MOVEit Gang Targets SysAid Customers With Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-47246 | Unauthenticated Path Traversal RCE in SysAid On-Premise Server CVE-2023-47246 is a critical (CVSS 9.8) path traversal flaw (CWE-22) in SysAid On-Premise before version 23.3.36 that allows an unauthenticated, network-located attacker to write attacker-controlled files into the Tomcat webroot of the SysAid server. Once a file is written into that webroot, it is executed by the Tomcat application server, resulting in remote code execution on the ITSM server. Because the flaw requires no authentication or user interaction, any internet-exposed SysAid On-Premise server is directly reachable, and compromise can lead to data theft and ransomware deployment; the Lace Tempest group behind the MOVEit attacks has exploited it, and ransomware use is known. Only SysAid On-Premise deployments are affected, and the vendor fixed the issue in version 23.3.36. The vulnerability is confirmed exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-13, and carries a 98.9% EPSS probability of exploitation within 30 days. Do: Upgrade SysAid On-Premise to version 23.3.36 or later immediately, per the vendor's security notification. Because this is KEV-listed with known ransomware use by Lace Tempest, also inspect the Tomcat webroot and deployed webapps for unauthorized files (e.g., WAR files), review for unauthorized accounts and unusual processes, and check for signs of lateral movement on compromised hosts. Organizations unable to patch should apply mitigations per the vendor's instructions or discontinue use of the product, per the CISA required action. | 9.8 | 99% | KEV ransomware PoC |
| moderate≈ a few thousand internet-exposed SysAid On-Premise servers (SysAid's overall customer base is on the order of tens of thousands of organizations, and only the… |
Full article308 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft has revealed a new threat campaign exploiting a zero-day vulnerability in the popular SysAid IT helpdesk software.
Posting to X (formerly Twitter) yesterday, the Microsoft Threat Intelligence account said the group is the same one responsible for the MOVEit data theft and extortion campaign – a threat actor known as Lace Tempest (aka DEV-0950, FIN11 and TA505).
“Microsoft notified SysAid about the issue (CVE-2023-47246), which they immediately patched,” the post continued.
“Organizations using SysAid should apply the patch and look for any signs of exploitation prior to patching, as Lace Tempest will likely use their access to exfiltrate data and deploy Clop ransomware.”
Microsoft explained that after exploiting the vulnerability, the threat actors will issue commands via SysAid to deliver a loader for Gracewire malware to victim systems.
“This is typically followed by human-operated activity, including lateral movement, data theft, and ransomware deployment,” it added.
Read more on Lace Tempest: MOVEit Exploitation Fallout Drives Record Ransomware Attacks
A SysAid advisory revealed that the zero-day path traversal vulnerability affects its on-premises server software.
The firm urged customers to upgrade immediately to version 23.3.36, conduct a thorough assessment to check for indicators of compromise (IoCs), check relevant logs and review any credentials or other information that may have been exposed to threat actors.
“Being that this impacts on-premises deployments, this will take a long time to effectively remediate. Unlike cloud-based deployments, having this remediated will take individual action across a large number of organizations,” argued John Gallagher, VP of Viakoo Labs at Viakoo.
“While this will not be as widespread at the MOVEit vulnerability, it’s clear that the threat actor behind it is continuing to develop and deploy new ransomware threats. Organizations should use this as a warning to have effective threat assessment and remediation processes in place, especially for non-IT assets like IoT devices and applications.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/moveit-gang-targets-sysaid-zeroday/