VULNERA Pulse

Citrix — Content Collaboration

CVE-2023-24489 / Added: Aug. 16, 2023

CRITICAL CVSS 9.80 EPSS Score 96.73 EPSS Percentile 99.50

Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.

Headlines

• Aug. 17, 2023 - Patch and check Citrix gear: Two bugs under active attack
• Aug. 17, 2023 - Citrix ShareFile vulnerability actively exploited (CVE-2023-24489)
• Aug. 17, 2023 - CISA Urges Patching of Actively Exploited Citrix Bug
• Aug. 17, 2023 - Exploitation of Citrix ShareFile Vulnerability Spikes as CISA Issues Warning
• Aug. 17, 2023 - CISA Adds Citrix ShareFile Flaw to KEV Catalog Due to In-the-Wild Attacks
• Aug. 16, 2023 - CISA adds flaw in Citrix ShareFile to its Known Exploited Vulnerabilities catalog
• Aug. 16, 2023 - CISA warns of critical Citrix ShareFile flaw exploited in attacks
• Aug. 6, 2023 - newsletter Round 431 by Pierluigi Paganini – International edition
• Aug. 3, 2023 - Hundreds of Citrix NetScaler ADC and Gateway Servers Hacked in Major Cyber Attack
• July 31, 2023 - Experts warn attackers started exploiting Citrix ShareFile RCE flaw CVE-2023-24489
• July 28, 2023 - Exploitation of Recent Citrix ShareFile RCE Vulnerability Begins
• June 13, 2023 - Citrix patches critical flaw (CVE-2023-24489) in ShareFile storage zones controller

Back to top ↑

CVE-2023-3519

CRITICAL CVSS 9.80 EPSS Score 91.20 EPSS Percentile 98.47

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: July 19, 2023

Unauthenticated remote code execution

Vendor Impacted: Citrix

Products Impacted: Netscaler Gateway, Netscaler Application Delivery Contr, Netscaler Adc And Netscaler Gateway

Quotes

• Certain searches get written into the NetScaler logs whenever the script is run
• The tool is designed to do a best effort job at identifying existing compromises
• Could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller
• This tool is not guaranteed to find all evidence of compromise, or all evidence of compromise related to CVE 2023-3519
• This vulnerability affects all currently supported versions of customer-managed ShareFile storage zones controller before version 5.11.24
• An adversary appears to have exploited CVE-2023-3519 in an automated fashion, placing web shells on vulnerable NetScalers to gain persistent access
• This indicates that while most administrators were aware of the vulnerability and have since patched their NetScalers to a non-vulnerable version, they have not been (properly) checked for signs of successful exploitation
• Notably since at least 2021, cyber espionage threat actors have focused on edge devices, particularly security, networking, and virtualization technologies to gain persistent access to victim networks, while evading detection
• Exploits of CVE-2023-3519 on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible

Headlines

• Aug. 17, 2023 - Patch and check Citrix gear: Two bugs under active attack
• Aug. 17, 2023 - Exploitation of Citrix ShareFile Vulnerability Spikes as CISA Issues Warning
• Aug. 17, 2023 - CISA Adds Citrix ShareFile Flaw to KEV Catalog Due to In-the-Wild Attacks
• Aug. 17, 2023 - Citrix ADC, Gateways Still Backdoored, Even After Being Patched
• Aug. 16, 2023 - Mass-Exploitation Campaign Targets Citrix NetScalers With Backdoors
• Aug. 16, 2023 - (Re)check your patched NetScaler ADC and Gateway appliances for signs of compromise
• Aug. 16, 2023 - Approximately 2000 Citrix NetScaler servers were backdoored in a massive campaign
• Aug. 16, 2023 - Nearly 2,000 Citrix NetScaler Instances Hacked via Critical Vulnerability
• Aug. 16, 2023 - Mandiant Releases Scanner to Identify Compromised NetScaler ADC, Gateways
• Aug. 15, 2023 - Almost 2,000 Citrix NetScaler servers backdoored in hacking campaign
• Aug. 15, 2023 - New CVE-2023-3519 scanner detects hacked Citrix ADC, Gateway devices
• Aug. 15, 2023 - 2,000 Citrix NetScaler Instances Backdoored via Recent Vulnerability

CVE-2023-24489

CRITICAL CVSS 9.80 EPSS Score 96.73 EPSS Percentile 99.50

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: July 10, 2023

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.

Vendor Impacted: Citrix

Products Impacted: Content Collaboration, Sharefile Storage Zones Controller

Quotes

• Significant risks to the federal enterprise
• Could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller
• This vulnerability affects all currently supported versions of customer-managed ShareFile storage zones controller before version 5.11.24
• A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller
• You can use the ShareFile-managed cloud storage by itself or in combination with storage that you maintain, called storage zones for ShareFile Data. The storage zones that you maintain can reside in your on-premises single-tenant storage system or in supported third-party cloud storage

Headlines

• Aug. 17, 2023 - Patch and check Citrix gear: Two bugs under active attack
• Aug. 17, 2023 - Citrix ShareFile vulnerability actively exploited (CVE-2023-24489)
• Aug. 17, 2023 - CISA Urges Patching of Actively Exploited Citrix Bug
• Aug. 17, 2023 - Exploitation of Citrix ShareFile Vulnerability Spikes as CISA Issues Warning
• Aug. 17, 2023 - CISA Adds Citrix ShareFile Flaw to KEV Catalog Due to In-the-Wild Attacks
• Aug. 16, 2023 - CISA adds flaw in Citrix ShareFile to its Known Exploited Vulnerabilities catalog
• Aug. 16, 2023 - CISA warns of critical Citrix ShareFile flaw exploited in attacks

CVE-2023-32560

CRITICAL CVSS 9.80 EPSS Score 0.13 EPSS Percentile 47.93

Risk Context N/A

Published: Aug. 10, 2023

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1.

Quotes

• The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of System
• When processing an item of data type 9, WLAvalancheService.exe uses a fixed-size stack-based buffer to store user-supplied data and then convert the data to an integer using atol(). An unauthenticated remote attacker can specify a long type 9 item to overflow the buffer

Headlines

• Aug. 17, 2023 - Ivanti patches MDM vulnerabilities
• Aug. 16, 2023 - Ivanti Patches Critical Vulnerability in Avalanche Enterprise MDM Solution
• Aug. 16, 2023 - Critical Security Flaws Affect Ivanti Avalanche, Threatening 30,000 Organizations
• Aug. 16, 2023 - Ivanti Avalanche vulnerable to attack by unauthenticated, remote attackers (CVE-2023-32560)
• Aug. 16, 2023 - Two unauthenticated stack buffer overflows found in Ivanti Avalanche EMM
• Aug. 15, 2023 - Ivanti Avalanche impacted by critical pre-auth stack buffer overflows

CVE-2023-3259

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 7.00

Risk Context N/A

Published: Aug. 14, 2023

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to a rouge database.Successful exploitation allows the malicious agent to take actions with administrator privileges including, but not limited to, manipulating power levels, modifying user accounts, and exporting confidential user information

Quotes

• For tasks including digital signage, telecommunications, remote site management, and much more
• We found four vulnerabilities in CyberPower’s PowerPanel Enterprise Data Center Infrastructure Management (DCIM) platform and five vulnerabilities in Dataprobe’s iBoot Power Distribution Unit (PDU). An attacker could chain these vulnerabilities together to gain full access to these systems – which alone could be leveraged to commit substantial damage
• An attacker could chain these vulnerabilities together to gain full access to these systems – which alone could be leveraged to commit substantial damage. Furthermore, both products are vulnerable to remote code injection that could be leveraged to create a backdoor or an entry point to the broader network of connected data center devices and enterprise systems

Headlines

• Aug. 14, 2023 - Several Flaws Found in CyberPower and Dataprobe Products
• Aug. 14, 2023 - Major vulnerabilities discovered in data center solutions
• Aug. 14, 2023 - Nine flaws in CyberPower and Dataprobe solutions expose data centers to hacking
• Aug. 14, 2023 - Data centres vulnerable, researchers tell DEF CON
• Aug. 12, 2023 - Multiple Flaws in CyberPower and Dataprobe Products Put Data Centers at Risk

CVE-2023-32564

CRITICAL CVSS 9.80 EPSS Score 0.56 EPSS Percentile 74.75

Risk Context N/A

Published: Aug. 10, 2023

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.

Quotes

• The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of System

Headlines

• Aug. 17, 2023 - Ivanti patches MDM vulnerabilities
• Aug. 16, 2023 - Ivanti Patches Critical Vulnerability in Avalanche Enterprise MDM Solution
• Aug. 16, 2023 - Ivanti Avalanche vulnerable to attack by unauthenticated, remote attackers (CVE-2023-32560)
• Aug. 15, 2023 - Ivanti Avalanche impacted by critical pre-auth stack buffer overflows

CVE-2023-32563

CRITICAL CVSS 9.80 EPSS Score 1.05 EPSS Percentile 82.17

Risk Context N/A

Published: Aug. 10, 2023

An unauthenticated attacker could achieve the code execution through a RemoteControl server.

Quotes

• The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of System

Headlines

• Aug. 17, 2023 - Ivanti patches MDM vulnerabilities
• Aug. 16, 2023 - Ivanti Patches Critical Vulnerability in Avalanche Enterprise MDM Solution
• Aug. 16, 2023 - Ivanti Avalanche vulnerable to attack by unauthenticated, remote attackers (CVE-2023-32560)
• Aug. 15, 2023 - Ivanti Avalanche impacted by critical pre-auth stack buffer overflows

CVE-2023-32562

CRITICAL CVSS 9.80 EPSS Score 0.56 EPSS Percentile 74.75

Risk Context N/A

Published: Aug. 10, 2023

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1.

Quotes

• The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of System

Headlines

• Aug. 17, 2023 - Ivanti patches MDM vulnerabilities
• Aug. 16, 2023 - Ivanti Patches Critical Vulnerability in Avalanche Enterprise MDM Solution
• Aug. 16, 2023 - Ivanti Avalanche vulnerable to attack by unauthenticated, remote attackers (CVE-2023-32560)
• Aug. 15, 2023 - Ivanti Avalanche impacted by critical pre-auth stack buffer overflows

CVE-2023-3267

CRITICAL CVSS 9.10 EPSS Score 0.04 EPSS Percentile 5.84

Risk Context N/A

Published: Aug. 14, 2023

When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with system-level access to the CyberPower PowerPanel Enterprise server.

Quotes

• For tasks including digital signage, telecommunications, remote site management, and much more
• We found four vulnerabilities in CyberPower’s PowerPanel Enterprise Data Center Infrastructure Management (DCIM) platform and five vulnerabilities in Dataprobe’s iBoot Power Distribution Unit (PDU). An attacker could chain these vulnerabilities together to gain full access to these systems – which alone could be leveraged to commit substantial damage
• An attacker could chain these vulnerabilities together to gain full access to these systems – which alone could be leveraged to commit substantial damage. Furthermore, both products are vulnerable to remote code injection that could be leveraged to create a backdoor or an entry point to the broader network of connected data center devices and enterprise systems

Headlines

• Aug. 14, 2023 - Several Flaws Found in CyberPower and Dataprobe Products
• Aug. 14, 2023 - Major vulnerabilities discovered in data center solutions
• Aug. 14, 2023 - Nine flaws in CyberPower and Dataprobe solutions expose data centers to hacking
• Aug. 14, 2023 - Data centres vulnerable, researchers tell DEF CON
• Aug. 12, 2023 - Multiple Flaws in CyberPower and Dataprobe Products Put Data Centers at Risk

CVE-2023-32566

CRITICAL CVSS 9.10 EPSS Score 0.41 EPSS Percentile 70.74

Remote Code Execution

Published: Aug. 10, 2023

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.

Quotes

• The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of System

Headlines

• Aug. 17, 2023 - Ivanti patches MDM vulnerabilities
• Aug. 16, 2023 - Ivanti Patches Critical Vulnerability in Avalanche Enterprise MDM Solution
• Aug. 16, 2023 - Critical Security Flaws Affect Ivanti Avalanche, Threatening 30,000 Organizations
• Aug. 16, 2023 - Ivanti Avalanche vulnerable to attack by unauthenticated, remote attackers (CVE-2023-32560)
• Aug. 15, 2023 - Ivanti Avalanche impacted by critical pre-auth stack buffer overflows

CVE-2023-32561

HIGH CVSS 7.50 EPSS Score 0.41 EPSS Percentile 70.74

Risk Context N/A

Published: Aug. 10, 2023

A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1.

Quotes

• The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of System

Headlines

• Aug. 17, 2023 - Ivanti patches MDM vulnerabilities
• Aug. 16, 2023 - Ivanti Patches Critical Vulnerability in Avalanche Enterprise MDM Solution
• Aug. 16, 2023 - Critical Security Flaws Affect Ivanti Avalanche, Threatening 30,000 Organizations
• Aug. 16, 2023 - Ivanti Avalanche vulnerable to attack by unauthenticated, remote attackers (CVE-2023-32560)
• Aug. 15, 2023 - Ivanti Avalanche impacted by critical pre-auth stack buffer overflows