City of Potsdam offline following a cyberattack ... ....
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-19781 | Unauthenticated path traversal RCE in Citrix ADC, Gateway, and SD-WAN WANOP CVE-2019-19781 is a path-traversal flaw (classified CWE-22, though CISA's description calls it unspecified) in Citrix ADC (formerly NetScaler ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances that lets an unauthenticated remote attacker traverse directories via crafted requests and execute arbitrary commands on the appliance, typically with root privileges. It is triggered by sending specially crafted directory-traversal requests (crafted URLs/requests to the appliance's management or VPN endpoints), which lets the attacker write files and run commands with no credentials. Successful exploitation yields arbitrary code execution on the appliance, enabling theft of VPN/ADC credentials, lateral movement into the corporate network, and installation of persistent backdoors. Any organization running affected ADC, Gateway, or SD-WAN WANOP firmware is affected, with internet-facing gateways used for remote access at the highest risk. Exploitation is confirmed in the wild: the vulnerability is on CISA's KEV (added 2021-11-03) with known ransomware use, EPSS assigns near-certain (100.0%) probability of exploitation within 30 days, and no public PoC is listed despite confirmed abuse. Do: Upgrade Citrix ADC, Gateway, and SD-WAN WANOP appliances to the fixed firmware builds listed in Citrix advisory CTX267020; if patching cannot be done immediately, apply Citrix's published interim mitigation and restrict internet exposure to the appliance. Because exploitation grants root code execution and persistence, after patching hunt for indicators of compromise (unexpected nsroot account, modified system files, crontab/scheduled entries), kill all active and inactive sessions, and rotate appliance and VPN credentials. Prioritize internet-facing gateways and comply with CISA's required action to apply vendor updates. | 9.8 | 100% | KEV ransomware |
| massroughly 80,000-100,000+ internet-exposed Citrix ADC/Gateway appliances at the time of disclosure, with a far larger total installed base (including… |
Full article498 words · extracted from securityaffairs.com · click to collapse
The City of Potsdam suffered a major cyberattack that took down its servers earlier this week, but emergency services were not impacted.
The German City of Potsdam has suffered a major cyberattack that took down its servers earlier this week, the good news is that emergency services, including the city’s fire department fully operational and payments were not affected.
Potsdam is the capital and largest city of the German federal state of Brandenburg. It directly borders the German capital, Berlin, and is part of the Berlin/Brandenburg Metropolitan Region.
The intrusion into the Potsdam administration’s servers was discovered on Tuesday, and on Wednesday evening systems were disconnected from the Internet to contain the infection and prevent data exfiltration.
“The state capital Potsdam has switched off the administration’s internet connection and is therefore no longer accessible by email.” reads the advisory published by the City of Potsdam.
“We put our systems offline for security reasons, because we have to assume an illegal cyber attack,” said Mayor Mike Schubert. “We are working flat out to ensure that the affected administration systems are switched on again as soon as possible and that we can work safely again. In the meantime, we ask for your patience in all matters relating to the citizen service facilities, ” “We put our systems offline for security reasons, because we have to assume an illegal cyberattack,”
The IT staff noticed “numerous inconsistencies” in central access to the capital of the state. Experts noticed a system of an external provider that was attempting to retrieve data from the state capital from outside without authorization or to install malware.
The City of Potsdam hired external IT security companies and IT forensic experts to investigate the attack.
The state capital has filed criminal charges against unknown individuals and notified the incident to the regional offices responsible for IT security and data protection.
The City published an update that announced that Postdam’s administration is not able to receive emails from outside and any incoming emails won’t be forwarded either.
Citizens could contact the City by calling the Potsdam administration staff on the phone or submitting their applications in writing by post.
“After switching off the Internet connection of the state capital Potsdam, the citizen service of the state capital Potsdam is currently only of limited use.” reads the update. “The administration can currently not receive emails from outside and incoming emails are also not forwarded. For this reason, it is necessary for citizens to submit all applications in writing to the administration by post. The employees are still available by phone for questions. “
The City of Potsdam did not provide details on the attack, but German journalist Hanno Böck reported that Citrix ADC servers on the administration’s network are affected by the CVE-2019-19781 vulnerability.
Citrix started addressing CVE-2019-19781 vulnerability in Citrix Application Delivery Controller (ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Potsdam, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/96835/hacking/city-potsdam-cyberattack.html