Week of October 30, 2023: Citrix Bleed Mass Exploitation and Biden's AI Executive Order

Security leaders watched active exploitation of the Citrix NetScaler flaw known as Citrix Bleed, two new CISA Known Exploited Vulnerabilities Catalog additions covering F5 BIG-IP and Apache ActiveMQ, and a critical Atlassian Confluence authorization bug all come to a head between October 30 and November 5, 2023. The same week, the White House issued an Executive Order on AI safety and security, Cisco pushed updated guidance on exploited IOS XE Web UI flaws, and a new wiper called BiBi-Linux surfaced against Israeli organizations.

CISA Adds Two F5 BIG-IP Flaws to Known Exploited Vulnerabilities Catalog

On October 31, 2023, CISA added two F5 BIG-IP vulnerabilities, CVE-2023-46747 and CVE-2023-46748, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The authentication-bypass flaw, tracked as CVE-2023-46747, could let an attacker bypass login protections on BIG-IP's Configuration Utility, while CVE-2023-46748 is a SQL injection weakness in the same interface. Federal civilian agencies were required to remediate both issues under Binding Operational Directive 22-01, and CISA urged all organizations managing BIG-IP devices to apply vendor fixes promptly given the scale of exposed management interfaces. (CISA)

CISA Adds Apache ActiveMQ Flaw to KEV Catalog

CISA added CVE-2023-46604, a deserialization flaw in Apache ActiveMQ, to its Known Exploited Vulnerabilities Catalog on November 2, 2023, citing evidence of active exploitation. The vulnerability allows an attacker to run arbitrary code on vulnerable ActiveMQ brokers, a messaging platform used across enterprise and government networks. Under Binding Operational Directive 22-01, federal civilian agencies faced a remediation deadline, and CISA again urged all organizations to prioritize patching catalog vulnerabilities as part of routine vulnerability management rather than waiting for a mandate. (CISA)

Citrix Bleed Vulnerability Faces Mass Exploitation

Security researchers reported that CVE-2023-4966, nicknamed Citrix Bleed, was undergoing mass exploitation against internet-facing Citrix NetScaler ADC and Gateway appliances. The flaw let attackers lift valid session tokens from device memory and hijack authenticated sessions, bypassing multi-factor authentication entirely. Mandiant had already linked exploitation to a zero-day campaign dating to late August 2023 against legal, professional services, technology, and government targets, and one ransomware group reportedly distributed a Python script automating the attack chain to its operators. Patching alone did not remove attacker access, so responders also pushed session termination. (Help Net Security)

Atlassian Patches Critical Confluence Authorization Flaw

Atlassian published a security advisory for CVE-2023-22518, an improper authorization vulnerability affecting on-premises Confluence Data Center and Server installations, warning that exploitation by an unauthenticated attacker could cause significant data loss. The flaw affected all versions before 7.19.16, 8.3.4, 8.4.4, 8.5.3 and 8.6.1, while Atlassian Cloud sites were not affected. CISA added the advisory to its own alert catalog on November 2, 2023, and Atlassian urged administrators of publicly accessible instances to upgrade immediately or take vulnerable systems offline until patched. (CISA)

CISA Updates Guidance on Exploited Cisco IOS XE Web UI Bugs

CISA updated its guidance on two Cisco IOS XE Web UI vulnerabilities, CVE-2023-20198 and CVE-2023-20273, noting on November 1, 2023, that Cisco had shipped a fix for the 17.3 software release train in version 17.3.8a. The flaws affected the Web User Interface feature on IOS XE devices and had already drawn active exploitation attention from Cisco Talos. CISA pointed administrators to both Cisco's own security advisory and the Talos threat advisory and urged organizations still running affected versions to apply updates immediately. (CISA)

New BiBi-Linux Wiper Targets Israeli Companies

Incident responders at Security Joes disclosed a previously undocumented wiper, BiBi-Linux, deployed against an Israeli company during a breach investigation. The x64 ELF malware let operators target specific folders, overwrote file contents with random data, then renamed files using a BiBi extension, and could destroy an entire operating system if run with root permissions. The sample carried no ransom note, used no reversible encryption, and made no command-and-control connection, pointing to a purely destructive motive rather than a financially driven one. (Help Net Security)

White House Issues Executive Order on AI Safety and Security

On October 30, 2023, the White House issued an Executive Order directing new federal requirements for artificial intelligence safety and security. The order required developers of the most powerful AI systems to share safety test results with the government, directed the National Institute of Standards and Technology to set red-team testing standards, and tasked the Department of Homeland Security with applying those standards to critical infrastructure sectors and establishing an AI Safety and Security Board. It also ordered an advanced cybersecurity program to use AI to find and fix vulnerabilities in critical software. (Help Net Security)