Week of April 29, 2024: Dropbox Sign Breach, CISA's Directory Traversal Alert

Security leaders tracked Dropbox's disclosure of a breach in its Dropbox Sign service, CISA and FBI's new alert pushing software makers to eliminate directory traversal flaws, and two fresh additions to CISA's Known Exploited Vulnerabilities catalog covering GitLab and Microsoft SmartScreen. The week also brought a joint fact sheet on pro-Russia hacktivist activity against operational technology, new ICS advisories, a CERT/CC warning on the R programming language, and a first-time CISO hire at Google spinoff SandboxAQ.

Dropbox Discloses Material Breach of Dropbox Sign Service

On April 29, 2024, Dropbox filed an SEC Form 8-K disclosing that on April 24, 2024 it became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. The company said the intruder accessed data tied to all Dropbox Sign users, including emails, usernames and account settings, and for a subset of users also phone numbers, hashed passwords, and authentication details such as API keys, OAuth tokens and MFA information. Dropbox stated it found no evidence the intruder reached the contents of users' agreements, templates or payment information. (SEC EDGAR)

CISA and FBI Urge Elimination of Directory Traversal Flaws

On May 2, 2024, CISA and the FBI issued a joint Secure by Design Alert urging software manufacturers to eliminate directory traversal vulnerabilities, citing exploitation of CVE-2024-1708 and CVE-2024-20345 that affected healthcare and public health sector systems. The agencies noted that directory traversal defects had already impacted hospital and school operations and said approaches to avoid the flaw class were well known yet still widely unaddressed. CISA and FBI called on software executives to require formal testing for this vulnerability category across their product lines. (CISA)

CISA Adds GitLab Access-Control Flaw to KEV Catalog

On May 1, 2024, CISA added CVE-2023-7028, an improper access control vulnerability in GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The listing triggers Binding Operational Directive 22-01, which requires Federal Civilian Executive Branch agencies to remediate the flaw by CISA's specified due date. CISA again urged all organizations, not only federal agencies, to prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA Lists Microsoft SmartScreen Bypass as Actively Exploited

On April 30, 2024, CISA added CVE-2024-29988, a Microsoft SmartScreen Prompt security feature bypass vulnerability, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. Under Binding Operational Directive 22-01, the listing requires Federal Civilian Executive Branch agencies to remediate the flaw by the catalog's due date. CISA reiterated that such vulnerabilities remain frequent attack vectors for malicious cyber actors and encouraged all organizations to factor the bypass into their own vulnerability management prioritization. (CISA)

CISA Warns OT Operators Over Pro-Russia Hacktivist Activity

On May 1, 2024, CISA joined U.S. and international partners in publishing a fact sheet, Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity, warning that pro-Russia hacktivists were targeting industrial control systems and small-scale operational technology across North American and European water, dams, energy, and food and agriculture sectors. The agencies said the activity mostly relied on unsophisticated techniques producing nuisance effects but noted investigations found some actors capable of techniques posing physical threats to insecure or misconfigured OT environments. CISA urged operators to apply the fact sheet's recommended mitigations. (CISA)

SandboxAQ Hires First CISO as Security Leadership Shifts Continue

SecurityWeek's Industry Moves roundup for the week of April 29, 2024 reported that Google spinoff SandboxAQ hired Chris Bates, previously Chief Trust and Security Officer at SentinelOne, as its first CISO. The same roundup noted HackerOne CEO Marten Mickos announced he would retire from the company after nine years, remaining in the role until a successor is identified. Other moves included Lital Asher-Dotan joining Beyond Identity as Chief Marketing Officer and Jennifer Leggio becoming Tidal Cyber's Chief Operating Officer. (SecurityWeek)

CERT/CC Flags Deserialization Flaw in R Programming Language

On May 1, 2024, CISA highlighted a CERT Coordination Center advisory on CVE-2024-27322, a vulnerability in R programming language implementations that could let a cyber threat actor take control of an affected system. The bulletin was linked to a deserialization defect described in an associated vendor analysis, and CISA directed users and administrators to review CERT/CC's VU#23819 advisory along with guidance published through the Comprehensive R Archive Network and apply the necessary updates. (CISA)

CISA Publishes ICS Advisories for CyberPower, Delta Electronics, Chirp

On May 2, 2024, CISA released three Industrial Control Systems advisories covering CyberPower PowerPanel, Delta Electronics DIAEnergie, and an updated advisory for Chirp Systems Chirp Access, providing technical detail on current ICS security issues, vulnerabilities and exploits. CISA encouraged asset owners and administrators across critical infrastructure sectors to review the advisories and apply the listed mitigations to reduce exposure in operational technology environments. (CISA)