Week of May 30, 2022: Follina and Confluence Zero-Days Dominate CISA Advisories

Security leaders spent the week of May 30, 2022 tracking two actively exploited zero-days: the Windows MSDT "Follina" flaw and an unauthenticated remote-code-execution bug in Atlassian Confluence that CISA added to its Known Exploited Vulnerabilities catalog. CISA also published a joint advisory on the Karakurt data-extortion group and ICS advisories covering Illumina sequencing software and Dominion voting systems, alongside an updated VMware exploitation-chain alert and routine Mozilla browser patches.

Microsoft Issues Workaround for "Follina" Zero-Day Under Active Attack

Microsoft published workaround guidance for CVE-2022-30190, a remote code execution flaw dubbed "Follina" in the Microsoft Support Diagnostic Tool on Windows. CISA relayed that Microsoft had reported active exploitation in the wild and urged administrators to review the guidance and apply the workaround, since a remote, unauthenticated attacker could use the flaw to take control of an affected system. No patch existed yet, leaving mitigation as the only defense that week. (CISA)

Agencies Warn on Karakurt Data Extortion Group

CISA, the FBI, the Treasury Department, and FinCEN issued a joint advisory on the Karakurt data extortion group, which steals data and threatens public release or auction unless victims pay. The agencies encouraged organizations to review Karakurt's tactics, techniques, and procedures and apply recommended mitigations, including patching known exploited vulnerabilities, phishing-awareness training, and enforcing multifactor authentication. The advisory gave security teams documented reference material on a group that pressures victims without deploying encryption. (CISA)

Mozilla Patches Firefox, Firefox ESR, and Thunderbird

Mozilla released security updates for Firefox 101, Firefox ESR 91.10, and Thunderbird 91.10 to close vulnerabilities that an attacker could exploit to take control of an affected system. CISA advised users and administrators to review the corresponding Mozilla security advisories and apply the updates without delay, adding another client-side patch cycle to the week's advisory load for enterprise teams tracking browser and email-client risk alongside the more severe zero-days under disclosure. (CISA)

CISA Updates Advisory on VMware Vulnerability Chaining

CISA updated Cybersecurity Advisory AA22-138B, originally issued May 18, 2022, which covers threat actors chaining unpatched VMware vulnerabilities to gain full system control. The update added new indicators of compromise, detection signatures, and tactics, techniques, and procedures reported by trusted third parties. CISA encouraged organizations to review the revised advisory and either update affected VMware products to the latest version or remove impacted versions from their networks entirely. (CISA)

CISA Adds Confluence Zero-Day to Known Exploited Vulnerabilities Catalog

CISA added CVE-2022-26134, an unauthenticated remote code execution flaw in Atlassian Confluence Server and Data Center, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. No patch existed at the time of the addition, and federal agencies were directed under Binding Operational Directive 22-01 to block internet traffic to and from affected Confluence products until a fix could be applied. Atlassian said it was working on an update. (CISA)

CISA Advisory Flags Vulnerabilities in Illumina Genomic Sequencing Software

CISA released an Industrial Control Systems Advisory detailing multiple vulnerabilities in Illumina Local Run Manager, software used with genomic sequencing instruments. Successful exploitation could let an unauthenticated actor remotely take control of the affected product at the operating system level, potentially altering settings, configurations, software, or data and interacting with the connected network. CISA pointed users to the ICS advisory and a companion FDA advisory for mitigation details relevant to healthcare and life-sciences security teams. (CISA)

CISA Details Vulnerabilities in Dominion Voting Systems ImageCast X

CISA published an Industrial Control Systems Advisory on vulnerabilities affecting Dominion Voting Systems Democracy Suite ImageCast X, an in-person ballot-marking device. Exploitation would require physical access to individual devices, access to the Election Management System, or the ability to alter files before they are uploaded to ImageCast X units. CISA said jurisdictions could mitigate the risk through standard technical, physical, and operational access controls, and stated it had no evidence of exploitation in any election. (CISA)