Citrix Bleed leveraged to steal data of 35+ million Comcast Xfinity customers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation. Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts. | 7.5 | 100% | KEV ransomware |
| masshundreds of thousands of internet-exposed NetScaler ADC/Gateway appliances (public internet scan counts), plus an unknown number of VPN-only or internal… |
Full article273 words · extracted from helpnetsecurity.com · click to collapse
Telecommunications company Comcast has confirmed a breach that exposed personal information of more than 35.8 million of Xfinity customers.
Exploiting Citrix Bleed to breach Xfinity
CVE-2023-4966 (aka Citrix Bleed) – an information disclosure vulnerability in Citrix NetScaler ADC/Gateway devices – was disclosed on October 10, when Citrix issued a patch to fix the vulnerability.
(CVE-2023-4966 has been exploited as a zero-day by attackers since late August 2023, and widely since the release of the patch.)
Xfinity noted that they “promptly patched and mitigated [their] systems” after Citrix released additional mitigation guidelines on October 23.
“However, we subsequently discovered that prior to mitigation, between October 16 and October 19, 2023, there was unauthorized access to some of our internal systems that we concluded was a result of this vulnerability,” the company stated in the security incident notice sent to customers.
“We notified federal law enforcement and conducted an investigation into the nature and scope of the incident. On November 16, 2023, it was determined that information was likely acquired.”
Xfinity revealed that the stolen information included usernames and hashed passwords, and that the breach also exposed names, contact information, last four digits of social security numbers, dates of birth and/or secret questions and answers for some of its customers (though the number was not specified).
What should customers do?
To protect their accounts, customers are advised to change their passwords and to enable two-factor or multi-factor authentication (if they haven’t already).
The company also urged customers to be vigilant for fraud and identity theft incidents by checking accounts statements, credit card reports, and generally be on the lookout for suspicious activity on their accounts.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/12/20/xfinity-breach/