Vulnerability News - December 15, 2023

Snapshot

Dec. 9, 2023 - Dec. 15, 2023

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2023-6448	Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.	CRITICAL	Unitronics	Dec. 11, 2023
Newswires
NKAbuse Malware Exploits NKN Blockchain for Stealthy Operations NKAbuse, a new multi-platform malware, is the first to exploit the NKN (New Kind of Network) technology for data exchange, making it a covert threat.				Dec. 14, 2023
Russian APT29 Hackers Exploiting TeamCity Servers Since September: CISA The US Cybersecurity and Infrastructure Security Agency (CISA), along with its cybersecurity partners and intelligence services, has issued a warning that the APT29 hacking group, associated with Russia's Foreign Intelligence Service (SVR), has been focusing on unpatched TeamCity servers in a series of widespread attacks beginning in September 2023.				Dec. 13, 2023
Critical Apache Struts Vulnerability Targeted by Hackers Using Public Proof-of-Concept Hackers have begun to exploit a recently resolved critical vulnerability in Apache Struts, an open-source web application framework.				Dec. 13, 2023
Sophos Backports Critical Vulnerability Fix for EOL Firewall Firmware Sophos has retroactively implemented a fix for the critical code injection vulnerability, CVE-2022-3236, in its end-of-life (EOL) firewall firmware versions.				Dec. 13, 2023
Microsoft's December 2023 Patch Tuesday Addresses 34 Vulnerabilities, Including an AMD Zero-Day Microsoft's December 2023 Patch Tuesday has seen the release of security updates addressing a total of 34 vulnerabilities, including one previously disclosed but unpatched flaw in AMD CPUs.				Dec. 12, 2023
Critical RCE Vulnerability in WordPress Backup Migration Plug-in Puts Thousands of Websites at Risk A major unauthenticated remote control execution (RCE) vulnerability has been discovered in a widely used WordPress plug-in, Backup Migration, exposing many WordPress websites to potential compromise.				Dec. 12, 2023
Over 1,450 pfSense Servers Vulnerable to Remote Code Execution Attacks Due to Multiple Bugs Approximately 1,450 instances of pfSense, a widely used open-source firewall and router software, are currently exposed to potential remote code execution (RCE) attacks.				Dec. 12, 2023
Apple Releases Emergency Security Updates to Address Zero-Day Flaws on Older Devices Apple has proactively released emergency security updates to provide patches for two zero-day vulnerabilities that are currently being exploited, affecting older iPhone models, as well as select Apple Watch and Apple TV devices.				Dec. 11, 2023
Lazarus Group Exploits Log4j Security Flaws to Launch Global Cyberattack Campaign The Lazarus Group, a North Korea-associated threat actor, has launched a global campaign exploiting Log4j vulnerabilities to deploy new remote access trojans (RATs).				Dec. 11, 2023
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2021-44228 (10)	Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect agai...	CRITICAL	Cisco, Siemens, Snowsoftware, Apache, Bentley, Sonicwall, Debian, Intel, Netapp, Percussion, Fedoraproject	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available
CVE-2017-5638 (8)	The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handlin...	CRITICAL	Apache	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2023-50164 (11)	An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploadi...	CRITICAL	Apache	Actively Exploited Remote Code Execution Public Exploits Available
CVE-2023-42793 (9)	In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible	CRITICAL	Jetbrains	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available
CVE-2023-36019 (7)	Microsoft Power Platform Connector Spoofing Vulnerability	CRITICAL		Actively Exploited
CVE-2023-42917 (6)	A memory corruption vulnerability was addressed with improved locking.	HIGH	Apple	CISA Known Exploited
CVE-2023-35641 (5)	Internet Connection Sharing Remote Code Execution Vulnerability	HIGH	Microsoft	Remote Code Execution
CVE-2023-35628 (9)	Windows MSHTML Platform Remote Code Execution Vulnerability	HIGH	Microsoft	Actively Exploited Remote Code Execution
CVE-2023-42916 (6)	An out-of-bounds read was addressed with improved input validation.	MEDIUM	Apple	CISA Known Exploited
CVE-2023-35636 (5)	Microsoft Outlook Information Disclosure Vulnerability	MEDIUM	Microsoft	Risk Context N/A

CISA Known Exploited Vulnerabilities

CISA added one vulnerability to the known exploited vulnerabilities list.

Unitronics — Vision PLC and HMI

CVE-2023-6448 / Added: Dec. 11, 2023

CRITICAL CVSS 9.80 EPSS Score 4.46 EPSS Percentile 91.55

Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.

Headlines

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2021-44228

CRITICAL CVSS 10.00 EPSS Score 97.45 EPSS Percentile 99.95

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Dec. 10, 2021

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Vendors Impacted: Cisco, Siemens, Snowsoftware, Apache, Bentley, Sonicwall, Debian, Intel, Netapp, Percussion, Fedoraproject

Products Impacted: Oneapi Sample Browser, Cloud Secure Agent, Nexus Insights, Firepower 1150, Head-End System Universal Device Integration System, Cloudcenter Workload Manager, Firepower 1010, Unified Contact Center Express, Ontap Tools, Solid Edge Cam Pro, E-Car Operation Center, Unified Communications Manager Im And Presence Service, Fxos, Ucs Central, Data Center Network Manager, Email Security, Firepower 4145, Unified Intelligence Center, Virtual Topology System, Snapcenter, Nx, Automated Subsea Tuning, Spectrum Power 4, Crosswork Zero Touch Provisioning, Nexus Dashboard, Mendix, Sd-Wan Vmanage, Opcenter Intelligence, Logo\! Soft Comfort, Industrial Edge Management, Cloud Insights, Debian Linux, Energyip Prepay, Firepower 4120, Audio Development Kit, Broadworks, Active Iq Unified Manager, Contact Center Management Portal, Sensor Solution Firmware Development Kit, Firepower 4110, Network Services Orchestrator, Unified Contact Center Enterprise, System Debugger, Gma-Manager, Siguard Dsa, Business Process Automation,...

Quotes

Andariel is typically tasked with initial access, reconnaissance and establishing long term access for espionage in support of the North Korean government's national interests
This campaign consists of continued opportunistic targeting of enterprises around the world that publicly host and expose their vulnerable infrastructure to n-day vulnerability exploitation such as CVE-2021-44228
This particular attack observed by Talos involves the successful exploitation of CVE-2021-44228, also known as Log4Shell, on publicly facing VMWare Horizon servers, as a means of initial access to vulnerable public-facing servers
If Log4Shell was another example in a long series of wake-up calls to adopt more stringent open source security practices, the fact that more than one in three applications currently run vulnerable versions of Log4j shows there is more work to do
Log4j created awareness that you should have as much security testing automation in build processes as possible. It was also a wake-up call to how security technical debt, when left unaddressed, can cause urgent issues to take an enormous amount of time to fix

Headlines

CVE-2017-5638

CRITICAL CVSS 10.00 EPSS Score 97.54 EPSS Percentile 99.99

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 11, 2017

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Vendor Impacted: Apache

Product Impacted: Struts

Quotes

All developers are strongly advised to perform this upgrade
This threat (ab)uses the NKN public blockchain protocol to carry out a large set of flooding attacks and act as a backdoor inside Linux systems
Although relatively rare, new cross-platform flooders and backdoors like NKAbuse stand out through their utilization of less common communication protocols
The malware utilizes NKN technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and backdoor capabilities
An attacker can manipulate file upload parameters to enable path traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform remote code execution
It is a powerful Linux implant with flooder and backdoor capabilities that can attack a target simultaneously using multiple protocols like HTTP, DNS, or TCP, for example, and can also allow an attacker control the system and extract information from it

Headlines

CVE-2023-50164

CRITICAL CVSS 9.80 EPSS Score 9.80 EPSS Percentile 94.23

Actively Exploited Remote Code Execution Public Exploits Available

Published: Dec. 7, 2023

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Vendor Impacted: Apache

Product Impacted: Struts

Quotes

Profile → Edit Selected Profile
All developers are strongly advised to perform this upgrade
Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1
Attackers aim to deploy webshells, with some cases targeting the parameter ‘fileFileName’ – a deviation from the original exploit PoC
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution
An attacker can manipulate file upload parameters to enable path traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform remote code execution
This vulnerability requires crafting specific proofs of concept (POCs) according to different scenarios, as bypassing it can be challenging if there is stringent interception and inspection at the file upload point

Headlines

CVE-2023-42793

CRITICAL CVSS 9.80 EPSS Score 97.26 EPSS Percentile 99.82

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Sept. 19, 2023

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Vendor Impacted: Jetbrains

Product Impacted: Teamcity

Quotes

Since 2013, cybersecurity companies and governments have reported on SVR operations targeting victim networks to steal confidential and proprietary information
Andariel is typically tasked with initial access, reconnaissance and establishing long term access for espionage in support of the North Korean government's national interests
[An exploit] may allow for deploying a malicious update which, in the simplest scenario, could execute adversary tools resulting in enabling access to devices or whole networks
If compromised, access to a TeamCity server would provide malicious actors with access to that software developer’s source code, signing certificates, and the ability to subvert software compilation and deployment processes
By choosing to exploit CVE-2023-42793, a software development program, the authoring agencies assess the SVR could benefit from access to victims, particularly by allowing the threat actors to compromise the networks of dozens of software developers
The SVR has been observed using the initial access gleaned by exploiting the TeamCity CVE to escalate its privileges, move laterally, deploy additional backdoors, and take other steps to ensure persistent and long-term access to the compromised network environments
The SVR has, however, been observed using the initial access gleaned by exploiting the TeamCity CVE to escalate its privileges, move laterally, deploy additional backdoors, and take other steps to ensure persistent and long-term access to the compromised network environments
In April 2021, the U.S. Government attributed a supply chain operation targeting the SolarWinds information technology company and its customers to the SVR. This attribution marked the discovery that the SVR had, since at least 2018, expanded the range of its cyber operations to include the widespread targeting of information technology companies. At least some of this targeting was aimed at enabling additional cyber operations
TeamCity server version 2023.05.3 and below is prone to an authentication bypass, which allows an unauthenticated attacker to gain remote code execution (RCE) on the server. This enables attackers not only to steal source code but also stored service secrets and private keys. And it’s even worse: With access to the build process, attackers can inject malicious code, compromising the integrity of software releases and impacting all downstream users

Headlines

CVE-2023-36019

CRITICAL CVSS 9.60 EPSS Score 0.09 EPSS Percentile 38.35

Actively Exploited

Published: Dec. 12, 2023

Microsoft Power Platform Connector Spoofing Vulnerability

Quotes

Potentially return speculative data resulting in loss of confidentiality
Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1
An attacker could manipulate a malicious link, application, or file to disguise it as a legitimate link or file to trick the victim
This month, Microsoft did not patch any zero-day vulnerabilities, marking only the second time in 2023 that no zero-days were fixed (June was the other month)
In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability
The December release is typically small, and this month is no exception. In fact, this is the lightest release since December 2017. Still, with over 900 CVEs addressed this year, 2023 has been one of the busiest years for Microsoft patches

Headlines

CVE-2023-42917

HIGH CVSS 8.80 EPSS Score 0.14 EPSS Percentile 48.88

CISA Known Exploited

Published: Nov. 30, 2023

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Vendor Impacted: Apple

Products Impacted: Safari, Ipados, Iphone Os, Macos, Multiple Products

Quotes

Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1
Allow attackers to access sensitive information through out-of-bounds reads and execute remote code execution (RCE) via memory corruption through malicious webpages
IMessage Contact Key Verification advances the state of the art of Key Transparency deployments by having user devices themselves verify consistency proofs and ensure consistency of the KT system across all user devices for an account

Headlines

CVE-2023-35641

HIGH CVSS 8.80 EPSS Score 0.10 EPSS Percentile 39.62

Remote Code Execution

Published: Dec. 12, 2023

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2022, Windows 10 1507, Windows 10 1607, Windows Server 2019, Windows 10 21h2, Windows 10 22h2, Windows Server 2008, Windows 10 1809, Windows 11 23h2, Windows Server 2012, Windows 11 21h2, Windows Server 2016, Windows 11 22h2

Quotes

Potentially return speculative data resulting in loss of confidentiality
Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1
December's Patch Tuesday may seem like an early seasonal gift to security teams with a small number of patches and none reported as exploited in the wild
In the worst-case scenario, Microsoft suggests that simply receiving an email would be enough to trigger the vulnerability and give an attacker code execution on the target machine without any user interaction like opening or interacting with the contents

Headlines

CVE-2023-35628

HIGH CVSS 8.10 EPSS Score 0.64 EPSS Percentile 76.91

Actively Exploited Remote Code Execution

Published: Dec. 12, 2023

Windows MSHTML Platform Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2022 23h2, Windows Server 2022, Windows 10 1507, Windows 10 1607, Windows Server 2019, Windows 10 21h2, Windows 10 22h2, Windows Server 2008, Windows 10 1809, Windows 11 23h2, Windows Server 2012, Windows 11 21h2, Windows Server 2016, Windows 11 22h2

Quotes

Potentially return speculative data resulting in loss of confidentiality
Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1
December's Patch Tuesday may seem like an early seasonal gift to security teams with a small number of patches and none reported as exploited in the wild
This month, Microsoft did not patch any zero-day vulnerabilities, marking only the second time in 2023 that no zero-days were fixed (June was the other month)
The December release is typically small, and this month is no exception. In fact, this is the lightest release since December 2017. Still, with over 900 CVEs addressed this year, 2023 has been one of the busiest years for Microsoft patches
In the worst-case scenario, Microsoft suggests that simply receiving an email would be enough to trigger the vulnerability and give an attacker code execution on the target machine without any user interaction like opening or interacting with the contents

Headlines

CVE-2023-42916

MEDIUM CVSS 6.50 EPSS Score 0.13 EPSS Percentile 47.60

CISA Known Exploited

Published: Nov. 30, 2023

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Vendor Impacted: Apple

Products Impacted: Safari, Ipados, Iphone Os, Macos, Multiple Products

Quotes

Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1
Allow attackers to access sensitive information through out-of-bounds reads and execute remote code execution (RCE) via memory corruption through malicious webpages
IMessage Contact Key Verification advances the state of the art of Key Transparency deployments by having user devices themselves verify consistency proofs and ensure consistency of the KT system across all user devices for an account

Headlines

CVE-2023-35636

MEDIUM CVSS 6.50 EPSS Score 0.11 EPSS Percentile 42.61

Risk Context N/A

Published: Dec. 12, 2023

Microsoft Outlook Information Disclosure Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Office Long Term Servicing Channel, Office, 365 Apps

Quotes

December's Patch Tuesday may seem like an early seasonal gift to security teams with a small number of patches and none reported as exploited in the wild
This month, Microsoft did not patch any zero-day vulnerabilities, marking only the second time in 2023 that no zero-days were fixed (June was the other month)
The December release is typically small, and this month is no exception. In fact, this is the lightest release since December 2017. Still, with over 900 CVEs addressed this year, 2023 has been one of the busiest years for Microsoft patches
In the worst-case scenario, Microsoft suggests that simply receiving an email would be enough to trigger the vulnerability and give an attacker code execution on the target machine without any user interaction like opening or interacting with the contents

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

December 15, 2023

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

December 15, 2023

Snapshot

CISA Known Exploited Vulnerabilities

Newswires

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Unitronics — Vision PLC and HMI

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe