VULNERA Pulse

JetBrains — TeamCity

CVE-2024-27198 / Added: March 7, 2024

CRITICAL CVSS 9.80 EPSS Score 97.10 EPSS Percentile 99.76

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.

Headlines

• March 8, 2024 - CISA Warns of Actively Exploited JetBrains TeamCity Vulnerability
• March 7, 2024 - JetBrains TeamCity Mass Exploitation Underway, Rogue Accounts Thrive
• March 7, 2024 - JetBrains TeamCity under attack by ransomware thugs
• March 7, 2024 - Critical TeamCity Vulnerability Exploitation Started Immediately After Disclosure
• March 7, 2024 - Hundreds of Rogue Users Added to Unpatched TeamCity Servers
• March 7, 2024 - TeamCity auth bypass bug exploited to mass-generate admin accounts
• March 7, 2024 - Critical TeamCity flaw now widely exploited to create admin accounts
• March 5, 2024 - Rapid7 flames JetBrains over vulnerability disclosure
• March 5, 2024 - TeamCity Users Urged to Patch Critical Vulnerabilities
• March 5, 2024 - Experts disclosed two flaws in JetBrains TeamCity On-Premises SW
• March 5, 2024 - Critical JetBrains TeamCity On-Premises Flaws Could Lead to Server Takeovers
• March 4, 2024 - Critical TeamCity Bugs Endanger Software Supply Chain
• March 4, 2024 - Exploit available for new critical TeamCity auth bypass bug, patch now
• March 4, 2024 - Urgent: CVE-2024-27198 & CVE-2024-27199 Flaws in TeamCity Demand Your Attention
• March 4, 2024 - Critical vulnerabilities in TeamCity JetBrains fixed, release of technical details imminent, patch quickly! (CVE-2024-27198, CVE-2024-27199)

Back to top ↑

Apple — iOS and iPadOS

CVE-2024-23225 / Added: March 6, 2024

HIGH CVSS 7.80 EPSS Score 0.10 EPSS Percentile 41.72

Apple iOS and iPadOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.

Headlines

• March 7, 2024 - CISA adds Apple iOS and iPadOS memory corruption bugs to its Known Exploited Vulnerabilities Catalog
• March 6, 2024 - Patch Now: Apple Zero-Day Exploits Bypass Kernel Security
• March 6, 2024 - Apple remains tight-lipped about latest iPhone, iPad 0-days
• March 6, 2024 - Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296)
• March 5, 2024 - Apple emergency security updates fix two new iOS zero-days
• March 5, 2024 - Apple fixes two new iOS zero-days exploited in attacks on iPhones
• March 5, 2024 - CVE-2024-23225 & CVE-2024-23296: Apple Patches Actively Exploited 0-Day Flaws

Back to top ↑

Apple — iOS and iPadOS

CVE-2024-23296 / Added: March 6, 2024

HIGH CVSS 7.80 EPSS Score 0.17 EPSS Percentile 52.90

Apple iOS and iPadOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.

Headlines

• March 7, 2024 - CISA adds Apple iOS and iPadOS memory corruption bugs to its Known Exploited Vulnerabilities Catalog
• March 6, 2024 - Patch Now: Apple Zero-Day Exploits Bypass Kernel Security
• March 6, 2024 - Apple remains tight-lipped about latest iPhone, iPad 0-days
• March 6, 2024 - Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296)
• March 5, 2024 - Apple emergency security updates fix two new iOS zero-days
• March 5, 2024 - Apple fixes two new iOS zero-days exploited in attacks on iPhones
• March 5, 2024 - CVE-2024-23225 & CVE-2024-23296: Apple Patches Actively Exploited 0-Day Flaws

Back to top ↑

Sunhillo — SureLine

CVE-2021-36380 / Added: March 5, 2024

CRITICAL CVSS 9.80 EPSS Score 97.52 EPSS Percentile 99.98

Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.

Headlines

• March 6, 2024 - CISA Warns of Pixel Phone Vulnerability Exploitation
• March 6, 2024 - Urgent: Apple Issues Critical Updates for Actively Exploited Zero-Day Flaws
• March 5, 2024 - CISA Warns of Active Exploitation of CVE-2021-36380 & CVE-2023-21237 Flaws
• Oct. 10, 2023 - Mirai Variant IZ1H9 Adds 13 Exploits to Arsenal

Back to top ↑

Android — Pixel

CVE-2023-21237 / Added: March 5, 2024

MEDIUM CVSS 5.50 EPSS Score 0.18 EPSS Percentile 54.97

Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.

Headlines

• March 6, 2024 - CISA ADDS ANDROID PIXEL AND SUNHILLO SURELINE BUGS TO ITS KNOWN EXPLOITED VULNERABILITIES CATALOG
• March 6, 2024 - CISA Warns of Pixel Phone Vulnerability Exploitation
• March 6, 2024 - Urgent: Apple Issues Critical Updates for Actively Exploited Zero-Day Flaws
• March 5, 2024 - CISA Warns of Active Exploitation of CVE-2021-36380 & CVE-2023-21237 Flaws

Back to top ↑

Microsoft — Windows

CVE-2024-21338 / Added: March 4, 2024

HIGH CVSS 7.80 EPSS Score 0.08 EPSS Percentile 32.31

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Headlines

• March 5, 2024 - CISA ADDS MICROSOFT WINDOWS KERNEL BUG USED BY LAZARUS TO ITS KNOWN EXPLOITED VULNERABILITIES CATALOG
• March 5, 2024 - CISA Warns of Active Exploitation of Windows Kernel Vulnerability
• March 2, 2024 - Windows Kernel bug fixed last month exploited as zero-day since August
• March 1, 2024 - Microsoft Zero Day Used by Lazarus in Rootkit Attack
• Feb. 29, 2024 - Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks
• Feb. 29, 2024 - Lazarus APT exploited 0-day in Win driver to gain kernel privileges
• Feb. 29, 2024 - Zero-Day Alert (CVE-2024-21338): Lazarus Group Exploits Windows Kernel Vulnerability
• Feb. 28, 2024 - Lazarus hackers exploited Windows zero-day to gain Kernel privileges

Back to top ↑

CVE-2024-1709

CRITICAL CVSS 10.00 EPSS Score 93.46 EPSS Percentile 99.03

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Feb. 21, 2024

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

Vendor Impacted: Connectwise

Product Impacted: Screenconnect

Quotes

• A nuanced understanding of the appliance
• The list of threat actors utilizing the ScreenConnect vulnerability CVE-2024-1709 for initial access is growing
• Multiple workarounds to ensure provider claims are addressed and people have access to the medications and care they need
• The threat actor gained access to the victim workstation by exploiting the exposed setup wizard of the ScreenConnect application

Headlines

• March 7, 2024 - How Ransomware Fallout Is Rippling Through the US Health Care System
• March 5, 2024 - North Korea Hits ScreenConnect Bugs to Drop 'ToddleShark' Malware
• March 5, 2024 - Hackers Exploit ConnectWise ScreenConnect Flaws to Deploy TODDLERSHARK Malware
• March 4, 2024 - ScreenConnect flaws exploited to drop new ToddlerShark malware
• March 4, 2024 - ScreenConnect flaws exploited to drop new ToddleShark malware
• March 3, 2024 - Week in review: LockBit leak site is back online, NIST updates its Cybersecurity Framework

CVE-2024-27198

CRITICAL CVSS 9.80 EPSS Score 97.10 EPSS Percentile 99.76

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: March 4, 2024

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

Vendor Impacted: Jetbrains

Product Impacted: Teamcity

Quotes

• The Rapid7 blog on JetBrains TeamCity is savage – especially the disclosure timeline
• Never had any intention to release a fix silently without making the full details public
• There are between 3 and 300 hundreds users created on compromised instances, usually the pattern is 8 alphanum characters
• Attackers are realizing that tools like TeamCity for configuration deployment are an easy way to rapidly propagate malicious code
• Complete compromise of a vulnerable TeamCity server by a remote unauthenticated attacker, including unauthenticated remote code execution (RCE)
• The vulnerabilities may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server
• Compromising a TeamCity server allows an attacker full control over all TeamCity projects, builds, agents and artifacts, and as such is a suitable vector to position an attacker to perform a supply chain attack
• Both vulnerabilities are authentication bypass vulnerabilities, the most severe of which, CVE-2024-27198, allows for a complete compromise of a vulnerable TeamCity server by a remote unauthenticated attacker, including unauthenticated remote code execution (RCE)
• The ability of an unauthenticated attacker to bypass authentication checks and gain administrative control poses a significant risk not only to the immediate environment but also to the integrity and security of the software being developed and deployed through such compromised CI/CD pipelines
• Rapid7 originally identified and reported these vulnerabilities to us and has chosen to adhere strictly to its own vulnerability disclosure policy. This means that their team will publish full technical details of these vulnerabilities and their replication steps within 24 hours of this notice

Headlines

• March 8, 2024 - CISA Warns of Actively Exploited JetBrains TeamCity Vulnerability
• March 7, 2024 - JetBrains TeamCity Mass Exploitation Underway, Rogue Accounts Thrive
• March 7, 2024 - JetBrains TeamCity under attack by ransomware thugs
• March 7, 2024 - Critical TeamCity Vulnerability Exploitation Started Immediately After Disclosure
• March 7, 2024 - Hundreds of Rogue Users Added to Unpatched TeamCity Servers
• March 7, 2024 - TeamCity auth bypass bug exploited to mass-generate admin accounts
• March 7, 2024 - Critical TeamCity flaw now widely exploited to create admin accounts
• March 5, 2024 - Rapid7 flames JetBrains over vulnerability disclosure
• March 5, 2024 - TeamCity Users Urged to Patch Critical Vulnerabilities
• March 5, 2024 - Experts disclosed two flaws in JetBrains TeamCity On-Premises SW
• March 5, 2024 - Critical JetBrains TeamCity On-Premises Flaws Could Lead to Server Takeovers
• March 4, 2024 - Critical TeamCity Bugs Endanger Software Supply Chain
• March 4, 2024 - Exploit available for new critical TeamCity auth bypass bug, patch now
• March 4, 2024 - Urgent: CVE-2024-27198 & CVE-2024-27199 Flaws in TeamCity Demand Your Attention
• March 4, 2024 - Critical vulnerabilities in TeamCity JetBrains fixed, release of technical details imminent, patch quickly! (CVE-2024-27198, CVE-2024-27199)

CVE-2022-26134

CRITICAL CVSS 9.80 EPSS Score 97.53 EPSS Percentile 99.99

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: June 3, 2022

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.

Vendor Impacted: Atlassian

Products Impacted: Confluence Server/data Center, Confluence Data Center, Confluence Server

Quotes

• This extensive attack demonstrates the variety in initial access techniques available to cloud and Linux malware developers
• The attacks are relatively hard-coded and automated, so they look for known vulnerabilities in Confluence and other platforms and well-known misconfigurations in platforms like Redis and Docker
• The attackers leverage these tools to issue exploit code, taking advantage of common misconfigurations and exploiting an N-day vulnerability, to conduct Remote Code Execution (RCE) attacks and infect new hosts
• Interestingly, the malware developer neglected to strip the binaries, leaving DWARF debug information intact. There has been no effort made to obfuscate strings or other sensitive data within the binaries either, making them trivial to reverse engineer

Headlines

• March 6, 2024 - Cloud-y Linux Malware Rains on Apache, Docker, Redis & Confluence
• March 6, 2024 - Hackers Exploit Misconfigured YARN, Docker, Confluence, Redis Servers for Crypto Mining
• March 6, 2024 - Linux Malware Targets Docker, Apache Hadoop, Redis and Confluence
• March 6, 2024 - Sophisticated Linux Malware Campaign Targets Misconfigured Cloud Services
• March 6, 2024 - Hackers target Docker, Hadoop, Redis, Confluence with new Golang malware

CVE-2024-22252

CRITICAL CVSS 9.30 EPSS Score 0.04 EPSS Percentile 7.08

Public Exploits Available

Published: March 5, 2024

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Quotes

• May not be feasible at scale
• VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller
• A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox
• A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host

Headlines

• March 7, 2024 - VMware patches critical flaws in ESXi, Workstation, Fusion and Cloud Foundation
• March 7, 2024 - VMware urges emergency action to blunt hypervisor flaws
• March 7, 2024 - VMware patches against sandbox escape
• March 6, 2024 - VMware fixes critical sandbox escape flaws in ESXi, Workstation, and Fusion
• March 6, 2024 - VMware Issues Security Patches for ESXi, Workstation, and Fusion Flaws
• March 5, 2024 - VMware urgent updates addressed Critical ESXi Sandbox Escape bugs

CVE-2024-22253

CRITICAL CVSS 9.30 EPSS Score 0.04 EPSS Percentile 7.08

Risk Context N/A

Published: March 5, 2024

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Quotes

• VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller
• A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox
• A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host

Headlines

• March 7, 2024 - VMware patches critical flaws in ESXi, Workstation, Fusion and Cloud Foundation
• March 7, 2024 - VMware patches against sandbox escape
• March 6, 2024 - VMware fixes critical sandbox escape flaws in ESXi, Workstation, and Fusion
• March 6, 2024 - VMware Issues Security Patches for ESXi, Workstation, and Fusion Flaws
• March 5, 2024 - VMware urgent updates addressed Critical ESXi Sandbox Escape bugs

CVE-2024-1708

HIGH CVSS 8.40 EPSS Score 0.05 EPSS Percentile 16.19

Risk Context N/A

Published: Feb. 21, 2024

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

Vendor Impacted: Connectwise

Product Impacted: Screenconnect

Quotes

• A nuanced understanding of the appliance
• Multiple workarounds to ensure provider claims are addressed and people have access to the medications and care they need
• The threat actor gained access to the victim workstation by exploiting the exposed setup wizard of the ScreenConnect application

Headlines

• March 7, 2024 - How Ransomware Fallout Is Rippling Through the US Health Care System
• March 5, 2024 - North Korea Hits ScreenConnect Bugs to Drop 'ToddleShark' Malware
• March 5, 2024 - Hackers Exploit ConnectWise ScreenConnect Flaws to Deploy TODDLERSHARK Malware
• March 4, 2024 - ScreenConnect flaws exploited to drop new ToddlerShark malware
• March 4, 2024 - ScreenConnect flaws exploited to drop new ToddleShark malware
• March 3, 2024 - Week in review: LockBit leak site is back online, NIST updates its Cybersecurity Framework

CVE-2024-22254

HIGH CVSS 7.90 EPSS Score 0.04 EPSS Percentile 7.08

Risk Context N/A

Published: March 5, 2024

VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.

Quotes

• May not be feasible at scale
• A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox
• A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed

Headlines

• March 7, 2024 - VMware patches critical flaws in ESXi, Workstation, Fusion and Cloud Foundation
• March 7, 2024 - VMware urges emergency action to blunt hypervisor flaws
• March 7, 2024 - VMware patches against sandbox escape
• March 6, 2024 - VMware fixes critical sandbox escape flaws in ESXi, Workstation, and Fusion

CVE-2024-23296

HIGH CVSS 7.80 EPSS Score 0.17 EPSS Percentile 52.90

CISA Known Exploited

Published: March 5, 2024

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Vendor Impacted: Apple

Products Impacted: Ios And Ipados, Ipad Os, Iphone Os

Quotes

• Additional CVE entries [are] coming soon
• A privacy issue was addressed with improved private data redaction for log entries
• The kernel on any platform is crucial because it manages all operating system operations and hardware interactions
• An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited

Headlines

• March 7, 2024 - CISA adds Apple iOS and iPadOS memory corruption bugs to its Known Exploited Vulnerabilities Catalog
• March 6, 2024 - Patch Now: Apple Zero-Day Exploits Bypass Kernel Security
• March 6, 2024 - Apple remains tight-lipped about latest iPhone, iPad 0-days
• March 6, 2024 - Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296)
• March 5, 2024 - Apple emergency security updates fix two new iOS zero-days
• March 5, 2024 - Apple fixes two new iOS zero-days exploited in attacks on iPhones
• March 5, 2024 - CVE-2024-23225 & CVE-2024-23296: Apple Patches Actively Exploited 0-Day Flaws

CVE-2024-23225

HIGH CVSS 7.80 EPSS Score 0.10 EPSS Percentile 41.72

CISA Known Exploited

Published: March 5, 2024

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Vendor Impacted: Apple

Products Impacted: Ios And Ipados, Ipad Os, Iphone Os

Quotes

• Additional CVE entries [are] coming soon
• A privacy issue was addressed with improved private data redaction for log entries
• The kernel on any platform is crucial because it manages all operating system operations and hardware interactions
• An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited

Headlines

• March 7, 2024 - CISA adds Apple iOS and iPadOS memory corruption bugs to its Known Exploited Vulnerabilities Catalog
• March 6, 2024 - Patch Now: Apple Zero-Day Exploits Bypass Kernel Security
• March 6, 2024 - Apple remains tight-lipped about latest iPhone, iPad 0-days
• March 6, 2024 - Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296)
• March 5, 2024 - Apple emergency security updates fix two new iOS zero-days
• March 5, 2024 - Apple fixes two new iOS zero-days exploited in attacks on iPhones
• March 5, 2024 - CVE-2024-23225 & CVE-2024-23296: Apple Patches Actively Exploited 0-Day Flaws

CVE-2024-27199

HIGH CVSS 7.30 EPSS Score 0.05 EPSS Percentile 19.45

Risk Context N/A

Published: March 4, 2024

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

Quotes

• The Rapid7 blog on JetBrains TeamCity is savage – especially the disclosure timeline
• Attackers are realizing that tools like TeamCity for configuration deployment are an easy way to rapidly propagate malicious code
• The vulnerabilities may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server
• Compromising a TeamCity server allows an attacker full control over all TeamCity projects, builds, agents and artifacts, and as such is a suitable vector to position an attacker to perform a supply chain attack
• The ability of an unauthenticated attacker to bypass authentication checks and gain administrative control poses a significant risk not only to the immediate environment but also to the integrity and security of the software being developed and deployed through such compromised CI/CD pipelines
• Rapid7 originally identified and reported these vulnerabilities to us and has chosen to adhere strictly to its own vulnerability disclosure policy. This means that their team will publish full technical details of these vulnerabilities and their replication steps within 24 hours of this notice

Headlines

• March 8, 2024 - CISA Warns of Actively Exploited JetBrains TeamCity Vulnerability
• March 7, 2024 - JetBrains TeamCity Mass Exploitation Underway, Rogue Accounts Thrive
• March 7, 2024 - Critical TeamCity Vulnerability Exploitation Started Immediately After Disclosure
• March 5, 2024 - Rapid7 flames JetBrains over vulnerability disclosure
• March 5, 2024 - TeamCity Users Urged to Patch Critical Vulnerabilities
• March 5, 2024 - Experts disclosed two flaws in JetBrains TeamCity On-Premises SW
• March 5, 2024 - Critical JetBrains TeamCity On-Premises Flaws Could Lead to Server Takeovers
• March 4, 2024 - Critical TeamCity Bugs Endanger Software Supply Chain
• March 4, 2024 - Exploit available for new critical TeamCity auth bypass bug, patch now
• March 4, 2024 - Urgent: CVE-2024-27198 & CVE-2024-27199 Flaws in TeamCity Demand Your Attention
• March 4, 2024 - Critical vulnerabilities in TeamCity JetBrains fixed, release of technical details imminent, patch quickly! (CVE-2024-27198, CVE-2024-27199)