VULNERA Pulse

Apache — ActiveMQ

CVE-2023-46604 / Added: Nov. 2, 2023

CRITICAL CVSS 10.00 EPSS Score 1.60 EPSS Percentile 85.97

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Headlines

• Nov. 2, 2023 - Attackers Target Max-Severity Apache ActiveMQ Bug to Drop Ransomware
• Nov. 2, 2023 - Critical Apache ActiveMQ bug exploited by ransomware crew
• Nov. 2, 2023 - HelloKitty ransomware now exploiting Apache ActiveMQ flaw in attacks
• Nov. 2, 2023 - Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)
• Nov. 2, 2023 - Suspected exploitation of Apache ActiveMQ flaw CVE-2023-46604 to install HelloKitty ransomware
• Nov. 2, 2023 - Apache ActiveMQ Servers Exploited by HelloKitty Ransomware
• Nov. 2, 2023 - HelloKitty Ransomware Group Exploiting Apache ActiveMQ Vulnerability
• Nov. 1, 2023 - 3,000 Apache ActiveMQ servers vulnerable to RCE attacks exposed online

Back to top ↑

F5 — BIG-IP Configuration Utility

CVE-2023-46747 / Added: Oct. 31, 2023

CRITICAL CVSS 9.80 EPSS Score 95.30 EPSS Percentile 99.13

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.

Headlines

• Nov. 2, 2023 - F5 BIG-IP vulnerabilities leveraged by attackers: What to do?
• Nov. 1, 2023 - CISA adds two F5 BIG-IP flaws to its Known Exploited Vulnerabilities catalog
• Nov. 1, 2023 - Threat actors actively exploit F5 BIG-IP flaws CVE-2023-46747/8
• Nov. 1, 2023 - F5's critical BIG-IP vulnerability under active exploitation
• Nov. 1, 2023 - Hackers exploit recent F5 BIG-IP flaws in stealthy attacks
• Nov. 1, 2023 - CISA and F5 Warn of BIG-IP Security Vulnerabilities Under Active Exploit
• Nov. 1, 2023 - Alert: F5 Warns of Active Attacks Exploiting BIG-IP Vulnerability
• Oct. 31, 2023 - Attackers Exploiting Critical F5 BIG-IP Vulnerability
• Oct. 30, 2023 - F5 fixes critical BIG-IP vulnerability (CVE-2023-46747)
• Oct. 30, 2023 - CVE-2023-46748: F5 BIG-IP SQL injection vulnerability
• Oct. 29, 2023 - newsletter Round 443 by Pierluigi Paganini
• Oct. 27, 2023 - F5 hurriedly squashes BIG-IP remote code execution bug
• Oct. 27, 2023 - F5 fixes BIG-IP auth bypass allowing remote code execution attacks
• Oct. 27, 2023 - F5 Warns of Critical Remote Code Execution Vulnerability in BIG-IP
• Oct. 27, 2023 - F5 urges to address a critical flaw in BIG-IP
• Oct. 27, 2023 - F5 Issues Warning: BIG-IP Vulnerability Allows Remote Code Execution
• Oct. 27, 2023 - CVE-2023-46747: F5 BIG-IP Unauthenticated RCE Vulnerability

Back to top ↑

F5 — BIG-IP Configuration Utility

CVE-2023-46748 / Added: Oct. 31, 2023

HIGH CVSS 8.80 EPSS Score 0.61 EPSS Percentile 76.26

F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

Headlines

• Nov. 2, 2023 - F5 BIG-IP vulnerabilities leveraged by attackers: What to do?
• Nov. 1, 2023 - CISA adds two F5 BIG-IP flaws to its Known Exploited Vulnerabilities catalog
• Nov. 1, 2023 - Threat actors actively exploit F5 BIG-IP flaws CVE-2023-46747/8
• Nov. 1, 2023 - F5's critical BIG-IP vulnerability under active exploitation
• Nov. 1, 2023 - Hackers exploit recent F5 BIG-IP flaws in stealthy attacks
• Nov. 1, 2023 - CISA and F5 Warn of BIG-IP Security Vulnerabilities Under Active Exploit
• Nov. 1, 2023 - Alert: F5 Warns of Active Attacks Exploiting BIG-IP Vulnerability
• Oct. 31, 2023 - Attackers Exploiting Critical F5 BIG-IP Vulnerability
• Oct. 30, 2023 - CVE-2023-46748: F5 BIG-IP SQL injection vulnerability

Back to top ↑

CVE-2023-46604

CRITICAL CVSS 10.00 EPSS Score 1.60 EPSS Percentile 85.97

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 27, 2023

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.  Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Vendor Impacted: Apache

Product Impacted: Activemq

Quotes

• Apache ActiveMQ is vulnerable to remote code execution
• In both instances, the adversary attempted to deploy ransomware binaries on target systems in an effort to ransom the victim organizations. Based on the ransom note and available evidence, we attribute the activity to the HelloKitty ransomware family, whose source code was leaked on a forum in early October
• Beginning Friday, October 27, Rapid7 Managed Detection and Response (MDR) identified suspected exploitation of Apache ActiveMQ CVE-2023-46604 in two different customer environments. In both instances, the adversary attempted to deploy ransomware binaries on target systems in an effort to ransom the victim organizations

Headlines

• Nov. 2, 2023 - Attackers Target Max-Severity Apache ActiveMQ Bug to Drop Ransomware
• Nov. 2, 2023 - Critical Apache ActiveMQ bug exploited by ransomware crew
• Nov. 2, 2023 - HelloKitty ransomware now exploiting Apache ActiveMQ flaw in attacks
• Nov. 2, 2023 - Attackers exploiting Apache ActiveMQ flaw to deliver ransomware (CVE-2023-46604)
• Nov. 2, 2023 - Suspected exploitation of Apache ActiveMQ flaw CVE-2023-46604 to install HelloKitty ransomware
• Nov. 2, 2023 - Apache ActiveMQ Servers Exploited by HelloKitty Ransomware
• Nov. 2, 2023 - HelloKitty Ransomware Group Exploiting Apache ActiveMQ Vulnerability
• Nov. 1, 2023 - 3,000 Apache ActiveMQ servers vulnerable to RCE attacks exposed online

CVE-2023-20198

CRITICAL CVSS 10.00 EPSS Score 95.56 EPSS Percentile 99.19

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 16, 2023

Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. For steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory  Cisco will provide updates on the status of this investigation and when a software patch is available.

Vendor Impacted: Cisco

Products Impacted: Ios Xe Web Ui, Ios Xe

Quotes

• An attacker could make a specially crafted network call to the target Skype for Business server, which could cause the parsing of an http request made to an arbitrary address
• Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks
• The crux of this vulnerability is in the first line of this request POST /%2577ebui_wsma_HTTP. This clever encoding of webui_wsma_http bypasses the Nginx matches discussed in the previous post and allows us to reach the WMSA service in iosd

Headlines

• Nov. 1, 2023 - CISA Updates Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities | CISA
• Oct. 31, 2023 - Experts released PoC exploit code for Cisco IOS XE flaw CVE-2023-20198
• Oct. 31, 2023 - Apple, Google, and Microsoft Just Patched Some Spooky Security Flaws
• Oct. 31, 2023 - Exploit released for critical Cisco IOS XE flaw, many hosts still hacked
• Oct. 29, 2023 - Week in review: VMware patches critical vulnerability, 1Password affected by Okta breach

CVE-2023-46747

CRITICAL CVSS 9.80 EPSS Score 95.30 EPSS Percentile 99.13

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: Oct. 26, 2023

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Vendor Impacted: F5

Product Impacted: Big-Ip Configuration Utility

Quotes

• This information is based on the evidence F5 has seen on compromised devices, which appear to be reliable indicators
• This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands
• This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. There is no data plane exposure; this is a control plane issue only
• An authenticated SQL injection vulnerability exists in the BIG-IP configuration utility which may allow an authenticated attacker with network access to the configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands
• It is important to note that not all exploited systems may show the same indicators, and, indeed, a skilled attacker may be able to remove traces of their work. It is not possible to prove a device has not been compromised; when there is any uncertainty, you should consider the device compromised

Headlines

• Nov. 2, 2023 - F5 BIG-IP vulnerabilities leveraged by attackers: What to do?
• Nov. 1, 2023 - CISA adds two F5 BIG-IP flaws to its Known Exploited Vulnerabilities catalog
• Nov. 1, 2023 - Threat actors actively exploit F5 BIG-IP flaws CVE-2023-46747/8
• Nov. 1, 2023 - F5's critical BIG-IP vulnerability under active exploitation
• Nov. 1, 2023 - Hackers exploit recent F5 BIG-IP flaws in stealthy attacks
• Nov. 1, 2023 - CISA and F5 Warn of BIG-IP Security Vulnerabilities Under Active Exploit
• Nov. 1, 2023 - Alert: F5 Warns of Active Attacks Exploiting BIG-IP Vulnerability
• Oct. 31, 2023 - Attackers Exploiting Critical F5 BIG-IP Vulnerability
• Oct. 30, 2023 - F5 fixes critical BIG-IP vulnerability (CVE-2023-46747)
• Oct. 30, 2023 - CVE-2023-46748: F5 BIG-IP SQL injection vulnerability
• Oct. 29, 2023 - newsletter Round 443 by Pierluigi Paganini

CVE-2023-22515

CRITICAL CVSS 9.80 EPSS Score 95.53 EPSS Percentile 99.18

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 4, 2023

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Vendor Impacted: Atlassian

Products Impacted: Confluence Server, Confluence Data Center, Confluence Data Center And Server

Quotes

• Significant data loss if exploited by an unauthenticated attacker
• Improper authorization vulnerability in Confluence Data Center and Server
• There are still no reports of an active exploit, though customers must take immediate action to protect their instances
• We have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker
• As part of Atlassian's ongoing monitoring of this CVE, we observed publicly posted critical information about the vulnerability which increases risk of exploitation
• As part of our continuous security assessment processes, we have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker

Headlines

• Nov. 3, 2023 - Atlassian Finds Public Exploit for Critical Bug
• Nov. 2, 2023 - Atlassian warns of exploit for Confluence data wiping bug, get patching
• Nov. 1, 2023 - Atlassian Customers Should Patch Latest Critical Vuln Immediately
• Oct. 31, 2023 - Atlassian warns of critical Confluence flaw leading to data loss
• Oct. 31, 2023 - Atlassian Warns of New Critical Confluence Vulnerability Threatening Data Loss
• Oct. 31, 2023 - Atlassian patches critical Confluence bug, urges for immediate action (CVE-2023-22518)
• Oct. 31, 2023 - Atlassian warns users: patch critical Confluence flaw ASAP

CVE-2023-22518

CRITICAL CVSS 9.10 EPSS Score 0.05 EPSS Percentile 20.10

Actively Exploited Public Exploits Available

Published: Oct. 31, 2023

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. There is no impact to confidentiality as an attacker cannot exfiltrate any instance data. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Quotes

• Vulnerable to significant data loss
• Significant data loss if exploited by an unauthenticated attacker
• Improper authorization vulnerability in Confluence Data Center and Server
• There are still no reports of an active exploit, though customers must take immediate action to protect their instances
• We have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker
• As part of Atlassian's ongoing monitoring of this CVE, we observed publicly posted critical information about the vulnerability which increases risk of exploitation
• As part of our continuous security assessment processes, we have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker

Headlines

• Nov. 3, 2023 - Atlassian Finds Public Exploit for Critical Bug
• Nov. 2, 2023 - Atlassian warns of exploit for Confluence data wiping bug, get patching
• Nov. 2, 2023 - Atlassian Releases Security Advisory for Confluence Data Center and Server | CISA
• Nov. 1, 2023 - Atlassian Customers Should Patch Latest Critical Vuln Immediately
• Oct. 31, 2023 - Critical vulnerability found in Atlassian Confluence software
• Oct. 31, 2023 - Critical Atlassian Confluence flaw can lead to significant data loss
• Oct. 31, 2023 - Atlassian warns of critical Confluence flaw leading to data loss
• Oct. 31, 2023 - Atlassian CISO Urges Quick Action to Protect Confluence Instances From Critical Vulnerability
• Oct. 31, 2023 - Atlassian Warns of New Critical Confluence Vulnerability Threatening Data Loss
• Oct. 31, 2023 - Atlassian patches critical Confluence bug, urges for immediate action (CVE-2023-22518)
• Oct. 31, 2023 - CVE-2023-22518: A Critical Vulnerability in Atlassian Confluence
• Oct. 31, 2023 - Atlassian warns users: patch critical Confluence flaw ASAP

CVE-2023-46748

HIGH CVSS 8.80 EPSS Score 0.61 EPSS Percentile 76.26

CISA Known Exploited

Published: Oct. 26, 2023

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Vendor Impacted: F5

Product Impacted: Big-Ip Configuration Utility

Quotes

• Observed threat actors using this vulnerability to exploit CVE-2023-46748
• F5 has observed threat actors using this vulnerability to exploit CVE-2023-46748
• This information is based on the evidence F5 has seen on compromised devices, which appear to be reliable indicators
• Interestingly enough, the in-the-wild exploitation is using the SQL injection vulnerability (CVE-2023-46748) in conjunction with the AJP request smuggling attack to achieve access
• This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. There is no data plane exposure; this is a control plane issue only
• An authenticated SQL injection vulnerability exists in the BIG-IP configuration utility which may allow an authenticated attacker with network access to the configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands
• It is important to note that not all exploited systems may show the same indicators, and, indeed, a skilled attacker may be able to remove traces of their work. It is not possible to prove a device has not been compromised; when there is any uncertainty, you should consider the device compromised

Headlines

• Nov. 2, 2023 - F5 BIG-IP vulnerabilities leveraged by attackers: What to do?
• Nov. 1, 2023 - CISA adds two F5 BIG-IP flaws to its Known Exploited Vulnerabilities catalog
• Nov. 1, 2023 - Threat actors actively exploit F5 BIG-IP flaws CVE-2023-46747/8
• Nov. 1, 2023 - F5's critical BIG-IP vulnerability under active exploitation
• Nov. 1, 2023 - Hackers exploit recent F5 BIG-IP flaws in stealthy attacks
• Nov. 1, 2023 - CISA and F5 Warn of BIG-IP Security Vulnerabilities Under Active Exploit
• Nov. 1, 2023 - Alert: F5 Warns of Active Attacks Exploiting BIG-IP Vulnerability
• Oct. 31, 2023 - Attackers Exploiting Critical F5 BIG-IP Vulnerability
• Oct. 30, 2023 - CVE-2023-46748: F5 BIG-IP SQL injection vulnerability

CVE-2023-5044

HIGH CVSS 8.80 EPSS Score 0.06 EPSS Percentile 24.40

Public Exploits Available

Published: Oct. 25, 2023

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

Vendor Impacted: Kubernetes

Product Impacted: Ingress-Nginx

Quotes

• These vulnerabilities enable an attacker who can control the configuration of the Ingress object to steal secret credentials from the cluster
• Received CVSS ratings of 7.6 out of 10, and affect versions 1.9.0 and earlier. To mitigate both issues, the Kubernetes Security Response Committee's CJ Cullen recommends that ingress admins

Headlines

• Nov. 1, 2023 - The Trio of Unpatched Flaws in NGINX Ingress Controller for Kubernetes
• Oct. 30, 2023 - Unpatched bugs can be abused to steal Kubernetes secrets
• Oct. 30, 2023 - Urgent: New Security Flaws Discovered in NGINX Ingress Controller for Kubernetes

CVE-2023-5043

HIGH CVSS 8.80 EPSS Score 0.26 EPSS Percentile 63.89

Risk Context N/A

Published: Oct. 25, 2023

Ingress nginx annotation injection causes arbitrary command execution.

Vendor Impacted: Kubernetes

Product Impacted: Ingress-Nginx

Quotes

• These vulnerabilities enable an attacker who can control the configuration of the Ingress object to steal secret credentials from the cluster
• Received CVSS ratings of 7.6 out of 10, and affect versions 1.9.0 and earlier. To mitigate both issues, the Kubernetes Security Response Committee's CJ Cullen recommends that ingress admins

Headlines

• Nov. 1, 2023 - The Trio of Unpatched Flaws in NGINX Ingress Controller for Kubernetes
• Oct. 30, 2023 - Unpatched bugs can be abused to steal Kubernetes secrets
• Oct. 30, 2023 - Urgent: New Security Flaws Discovered in NGINX Ingress Controller for Kubernetes

CVE-2023-4966

HIGH CVSS 7.50 EPSS Score 92.27 EPSS Percentile 98.67

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 10, 2023

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server. 

Vendor Impacted: Citrix

Products Impacted: Netscaler Application Delivery Contr, Netscaler Gateway, Netscaler Adc And Netscaler Gateway

Quotes

• It was clear multiple groups had already obtained technical details
• Even if you applied the patch and rebooted, you still have a problem as session tokens persist
• An attacker could make a specially crafted network call to the target Skype for Business server, which could cause the parsing of an http request made to an arbitrary address
• Due to the lack of available log records or other artifacts of exploitation activity, as a precaution, organizations should consider rotating credentials for identities that were provisioned for accessing resources via a vulnerable NetScaler ADC or Gateway appliance

Headlines

• Nov. 3, 2023 - Mandiant Exposes Ongoing Exploits Against Citrix Users
• Nov. 1, 2023 - Hackers use Citrix Bleed flaw in attacks on govt networks worldwide
• Nov. 1, 2023 - Mass Exploitation of 'Citrix Bleed' Vulnerability Underway
• Oct. 31, 2023 - 'Mass exploitation' of Citrix Bleed as ransomware moves in
• Oct. 31, 2023 - Apple, Google, and Microsoft Just Patched Some Spooky Security Flaws
• Oct. 30, 2023 - Citrix Bleed: Mass exploitation in progress (CVE-2023-4966)
• Oct. 29, 2023 - newsletter Round 443 by Pierluigi Paganini

CVE-2022-4886

MEDIUM CVSS 6.50 EPSS Score 0.07 EPSS Percentile 31.11

Risk Context N/A

Published: Oct. 25, 2023

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

Vendor Impacted: Kubernetes

Product Impacted: Ingress-Nginx

Quotes

• These vulnerabilities enable an attacker who can control the configuration of the Ingress object to steal secret credentials from the cluster
• Received CVSS ratings of 7.6 out of 10, and affect versions 1.9.0 and earlier. To mitigate both issues, the Kubernetes Security Response Committee's CJ Cullen recommends that ingress admins

Headlines

• Nov. 1, 2023 - The Trio of Unpatched Flaws in NGINX Ingress Controller for Kubernetes
• Oct. 30, 2023 - Unpatched bugs can be abused to steal Kubernetes secrets
• Oct. 30, 2023 - Urgent: New Security Flaws Discovered in NGINX Ingress Controller for Kubernetes