CCTR.16.April.24
Pwning Firewalls and Thycotic Secret Servers
Last updated
Pwning Firewalls and Thycotic Secret Servers
Last updated
Volexity has identified the exploitation of a zero-day vulnerability of Palo Alto Networks Alto GlobalProtect gateway firewalls. This critical vulnerability (CVE-2024-3400 CVSS 10) allows a threat actor to execute commands with root privileges on the firewall. Currently, this vulnerability is actively being exploited, most likely by a single state-sponsored threat actor (UTA0218). They emotely exploit firewalls and transfer additional tools to move laterally within their victim organisations. The threat actor also installs a Python backdoor UPSTYLE on the compromised firewalls. It is imperative to patch your firewall; however, it's important to note that patching may destroy forensic artifacts. It is highly recommended to monitor network activity for any abnormal behaviour and investigate unexpected network activity. With the inevitability of the exploit becoming public knowledge, opportunistic threat actors are expected to exploit it against their victims. Ref Incident analysis UPSTYLE on VirusTotal Over the weekend, customers of Delinea Secret Server (formerly known as Thycotic Secret Server) cloud faced an unexpected outage due to a "security incident." This is a crown jewel system in organisations’ privileged access management. The secret server impacted by a critical vulnerability (allowing authentication bypass and administrator access) affecting both on-premises and cloud versions. Despite being reported two months earlier, Delinea had not taken action or acknowledged the issue until its public disclosure. Delinea said that they believe no customer data was impacted. On-premises users need to update their systems to the latest version, while cloud customers must rely on Delinea's pinky promise. Ref – Incident Ref PoC - This is a must read if you’re a pen tester🖋️ 🔷A critical vulnerability (CVE-2024-2879 CVSS 9.8) in the LayerSlider plugin (v7.10.1) for WordPress exposes websites to unauthenticated SQL injection attacks. Attackers can exploit this vulnerability to potentially steal sensitive data and gain complete control over the affected websites. Ref
