Week of December 4, 2023: Star Blizzard Advisory and ColdFusion Government Breach

Security leaders focused on CISA's joint advisory exposing Russian FSB group Star Blizzard's spearphishing tradecraft, confirmation that attackers exploited an Adobe ColdFusion flaw to breach two federal servers, and new Atlassian remote-code-execution advisories. The same week, CISA added Qualcomm and Qlik Sense vulnerabilities to its Known Exploited Vulnerabilities catalog, published secure-by-design guidance on memory-safe coding, named a new Cybersecurity Advisory Committee chair, and the President signed an executive order strengthening federal facility security.

CISA, UK NCSC Expose Russian FSB Spearphishing Group Star Blizzard

CISA joined the UK National Cyber Security Centre, Australia's ACSC, Canada's CCCS, New Zealand's NCSC-NZ, the NSA, FBI, and Cyber Command's Cyber National Mission Force in releasing a joint advisory on Star Blizzard, a Russia-based threat group assessed to be subordinate to the FSB. The advisory described the group's spearphishing tradecraft, including impersonating known contacts, building fake social media profiles, and using webmail addresses from Outlook, Gmail, and other providers to target academia, defense, government, and NGO personnel in the UK, US, and other NATO countries. (CISA)

CISA Advisory Details ColdFusion Exploitation at Federal Agency

CISA published a cybersecurity advisory describing confirmed exploitation of CVE-2023-26360 in Adobe ColdFusion at a Federal Civilian Executive Branch agency. The improper access control flaw affected ColdFusion 2018 Update 15 and earlier and 2021 Update 5 and earlier, and could allow arbitrary code execution. Investigators traced the compromise of at least two public-facing servers to activity between June and July 2023, with threat actors using the flaw to drop a web shell and run reconnaissance commands, though no evidence showed data exfiltration or lateral movement. (CISA)

Atlassian Pushes Fixes for Confluence, Companion App RCE Flaws

Atlassian released security updates addressing several vulnerabilities across its product line, including remote code execution flaws in Confluence Data Center and Server, the Atlassian Companion App for MacOS, and Assets Discovery, plus a SnakeYAML library RCE affecting multiple products. CISA flagged the advisories the same week, warning that a threat actor could exploit one of the flaws to take control of an affected system, and urged administrators to apply the vendor's updates or mitigations without delay. (CISA)

CISA Adds Four Actively Exploited Qualcomm Chipset Flaws to KEV Catalog

CISA added four Qualcomm chipset vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2023-33106, an out-of-range pointer offset flaw; CVE-2023-33063 and CVE-2022-22071, both use-after-free issues; and CVE-2023-33107, an integer overflow bug. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate catalog entries by their due dates, and CISA urged all organizations to prioritize patching these chipset flaws given their frequent use as attack vectors. (CISA)

Qlik Sense Flaws Added to CISA's Known Exploited Vulnerabilities List

CISA added two Qlik Sense vulnerabilities, CVE-2023-41265 and CVE-2023-41266, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The HTTP tunneling and path traversal flaws joined a growing list of software defects that CISA said posed significant risk to federal networks under Binding Operational Directive 22-01, which sets remediation deadlines for civilian agencies. CISA again encouraged all organizations, not just federal entities, to treat catalog additions as a prioritization signal for vulnerability management programs. (CISA)

CISA Advisory Committee Names Mastercard's Ron Green as New Chair

CISA held its fourth and final 2023 Cybersecurity Advisory Committee meeting, where subcommittees voted on recommendations covering memory-safe system languages and operational collaboration, bringing the year's total to 135 recommendations for Director Jen Easterly. During the meeting, Easterly acknowledged the committee's new chair, Ron Green of Mastercard, and new vice chair, Dave DeWalt of NightDragon, who succeeded outgoing founding chair Tom Fanning of Southern Company. (CISA)

President Signs Executive Order Strengthening Federal Facility Security

The President signed Executive Order 14111, reinforcing the Interagency Security Committee's mandate to protect Executive Branch federal facilities against persistent and emerging threats. The order updated the framework established under EO 12977 following the 1995 Oklahoma City bombing. CISA, which chairs the ISC, said it was committed to implementing the order's requirements, with the agency's infrastructure security leadership highlighting the administration's priority on keeping federal facility security at the forefront of national policy. (CISA)

CISA and Allies Publish Memory-Safe Coding Roadmap Guidance

As part of its Secure by Design campaign, CISA joined the NSA, FBI, and cybersecurity authorities from Australia, Canada, New Zealand, and the UK to publish guidance titled The Case for Memory Safe Roadmaps. The document urged software manufacturers to transition to memory-safe programming languages and publish roadmaps showing customers how they planned to eliminate memory safety defects, which the agencies described as the most prevalent category of disclosed software vulnerability. (CISA)