CCTR.18.April.24
Pwning Cisco ASA, FTP bugs and exploiting Virtualbox oh and more Citrix bugs
Last updated
Pwning Cisco ASA, FTP bugs and exploiting Virtualbox oh and more Citrix bugs
Last updated
Cybersecurity and Infrastructure Security Agency (CISA) has urgently demanded patching for two security vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco ASA products as these weaknesses have already been exploited by state-sponsored threat actors. The agency has set a rapid deadline of May 1 for federal agencies to address these issues. Similarly, ACSC has noted that threat actors have compromised some devices in Australia using these vulnerabilities. Ref CISA also added a high risk vulnerability (CVE-2024-4040) in CrushFTP a widely used file transfer service, to its list of actively exploited vulnerabilities. This vulnerability allows threat actors to access sensitive data managed through the FTP client and potentially take over the entire system. CrowdStrike has observed the active use of a specific exploit in targeted attacks against U.S. organisations, driven by intelligence gathering and possibly political motives. This has raised concerns about a repeat of events from 2023, when the Cl0p ransomware gang exploited similar vulnerabilities in GoAnyWhere and MoveIt file transfer tools to steal data from thousands of organisations globally. Ref Oracle Virtualbox was impacted by a high-risk security vulnerability tracked as CVE-2024-21111 (CVSS 7.8), which could allow attackers to gain higher privileged access on affected systems. Oracle quickly addressed this issue in impacted versions. Despite the quick response, a detailed guide (PoC) on how to exploit this flaw has been made publicly available, explaining how someone could exploit it. Ref A high-risk security vulnerability, tracked as CVE-2024-3902 (CVSS 7.3), has been discovered in Citrix monitoring tool, uberAgent. This could potentially allow attackers to elevate their access levels within an affected system, posing a significant threat to organisations using vulnerable versions of the software. Ref Okta has observed a rise in both the frequency and scale of credential stuffing attacks on online services. These attacks have been made easier by the widespread availability of residential proxy services, lists of previously stolen credentials, and scripting tools. In these attacks, adversaries use large sets of usernames and passwords, gathered from past data breaches of different organisations or through phishing and malware campaigns, to try and log into various online services. Read on
