Authors: Rui Ataide, Hermes Bojaxhi GuidePoint’s DFIR team is frequently called upon to respond to Ransomware incidents. While many such […]
The post Update from the Ransomware Trenches appeared first on Security Boulevard.
Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
BackgroundOn August 13, Ivanti released a security advisory to address a critical severity authentication bypass vulnerability in its Virtual Traffic Manager (vTM) product, a software-based application delivery controller (ADC).
CVEDescriptionCVSSv3CVE-2024-7593Ivanti Virtual Traffic Manager (vTM) Authentication Bypass Vulnerability9.8AnalysisCVE-2024-7593 is a critical severity authentication bypass vulnerability. Exploitation of this flaw could allow an unauthenticated, remote attacker to create an administrator user. According to the advisory, access to the management interface of vTM is required in order to exploit this vulnerability.
While Ivanti notes that no known exploitation has been observed for CVE-2024-7593, their advisory makes special note of publicly available exploit code.
Historical exploitation of Ivanti vulnerabilities
Ivanti has had a history of threat actors targeting their products, with one of the most prolific being attacks against their Ivanti Connect Secure (ICS) product, previously known as Pulse Connect Secure and Ivanti Policy Secure. In January, two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) were exploited against ICS in a chained attack. Coincidentally enough, one of these vulnerabilities (CVE-2023-46805) was an authentication bypass flaw. Within a few weeks of this release, Ivanti found several additional vulnerabilities impacting ICS, including another zero-day vulnerability (CVE-2024-21893) that had also been exploited in the wild. CVE-2023-46805 and CVE-2024-21887 were reportedly exploited by a threat actor tracked as UTA0178 and is believed to be a “Chinese nation-state level threat actor.” With threat actors, including nation-state aligned actors actively targeting Ivanti devices, it’s imperative that patching is prioritized.
Hundreds of Internet Facing Instances May Be Affected
Adding to the concern over the potential to exploit this vulnerability, a FOFA search lists more than 400 results tied to over 200 unique IPs that might be affected if patches or mitigations are not applied.
Image source: https://en.fofa.info/
Proof of conceptAccording to Ivanti’s security advisory, a public proof-of-concept (PoC) is available for this vulnerability. While Tenable Research has not tested and confirmed a working exploit, we are aware of exploit code found on a popular site for public exploit scripts. As attackers are keen to abuse targets with readily available exploit code, immediate patching or application of mitigation steps is recommended.
SolutionIvanti has released some patches to address this vulnerability, with additional patch versions expected to be released the week of August 19. A summary of the patched versions can be found in the table below:
Affected VersionFixed VersionAvailability22.222.2R1Available now22.322.3R3Upcoming- Week of August 1922.3R222.3R3Upcoming- Week of August 1922.5R122.5R2Upcoming- Week of August 1922.6R122.6R2Upcoming- Week of August 1922.7R122.7R2Available nowFor organizations that are not able to immediately patch this vulnerability, Ivanti does offer mitigation guidance. As access to the management interface is a requirement for exploitation, limiting access to this interface is recommended. Ivanti recommends to ensure that the management interface is bound to an internal network or private IP address. We recommend referring to Ivanti’s security advisory for the most up to date information on patch availability and mitigation guidance.
Identifying affected systemsA list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2024-7593 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.
Get more informationJoin Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
NetSPI discovered that Microsoft Outlook is vulnerable to authenticated remote code execution (CVE-2024-21378) due to improper validation of synchronized form objects. By manipulating a configuration file, attackers can automatically register and instantiate a custom form, specifying a malicious executable as the form server, which bypasses Outlook‘s faulty allow-listing mechanism, enabling remote code execution on the […]
The post 0-Click Outlook RCE Vulnerability Triggered When Email is Clicked – Technical Analysis appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
Adobe has released patches for 72 security vulnerabilities across its popular software products. This effort, spearheaded by Adobe’s Product Security Incident Response Team (PSIRT), underscores its commitment to safeguarding its users against potential cyber threats. Comprehensive Security Measures Adobe’s PSIRT is crucial to the company’s vulnerability disclosure program. It provides a single point of contact […]
The post Adobe Patches 72 Security Vulnerabilities Across Multiple Products appeared first on Cyber Security News.