of active exploitation against the Stratix product line, this vulnerability was discovered by Cisco Talos during an incident response for a Cisco customer
Fixes for both CVE-2023-20198 and CVE-2023-20273 are estimated to be available on October 22. The CVE-2021-1435 that had previously been mentioned is no longer assessed to be associated with this activity
For the second day in a row, we see the number of implants have drastically dropped in a short time (see screenshots attached). Basically, they appear to have been practically all rebooted (as the known implant doesn't survive a reboot) or have been updated

Headlines

CVE-2020-35730

MEDIUM CVSS 6.10 EPSS Score 4.05 EPSS Percentile 91.08

CISA Known Exploited

Published: Dec. 28, 2020

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Vendors Impacted: Debian, Fedoraproject, Roundcube

Products Impacted: Roundcube Webmail, Debian Linux, Fedora, Webmail

Quotes

Get started in your Outlook
Once we decode the base64-encoded value in the href attribute of the use tag, we have:
Exploitation of the XSS vulnerability can be done remotely by sending a specially crafted email message
Winter Vivern has stepped up its operations by using a zero-day vulnerability in Roundcube. Previously, it was using known vulnerabilities in Roundcube and Zimbra, for which proofs of concept are available online
By sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user's browser window. No manual intervention other than viewing the message in a web browser is required

Headlines

CVE-2023-5631

MEDIUM CVSS 5.40 EPSS Score 0.34 EPSS Percentile 68.15

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Oct. 18, 2023

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

Vendors Impacted: Debian, Roundcube

Products Impacted: Debian Linux, Webmail

Quotes

Get started in your Outlook
Once we decode the base64-encoded value in the href attribute of the use tag, we have:
Exploitation of the XSS vulnerability can be done remotely by sending a specially crafted email message
Since at least 2022, they have been exploiting XSS vulnerabilities in Zimbra and Roundcube to load arbitrary JavaScript code and steal emails
Winter Vivern has stepped up its operations by using a zero-day vulnerability in Roundcube. Previously, it was using known vulnerabilities in Roundcube and Zimbra, for which proofs of concept are available online
By sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user’s browser window. No manual interaction other than viewing the message in a web browser is required

Headlines

CVE-2023-34056

MEDIUM CVSS 4.30 EPSS Score 0.04 EPSS Percentile 7.24

Risk Context N/A

Published: Oct. 25, 2023

vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.

Quotes

In ITIL parlance this would be considered an emergency change, and your organisation should consider acting quickly
A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data
A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution
An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution
VCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8
While VMware does not mention end-of-life products in VMware Security Advisories, due to the critical severity of this vulnerability and lack of workaround VMware has made a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x
Due to the critical severity of this vulnerability and lack of workaround VMware has made a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x. For the same reasons, VMware has made additional patches available for vCenter Server 8.0U1

Headlines

CVE-2023-34051

CVSS Not Assigned EPSS Score 0.05 EPSS Percentile 14.69

Remote Code Execution Public Exploits Available

Published: Oct. 20, 2023

VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

Quotes

Updated VMSA to note that VMware has confirmed that exploit code for CVE-2023-34051 has been published
An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution
Since the patch only blocks access to Thrift services by IP and did not fix the other CVEs in VMSA-2023-0001, all an attacker needs to do is spoof their IP address and use the previous attack
Due to the critical severity of this vulnerability and lack of workaround VMware has made a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x. For the same reasons, VMware has made additional patches available for vCenter Server 8.0U1

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

October 27, 2023

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

October 27, 2023

Snapshot

CISA Known Exploited Vulnerabilities

Newswires

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Roundcube — Webmail

Cisco — Cisco IOS XE Web UI

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe