Week of October 16, 2023: Cisco IOS XE Zero-Day, Atlassian Confluence Under Attack

Security leaders spent the week of October 16, 2023 responding to CISA advisories on active exploitation of a Cisco IOS XE Web UI zero-day and an Atlassian Confluence flaw, plus reports that a Citrix NetScaler bug had been under attack since August and that state-sponsored groups were abusing a WinRAR vulnerability. CISA also expanded its Known Exploited Vulnerabilities Catalog, issued updated Secure by Design guidance with international partners, and pointed to Oracle's October patch release covering 387 vulnerabilities.

Cisco IOS XE Web UI zero-day exploited to install implants

Cisco Talos researchers disclosed that a previously unknown privilege-escalation vulnerability, CVE-2023-20198, in the web UI feature of Cisco IOS XE Software was being exploited by a threat actor to create privileged accounts and install an implant on affected networking devices. The flaw allowed a remote, unauthenticated attacker to gain the highest level of administrative access. Attacks against internet-facing devices began in September 2023, with an implant-deployment wave following in October. Cisco advised disabling the HTTP Server feature on internet-facing systems while a patch was developed. (Help Net Security)

CISA issues guidance on second Cisco IOS XE Web UI vulnerability

On October 20, 2023, CISA released guidance addressing two Cisco IOS XE Software Web UI vulnerabilities, CVE-2023-20198 and CVE-2023-20273, citing active, widespread exploitation. The flaws let an unauthenticated remote actor create a privileged account offering complete control over an affected device. CISA pointed administrators to Cisco's security advisory and Talos's blog on active exploitation, and urged organizations running the Web UI to disable the HTTP Server feature on internet-facing systems and hunt for malicious activity on their networks. (CISA)

CISA adds Citrix NetScaler and Cisco IOS XE bugs to KEV catalog

On October 19, 2023, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2023-4966, a buffer overflow affecting Citrix NetScaler ADC and NetScaler Gateway, and CVE-2021-1435, a command injection flaw in Cisco IOS XE Web UI. Federal Civilian Executive Branch agencies were required under Binding Operational Directive 22-01 to remediate the vulnerabilities by CISA's specified due dates, and the agency urged all organizations to prioritize the same fixes as part of routine vulnerability management. (CISA)

Joint advisory warns of Atlassian Confluence zero-day exploitation

CISA, the FBI, and MS-ISAC published a joint advisory on October 16, 2023, covering active exploitation of CVE-2023-22515, a critical broken-access-control flaw in Atlassian Confluence Data Center and Server. The advisory said threat actors had exploited the bug as a zero-day to create unauthorized administrator accounts and gain initial access, with exploitation continuing after Atlassian's October 4 patch. Agencies observed post-exploitation data exfiltration using cURL and Rclone, and strongly encouraged upgrading to a fixed version or taking servers offline. (CISA)

Citrix NetScaler bug found exploited since August

Mandiant researchers reported that CVE-2023-4966, an information-disclosure vulnerability in Citrix NetScaler ADC and Gateway patched on October 10, 2023, had been exploited by attackers since late August 2023. Threat actors used the flaw to hijack existing authenticated sessions, bypassing multifactor authentication, against professional-services, technology, and government targets. Mandiant noted hijacked sessions could persist after the patch was applied and recommended admins terminate active sessions, rotate credentials, and rebuild appliances found to contain web shells or backdoors. (Help Net Security)

CISA and international partners update Secure by Design guidance

On October 16, 2023, CISA, the NSA, the FBI, and international partners including the UK's NCSC released an update to their April 2023 Secure by Design guidance, adding recommendations for manufacturers of software and artificial-intelligence systems. The update, co-sealed by additional cybersecurity agencies, expanded on three principles: taking ownership of customer security outcomes, embracing radical transparency and accountability, and leading from the top. CISA Director Jen Easterly discussed the guidance during Singapore International Cyber Week and said the revisions focused on how companies can demonstrate commitment to the principles. (CISA)

State-sponsored hackers abuse WinRAR flaw in spear-phishing campaigns

Google's Threat Analysis Group reported on October 18, 2023, that multiple government-backed hacking groups, including Sandworm and Fancy Bear, were exploiting CVE-2023-38831, a file-extension spoofing bug in the WinRAR archiver patched in August 2023. Sandworm used a fake Ukrainian drone-warfare training school invitation to deliver the Rhadamanthys infostealer, while Fancy Bear targeted Ukrainian energy-sector workers with a fake event invite. A separate campaign linked to China-backed actors targeted Papua New Guinea with an archive leading to a backdoor download. (Help Net Security)

Oracle's October patch update covers 387 vulnerabilities

Oracle released its Critical Patch Update Advisory for October 2023, addressing 387 vulnerabilities across multiple products, and CISA highlighted the update on October 19, 2023. CISA warned that a cyber threat actor could exploit some of the flaws to take control of an affected system, and urged users and administrators to review Oracle's advisory and apply the necessary patches promptly. (CISA)