Week of July 17, 2023: Citrix NetScaler Zero-Day, VirusTotal Data Leak

Security leaders spent the week of July 17, 2023 tracking a Citrix NetScaler ADC zero-day used to implant webshells on a critical infrastructure appliance, fresh in-the-wild exploitation of Adobe ColdFusion, and a VirusTotal data leak that exposed the names and email addresses of 5,600 registered users, including staff at multiple intelligence and government agencies. CISA also added both flaws to its Known Exploited Vulnerabilities Catalog, published new 5G network slicing guidance with NSA, welcomed an expansion of free Microsoft logging, and Atlassian shipped a security bulletin for Confluence and Bamboo.

CISA details Citrix NetScaler zero-day used to implant webshell on critical infrastructure appliance

CISA published Alert AA23-201A describing how threat actors exploited CVE-2023-3519, an unauthenticated remote code execution flaw in NetScaler ADC and NetScaler Gateway, as a zero-day in June 2023 to plant a webshell on a critical infrastructure organization's appliance. The actors harvested Active Directory data and attempted lateral movement to a domain controller, though segmentation controls blocked further access. Citrix released a patch on July 18, 2023, and CISA added the flaw to its Known Exploited Vulnerabilities Catalog on July 19, 2023, urging immediate patching across critical infrastructure. (CISA)

CISA adds two Adobe ColdFusion flaws to Known Exploited Vulnerabilities Catalog

On July 20, 2023, CISA added CVE-2023-29298 and CVE-2023-38205, both Adobe ColdFusion improper access control vulnerabilities, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The additions followed reports that attackers were chaining the flaws to deploy webshells on vulnerable ColdFusion servers. Federal Civilian Executive Branch agencies were required under Binding Operational Directive 22-01 to remediate the vulnerabilities by CISA's specified due date, and CISA urged all organizations to prioritize patching given ColdFusion's frequent use as an attack vector. (CISA)

Adobe ColdFusion vulnerabilities exploited in the wild to deliver webshells

Rapid7 researchers reported that attackers began exploiting Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-38203 in customer environments starting July 13, 2023, chaining an incomplete patch bypass with a rediscovered zero-day to install webshells for persistent remote access. Adobe issued an out-of-band fix on July 14, and after Rapid7 found the CVE-2023-29298 patch was still bypassable, Adobe shipped a further fix, assigned CVE-2023-38205, on July 19, which Rapid7 confirmed resolved the issue. Administrators were advised to apply the newest ColdFusion updates without delay. (Help Net Security)

VirusTotal leak exposes names and emails of 5,600 registered users

Google confirmed to German outlet Der Spiegel that VirusTotal exposed the names and corporate email addresses of 5,600 registered users after an employee accidentally uploaded a customer list to the platform at the end of June 2023; the file was removed within an hour but had already been downloaded by at least one user. Affected accounts reportedly included staff at the US Cyber Command, the FBI, the NSA, and multiple German government bodies. VirusTotal said on July 21, 2023 that the exposure resulted from human error, not a cyberattack, and that no passwords were disclosed. (Help Net Security)

NSA and CISA release joint guidance on 5G network slicing security

On July 17, 2023, the National Security Agency and CISA released joint guidance, 5G Network Slicing: Security Considerations for Design, Deployment, and Maintenance, produced through the Enduring Security Framework public-private working group. The document outlines recommendations addressing identified threats to 5G standalone network slicing and provides practices for hardening slice design, deployment, and ongoing operation. It builds on 2022 ESF guidance covering potential threats to network slicing, and CISA encouraged 5G providers, integrators, and network operators to review and implement the recommended actions. (CISA)

Atlassian ships July security bulletin for Confluence and Bamboo

On July 21, 2023, CISA alerted administrators that Atlassian had released its July 2023 Security Bulletin addressing vulnerabilities in Confluence Data Center and Server, tracked as CVE-2023-22505 and CVE-2023-22508, along with a flaw in Bamboo Data Center, CVE-2023-22506. CISA noted that an attacker could exploit these vulnerabilities to take control of an affected system, and it urged users and administrators to review Atlassian's bulletin and apply the necessary updates promptly. (CISA)