VULNERA Pulse

CVE-2023-49606

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 38.60

Actively Exploited Remote Code Execution Public Exploits Available

Published: May 1, 2024

A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability.

Quotes

• Federal, state, local, tribal and territorial governments, as well as public and private sector critical infrastructure organizations
• Despite its design for smaller networks, compromising a proxy server can have serious consequences such as data breaches and service disruptions
• A security researcher from TALOS intelligence found a use-after-free vulnerability in tinyproxy in december 2023, claiming to have contacted upstream and waited 6 months for publication
• A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability

Headlines

• May 9, 2024 - A new alert system from CISA seems to be effective — now we just need companies to sign up
• May 8, 2024 - Critical Bug Could Open 50K+ Tinyproxy Servers to DoS, RCE
• May 8, 2024 - Talos discloses multiple zero-day vulnerabilities, two of which could lead to code execution
• May 8, 2024 - Most Tinyproxy Instances are potentially vulnerable to flaw CVE-2023-49606
• May 7, 2024 - Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw
• May 6, 2024 - Critical Tinyproxy Flaw Opens Over 50,000 Hosts to Remote Code Execution
• May 6, 2024 - CVE-2023-49606 (CVSS 9.8): Tinyproxy Zero-Day Threatens Thousands

CVE-2023-23397

CRITICAL CVSS 9.80 EPSS Score 92.64 EPSS Percentile 98.99

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 14, 2023

Microsoft Outlook Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Office, Outlook, 365 Apps

Quotes

• Senior authorities in Poland and Ukraine
• The CERT Polska (CSIRT NASK) and CSIRT MON teams observed a large-scale malware campaign targeting Polish government institutions
• It was a state-sponsored Russian cyber attack on Germany, and this is absolutely intolerable and unacceptable and will have consequences
• Cyber attacks targeting political entities, state institutions and critical infrastructure are not only a threat to national security, but also disrupt the democratic processes on which our free society is based
• The Federal Government’s national attribution procedure regarding this campaign has concluded that, for a relatively long period, the cyber actor APT28 used a critical vulnerability in Microsoft Outlook that remained unidentified at the time to compromise numerous email accounts

Headlines

• May 10, 2024 - Russia-linked APT28 targets government Polish institutions
• May 9, 2024 - Poland says Russian military hackers target its govt networks
• May 6, 2024 - Germany blames Fancy Bear for 2023 hacking campaign
• May 5, 2024 - NATO and the EU formally condemned APT28 cyber espionage
• May 4, 2024 - Microsoft Outlook Flaw Exploited by Russia's APT28 to Hack Czech, German Entities

CVE-2023-47610

CRITICAL CVSS 9.80 EPSS Score 0.23 EPSS Percentile 61.09

Actively Exploited Remote Code Execution

Published: Nov. 9, 2023

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message.

Vendor Impacted: Telit

Products Impacted: Bgs5 Firmware, Pds8, Pls62, Pds8 Firmware, Pds5 Firmware, Ehs5 Firmware, Ehs8, Els61, Pds6 Firmware, Pds6, Ehs8 Firmware, Ehs5, Bgs5, Els81 Firmware, Pds5, Ehs6, Pls62 Firmware, Ehs6 Firmware, Els81, Els61 Firmware

Quotes

• According to the transmission protocol, the ULPSizeFromPacket and wapTpduLen variables are calculated independently
• Although we cannot provide a precise estimate of the number of IoT vendors or products impacted, potentially millions of devices across various industries could be affected
• This access also facilitates the manipulation of RAM and flash memory, increasing the potential to seize complete control over the modem's functionalities—all without authentication or requiring physical access to the device

Headlines

• May 10, 2024 - Millions of IoT Devices at Risk From Integrated Modem
• May 10, 2024 - Widely used Telit Cinterion modems open to SMS takeover attacks
• May 10, 2024 - Widely used modems in industrial IoT devices open to SMS attack

CVE-2024-21887

CRITICAL CVSS 9.10 EPSS Score 97.33 EPSS Percentile 99.88

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 12, 2024

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Vendor Impacted: Ivanti

Products Impacted: Connect Secure And Policy Secure, Policy Secure, Connect Secure

Quotes

• This command sequence attempts to wipe files, downloads a script from a remote server, sets executable permissions, and executes the script, potentially leading to an infected system
• UNC5221 is a suspected China-nexus actor that Mandiant is tracking as the only group exploiting CVE-2023-46805 and CVE-2024-21887 during the pre-disclosure time frame since early Dec. 2023
• If CVE-2024-21887 is used in conjunction with CVE-2023-46805, exploitation does not require authentication and enables a threat actor to craft malicious requests and execute arbitrary commands on the system
• The adversary maneuvered within the research network via VMware infrastructure using a compromised administrator account, then employed a combination of backdoors and web shells to maintain persistence and harvest credentials
• The adversary manipulated VMs and established control over the infrastructure. The adversary used compromised administrative credentials, authenticated from an internal NERVE IP address, indicating lateral movement within the NERVE

Headlines

• May 9, 2024 - Mirai botnet also spreads through the exploitation of Ivanti Connect Secure bugs
• May 9, 2024 - Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery
• May 8, 2024 - MITRE breach details reveal attackers' successes and failures
• May 8, 2024 - Mirai Botnet Exploits Ivanti Vulnerabilities (CVE-2023-46805 & CVE-2024-21887)
• May 8, 2024 - China-Linked Hackers Target MITRE with ROOTROT Web Shell
• May 7, 2024 - MITRE attributes the recent attack to China-linked UNC5221
• May 7, 2024 - Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation | Official Blogs
• May 7, 2024 - China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion

CVE-2023-40000

HIGH CVSS 8.30 EPSS Score 0.04 EPSS Percentile 8.45

Actively Exploited Public Exploits Available

Published: April 16, 2024

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.

Quotes

• Search in [the] database for suspicious strings like 'eval(atob(Strings.fromCharCode
• The most common IP addresses that were probably scanning for vulnerable sites were 94.102.51.144, with 1,232,810 requests, and 31.43.191.220 with 70,472 requests

Headlines

• May 8, 2024 - LiteSpeed Cache WordPress plugin actively exploited in the wild
• May 8, 2024 - Hackers Exploiting LiteSpeed Cache Bug to Gain Full Control of WordPress Sites
• May 7, 2024 - Hackers exploit LiteSpeed Cache flaw to create WordPress admins

CVE-2023-46805

HIGH CVSS 8.20 EPSS Score 96.56 EPSS Percentile 99.61

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: Jan. 12, 2024

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

Vendor Impacted: Ivanti

Products Impacted: Connect Secure And Policy Secure, Policy Secure, Connect Secure

Quotes

• This command sequence attempts to wipe files, downloads a script from a remote server, sets executable permissions, and executes the script, potentially leading to an infected system
• UNC5221 is a suspected China-nexus actor that Mandiant is tracking as the only group exploiting CVE-2023-46805 and CVE-2024-21887 during the pre-disclosure time frame since early Dec. 2023
• If CVE-2024-21887 is used in conjunction with CVE-2023-46805, exploitation does not require authentication and enables a threat actor to craft malicious requests and execute arbitrary commands on the system
• The adversary maneuvered within the research network via VMware infrastructure using a compromised administrator account, then employed a combination of backdoors and web shells to maintain persistence and harvest credentials
• The adversary manipulated VMs and established control over the infrastructure. The adversary used compromised administrative credentials, authenticated from an internal NERVE IP address, indicating lateral movement within the NERVE

Headlines

• May 9, 2024 - Mirai botnet also spreads through the exploitation of Ivanti Connect Secure bugs
• May 9, 2024 - Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery
• May 8, 2024 - MITRE breach details reveal attackers' successes and failures
• May 8, 2024 - Mirai Botnet Exploits Ivanti Vulnerabilities (CVE-2023-46805 & CVE-2024-21887)
• May 8, 2024 - China-Linked Hackers Target MITRE with ROOTROT Web Shell
• May 7, 2024 - MITRE attributes the recent attack to China-linked UNC5221
• May 7, 2024 - Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation | Official Blogs
• May 7, 2024 - China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion

CVE-2024-3661

HIGH CVSS 7.60 EPSS Score 0.05 EPSS Percentile 16.35

Actively Exploited Remote Code Execution

Published: May 6, 2024

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Quotes

• Furthermore, the strength of the encryption algorithm a VPN uses makes no difference
• This is particularly dangerous for people who rely on VPNs to keep them safe, such as journalists and political dissidents
• We want to stress that there are ways an attacker who is on the same network as a targeted user might be able to become their DHCP server
• Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway
• Because this technique is not dependent on exploiting VPN technologies or underlying protocols, it works completely independently of the VPN provider or implementation

Headlines

• May 9, 2024 - New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation
• May 8, 2024 - New TunnelVision technique can bypass the VPN encapsulation
• May 8, 2024 - Attackers may be using TunnelVision to snoop on users' VPN traffic (CVE-2024-3661)
• May 7, 2024 - Watch out for rogue DHCP servers decloaking your VPN
• May 7, 2024 - New attack leaks VPN traffic using rogue DHCP servers
• May 7, 2024 - Major VPN Flaw Exposed: "TunnelVision" (CVE-2024-3661) Threatens Security on Public Networks

CVE-2024-26026

HIGH CVSS 7.50 EPSS Score 0.04 EPSS Percentile 8.45

Public Exploits Available

Published: May 8, 2024

An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Quotes

• To reduce operational complexity, improve performance, strengthen security, and enhance observability
• These attacker-controlled accounts would not be visible from the Next Central Manager itself, enabling ongoing malicious persistence within the environment
• The management console of the Central Manager can be remotely exploited by any attacker able to access the administrative UI via CVE 2024-21793 or CVE 2024-26026. This would result in full administrative control of the manager itself
• Our ongoing research has identified remotely exploitable vulnerabilities in F5’s Next Central Manager that can give attackers full administrative control of the device, and subsequently allow attackers to create accounts on any F5 assets managed by the Next Central Manager

Headlines

• May 9, 2024 - 2 (or 5) Bugs in F5 Asset Manager Allow Full Takeover, Hidden Accounts
• May 9, 2024 - F5 fixes BIG-IP Next Central Manager flaws with public PoCs (CVE-2024-21793, CVE-2024-26026)
• May 9, 2024 - F5 Patches Dangerous Vulnerabilities in BIG-IP Next Central Manager
• May 9, 2024 - Experts warn of BIG-IP Next Central Manager flaws that allow device takeover
• May 8, 2024 - New BIG-IP Next Central Manager bugs allow device takeover

CVE-2024-21793

HIGH CVSS 7.50 EPSS Score 0.04 EPSS Percentile 8.45

Public Exploits Available

Published: May 8, 2024

An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Quotes

• To reduce operational complexity, improve performance, strengthen security, and enhance observability
• These attacker-controlled accounts would not be visible from the Next Central Manager itself, enabling ongoing malicious persistence within the environment
• The management console of the Central Manager can be remotely exploited by any attacker able to access the administrative UI via CVE 2024-21793 or CVE 2024-26026. This would result in full administrative control of the manager itself
• Our ongoing research has identified remotely exploitable vulnerabilities in F5’s Next Central Manager that can give attackers full administrative control of the device, and subsequently allow attackers to create accounts on any F5 assets managed by the Next Central Manager

Headlines

• May 9, 2024 - 2 (or 5) Bugs in F5 Asset Manager Allow Full Takeover, Hidden Accounts
• May 9, 2024 - F5 fixes BIG-IP Next Central Manager flaws with public PoCs (CVE-2024-21793, CVE-2024-26026)
• May 9, 2024 - F5 Patches Dangerous Vulnerabilities in BIG-IP Next Central Manager
• May 9, 2024 - Experts warn of BIG-IP Next Central Manager flaws that allow device takeover
• May 8, 2024 - New BIG-IP Next Central Manager bugs allow device takeover