This article is contributed. See the original author and article here.
CISA has released three Industrial Control Systems (ICS) advisories on October 11, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.
CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations:
This article was originally posted by the FTC. See the original article here.
Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.
This article is contributed. See the original author and article here.
Title: FBI and CISA Publish a PSA on Information Manipulation Tactics for 2022 Midterm Elections
Content:
The Federal Bureau of Investigation (FBI) and CISA have published a joint public service announcement that:
The PSA also describes the extensive safeguards in place to protect election infrastructure and includes recommendations to assist the public in understanding how to find trustworthy sources of election-related information.
This article is contributed. See the original author and article here.
CISA, the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) have released a joint Cybersecurity Advisory (CSA) providing the top Common Vulnerabilities and Exposures (CVEs) used since 2020 by People’s Republic of China (PRC) state-sponsored cyber actors. PRC state-sponsored cyber actors continue to exploit known vulnerabilities to actively target U.S. and allied networks, including software and hardware companies to illegally obtain intellectual property and develop access into sensitive networks.
CISA, the FBI, and the NSA urge U.S. and allied governments, critical infrastructure, and private sector organizations to apply the recommendations listed in the Top CVEs Actively Exploited by People’s Republic of China State-Sponsored Cyber Actors to increase their defensive posture and reduce the threat of compromise from PRC state-sponsored malicious cyber actors.
For more information on PRC state-sponsored malicious cyber activity, see CISA’s China Cyber Threat Overview and Advisories webpage, the FBI’s Industry Alerts, and the NSA’s Cybersecurity Advisories & Guidance.
This article is contributed. See the original author and article here.
This joint Cybersecurity Advisory (CSA) provides the top Common Vulnerabilities and Exposures (CVEs) used since 2020 by People’s Republic of China (PRC) state-sponsored cyber actors as assessed by the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI). PRC state-sponsored cyber actors continue to exploit known vulnerabilities to actively target U.S. and allied networks as well as software and hardware companies to steal intellectual property and develop access into sensitive networks.
This joint CSA builds on previous NSA, CISA, and FBI reporting to inform federal and state, local, tribal and territorial (SLTT) government; critical infrastructure, including the Defense Industrial Base Sector; and private sector organizations about notable trends and persistent tactics, techniques, and procedures (TTPs).
NSA, CISA, and FBI urge U.S. and allied governments, critical infrastructure, and private sector organizations to apply the recommendations listed in the Mitigations section and Appendix A to increase their defensive posture and reduce the threat of compromise from PRC state-sponsored malicious cyber actors.
For more information on PRC state-sponsored malicious cyber activity, see CISA’s China Cyber Threat Overview and Advisories webpage, FBI’s Industry Alerts, and NSA’s Cybersecurity Advisories & Guidance.
Download the PDF version of this report: pdf, 409 KB
NSA, CISA, and FBI continue to assess PRC state-sponsored cyber activities as being one of the largest and most dynamic threats to U.S. government and civilian networks. PRC state-sponsored cyber actors continue to target government and critical infrastructure networks with an increasing array of new and adaptive techniques—some of which pose a significant risk to Information Technology Sector organizations (including telecommunications providers), Defense Industrial Base (DIB) Sector organizations, and other critical infrastructure organizations.
PRC state-sponsored cyber actors continue to exploit known vulnerabilities and use publicly available tools to target networks of interest. NSA, CISA, and FBI assess PRC state-sponsored cyber actors have actively targeted U.S. and allied networks as well as software and hardware companies to steal intellectual property and develop access into sensitive networks. See Table 1 for the top used CVEs.
Table I: Top CVEs most used by Chinese state-sponsored cyber actors since 2020
|
Vendor |
CVE |
Vulnerability Type |
|
Apache Log4j |
CVE-2021-44228 |
Remote Code Execution |
|
Pulse Connect Secure |
CVE-2019-11510 |
Arbitrary File Read |
|
GitLab CE/EE |
CVE-2021-22205 |
Remote Code Execution |
|
Atlassian |
CVE-2022-26134 |
Remote Code Execution |
|
Microsoft Exchange |
CVE-2021-26855 |
Remote Code Execution |
|
F5 Big-IP |
CVE-2020-5902 |
Remote Code Execution |
|
VMware vCenter Server |
CVE-2021-22005 |
Arbitrary File Upload |
|
Citrix ADC |
CVE-2019-19781 |
Path Traversal |
|
Cisco Hyperflex |
CVE-2021-1497 |
Command Line Execution |
|
Buffalo WSR |
CVE-2021-20090 |
Relative Path Traversal |
|
Atlassian Confluence Server and Data Center |
CVE-2021-26084 |
Remote Code Execution |
|
Hikvision Webserver |
CVE-2021-36260 |
Command Injection |
|
Sitecore XP |
CVE-2021-42237 |
Remote Code Execution |
|
F5 Big-IP |
CVE-2022-1388 |
Remote Code Execution |
|
Apache |
CVE-2022-24112 |
Authentication Bypass by Spoofing |
|
ZOHO |
CVE-2021-40539 |
Remote Code Execution |
|
Microsoft |
CVE-2021-26857 |
Remote Code Execution |
|
Microsoft |
CVE-2021-26858 |
Remote Code Execution |
|
Microsoft |
CVE-2021-27065 |
Remote Code Execution |
|
Apache HTTP Server |
CVE-2021-41773 |
Path Traversal |
These state-sponsored actors continue to use virtual private networks (VPNs) to obfuscate their activities and target web-facing applications to establish initial access. Many of the CVEs indicated in Table 1 allow the actors to surreptitiously gain unauthorized access into sensitive networks, after which they seek to establish persistence and move laterally to other internally connected networks. For additional information on PRC state-sponsored cyber actors targeting network devices, please see People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices.
NSA, CISA, and FBI urge organizations to apply the recommendations below and those listed in Appendix A.
Table II: Apache CVE-2021-44228
|
Apache CVE-2021-44228 CVSS 3.0: 10 (Critical) |
|
Vulnerability Description Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against malicious actor controlled LDAP and other JNDI related endpoints. A malicious actor who can control log messages or log message parameters could execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. |
|
Recommended Mitigations
|
|
Detection Methods |
|
Vulnerable Technologies and Versions There are numerous vulnerable technologies and versions associated with CVE-2021-44228. For a full list, check https://nvd.nist.gov/vuln/detail/CVE-2021-44228. |
Table III: Pulse CVE-2019-11510
|
Pulse CVE-2019-11510 CVSS 3.0: 10 (Critical) |
|
Vulnerability Description This vulnerability has been modified since it was last analyzed by NVD. It is awaiting reanalysis, which may result in further changes to the information provided. In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote malicious actor could send a specially crafted URI to perform an arbitrary file reading vulnerability. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 |
Table IV: GitLab CVE-2021-22205
|
GitLab CVE-2021-22205 CVSS 3.0: 10 (Critical) |
|
Vulnerability Description An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files passed to a file parser, which resulted in a remote command execution. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions Gitlab CE/EE. |
Table V: Atlassian CVE-2022-26134
|
Atlassian CVE-2022-26134 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that could allow an unauthenticated malicious actor to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, 7.13.0 before 7.13.7, 7.14.0 before 7.14.3, 7.15.0 before 7.15.2, 7.16.0 before 7.16.4, 7.17.0 before 7.17.4, and 7.18.0 before 7.18.1. |
|
Recommended Mitigations
|
|
Detection Methods N/A |
|
Vulnerable Technologies and Versions All supported versions of Confluence Server and Data Center Confluence Server and Data Center versions after 1.3.0 |
Table VI: Microsoft CVE-2021-26855
|
Microsoft CVE-2021-26855 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description Microsoft has released security updates for Windows Exchange Server. To exploit these vulnerabilities, an authenticated malicious actor could send malicious requests to an affected server. A malicious actor who successfully exploited these vulnerabilities would execute arbitrary code and compromise the affected systems. If successfully exploited, these vulnerabilities could allow an adversary to obtain access to sensitive information, bypass security restrictions, cause a denial of service conditions, and/or perform unauthorized actions on the affected Exchange server, which could aid in further malicious activity. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions Microsoft Exchange 2013, 2016, and 2019. |
Table VII: F5 CVE-2020-5902
Table VIII: VMware CVE-2021-22005
|
VMware CVE-2021-22005 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. |
|
Recommended Mitigations
|
|
Detection Methods N/A |
|
Vulnerable Technologies and Versions VMware Cloud Foundation VMware VCenter Server |
Table IX: Citrix CVE-2019-19781
|
Citrix CVE-2019-19781 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description This vulnerability has been modified since it was last analyzed by NVD. It is awaiting reanalysis, which may result in further changes to the information provided. An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. |
|
Recommended Mitigations |
|
Detection Methods N/A |
|
Vulnerable Technologies and Versions Citrix ADC, Gateway, and SD-WAN WANOP |
Table X: Cisco CVE-2021-1497
|
Cisco CVE-2021-1497 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote malicious actor to perform a command injection against an affected device. For more information about these vulnerabilities, see the Technical details section of this advisory. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions Cisco Hyperflex Hx Data Platform 4.0(2A) |
Table XI: Buffalo CVE-2021-20090
|
Buffalo CVE-2021-20090 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote malicious actors to bypass authentication. |
|
Recommended Mitigations
|
|
Detection Methods |
|
Vulnerable Technologies and Versions Buffalo Wsr-2533Dhpl2-Bk Firmware Buffalo Wsr-2533Dhp3-Bk Firmware |
Table XII: Atlassian CVE-2021-26084
|
Atlassian CVE-2021-26084 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated malicious actor to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23 and from version 6.14.0 before 7.4.11, version 7.5.0 before 7.11.6, and version 7.12.0 before 7.12.5. |
|
Recommended Mitigations
|
|
Detection Methods N/A |
|
Vulnerable Technologies and Versions Atlassian Confluence Atlassian Confluence Server Atlassian Data Center Atlassian Jira Data Center |
Table XIII: Hikvision CVE-2021-36260
|
Hikvision CVE-2021-36260 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description This vulnerability has been modified since it was last analyzed by NVD. It is awaiting reanalysis, which may result in further changes to the information provided. A command injection vulnerability exists in the web server of some Hikvision products. Due to the insufficient input validation, a malicious actor can exploit the vulnerability to launch a command injection by sending some messages with malicious commands. |
|
Recommended Mitigations
|
|
Detection Methods N/A |
|
Vulnerable Technologies and Versions Various Hikvision Firmware to include Ds, Ids, and Ptz |
|
References |
Table XIV: Sitecore CVE-2021-42237
|
Sitecore CVE-2021-42237 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. |
|
Recommended Mitigations
|
|
Detection Methods |
|
Vulnerable Technologies and Versions Sitecore Experience Platform 7.5, 7.5 Update 1, and 7.5 Update 2 Sitecore Experience Platform 8.0, 8.0 Service Pack 1, and 8.0 Update 1-Update 7 Sitecore Experience Platform 8.0 Service Pack 1 Sitecore Experience Platform 8.1, and Update 1-Update 3 Sitecore Experience Platform 8.2, and Update 1-Update 7 |
Table XV: F5 CVE-2022-1388
|
F5 CVE-2022-1388 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description This vulnerability has been modified since it was last analyzed by NVD. It is awaiting reanalysis, which may result in further changes to the information provided. On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
|
Recommended Mitigations
|
|
Detection Methods N/A |
|
Vulnerable Technologies and Versions Big IP versions: 16.1.0-16.1.2 15.1.0-15.1.5 14.1.0-14.1.4 13.1.0-13.1.4 12.1.0-12.1.6 11.6.1-11.6.5 |
Table XVI: Apache CVE-2022-24112
|
Apache CVE-2022-24112 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description A malicious actor can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX’s data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed. |
|
Recommended Mitigations
|
|
Detection Methods N/A |
|
Vulnerable Technologies and Versions Apache APISIX between 1.3 and 2.12.1 (excluding 2.12.1) LTS versions of Apache APISIX between 2.10.0 and 2.10.4 |
Table XVII: ZOHO CVE-2021-40539
|
ZOHO CVE-2021-40539 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions Zoho Corp ManageEngine ADSelfService Plus |
Table XVIII: Microsoft CVE-2021-26857
|
Microsoft CVE-2021-26857 CVSS 3.0: 7.8 (High) |
|
Vulnerability Description Microsoft Exchange Server remote code execution vulnerability. This CVE ID differs from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, and CVE-2021-27078. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions Microsoft Exchange Servers |
Table XIX: Microsoft CVE-2021-26858
Table XX: Microsoft CVE-2021-27065
Table XXI: Apache CVE-2021-41773
|
Apache CVE-2021-41773 CVSS 3.0: 7.5 (High) |
|
Vulnerability Description This vulnerability has been modified since it was last analyzed by NVD. It is awaiting reanalysis, which may result in further changes to the information provided. A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. A malicious actor could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration “require all denied,” these requests can succeed. Enabling CGI scripts for these aliased paths could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 is incomplete (see CVE-2021-42013). |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions Apache HTTP Server 2.4.49 and 2.4.50 Fedoraproject Fedora 34 and 35 Oracle Instantis Enterprise Track 17.1-17.3 Netapp Cloud Backup |
Initial Publication: October 6, 2022
This product is provided subject to this Notification and this Privacy & Use policy.
This article is contributed. See the original author and article here.
Cisco has released security updates to address vulnerabilities in multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page.
CISA encourages users and administrators to review the following advisories and apply the necessary updates:
• Cisco Enterprise NFV Infrastructure Software Improper Signature Verification Vulnerability cisco-sa-NFVIS-ISV-BQrvEv2h
• Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities cisco-sa-expressway-csrf-sqpsSfY6
Recent Comments