ExCobalt Cybercrime group targets Russian organizations in multiple sectors

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

CVE-2019-13272 is an improper privilege management flaw in the Linux kernel's ptrace_link function (kernel/ptrace.c), present in kernels before 5.1.17, in which the credentials of a process requesting a ptrace relationship are mishandled. A local attacker triggers it by stepping into a parent-child process chain where a privileged parent drops privileges and calls execve, typically by abusing Polkit's pkexec helper with PTRACE_TRACEME; contributing factors include an object lifetime issue and incorrect marking of the ptrace relationship as privileged. Successful exploitation grants the attacker full root-level privileges on the host, and the object lifetime bug can in some cases cause a system panic. Any Linux system running an unpatched kernel is affected, spanning the upstream kernel and distributions such as Debian, Fedora, Ubuntu, Red Hat Enterprise Linux and its variants, as well as NetApp AFF A700s firmware. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-12-10), has multiple public proof-of-concept exploits, and carries a high exploitation probability (EPSS ~52%), so defenders should treat it as an active exploitation risk.

Do: Upgrade the Linux kernel to 5.1.17 or later, or install the backported kernel update from your distribution (Debian, Ubuntu, Fedora, Red Hat) and NetApp's fixed firmware for AFF A700s, per CISA's required action to apply vendor updates. Where patching is delayed, SELinux with deny_ptrace may serve as a usable mitigation in some environments. Prioritize hosts that expose local shells to untrusted users and that have Polkit's pkexec installed, and verify the running kernel version (not just the installed package) on each system.

CVE-2021-3156 is an off-by-one error (CWE-193) in the Unix Sudo utility that causes a heap-based buffer overflow (CWE-122) in Sudo's handling of command-line arguments. It is triggered locally when an unprivileged user invokes Sudo with specially crafted arguments, requiring no special privileges or non-default configuration. A successful exploit allows the attacker to execute arbitrary code as root, achieving full local privilege escalation on the host. Any Linux, Unix, or other system running a vulnerable version of Sudo is affected, and because Sudo ships by default on virtually all such systems the potential footprint is enormous. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-06) and carries a 100% EPSS probability of exploitation within 30 days, indicating active in-the-wild exploitation, though specific ransomware use is unknown.

Do: Upgrade Sudo to a patched release (1.9.5p2 or later, or the vendor-supplied update for your distribution) per vendor instructions, as required by the CISA KEV listing. Audit all Unix-like hosts by checking the installed Sudo version through your package manager and prioritize patching multi-user and internet-facing servers. Restricting local shell access and monitoring for anomalous Sudo invocations can reduce risk while patching completes.

CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host.

Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use.

CVE-2021-40438 is a server-side request forgery flaw (CWE-918) in the mod_proxy module of Apache HTTP Server 2.4.48 and earlier. By sending a crafted request URI path, a remote attacker can cause the server to forward the request to an origin server chosen by the attacker instead of the intended backend. This lets the attacker use the web server as a proxy to reach internal network services, probe internal hosts, and bypass network access controls. Anyone running an affected Apache HTTP Server version with mod_proxy enabled in a proxying configuration is affected. The flaw is being actively exploited in the wild - it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-12-01 with known ransomware use - and EPSS assigns it the highest probability of near-term exploitation.

Do: Upgrade Apache HTTP Server to a release newer than 2.4.48 per vendor instructions. As an interim mitigation, restrict mod_proxy so it forwards only to explicitly configured backends (avoiding attacker-controlled origin selection) or disable mod_proxy where it is not required, and audit internet-facing Apache servers for proxy configurations. Because this flaw is on the CISA KEV list with known ransomware use, prioritize patching internet-facing systems immediately.

Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days.

Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use.

CVE-2022-2586 is a use-after-free (CWE-416) in the Linux kernel's netfilter/nftables subsystem, where an nft object or expression can reference an nft set belonging to a different nft table. When that other table is deleted, the reference becomes stale and the kernel accesses freed memory, which a local low-privileged user can leverage for privilege escalation and full compromise of the host (CVSS 3.1: 7.8, AV:L/PR:L with high confidentiality, integrity and availability impact). Any Linux deployment whose kernel carries the vulnerable nftables code is affected, including distributions such as Ubuntu Linux (Canonical is the assigned CNA). Exploitation is local, so internet-facing exposure matters mainly as a means for an attacker to first gain a local foothold. The bug is under active exploitation — CISA added it to the Known Exploited Vulnerabilities catalog on 2024-06-26 — and a public write-up with proof-of-concept material exists, with EPSS estimating a 10.5% chance of exploitation within 30 days.

Do: Apply kernel updates per vendor instructions — on Ubuntu, install the latest linux/linux-* packages for your release and reboot to load the patched kernel (per the CISA KEV required action, treating this as a priority item given confirmed in-the-wild exploitation). As interim mitigation, limit unprivileged users' ability to create nftables objects (e.g., restrict unprivileged user namespaces) and review local accounts on multi-user hosts; identify affected systems by checking kernel versions against your distribution's security advisories.

In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.

CVE-2023-3519 is a critical (CVSS 9.8) unauthenticated remote code execution flaw caused by improper code-injection handling (CWE-94) in Citrix NetScaler ADC and NetScaler Gateway. A remote attacker with no credentials can trigger it by sending crafted requests to an appliance configured as a Gateway (VPN/ICA proxy/RDP proxy) or AAA authentication virtual server, gaining arbitrary code execution on the appliance. Exploitation typically yields a foothold behind the VPN edge — access to internal networks, credential theft, and follow-on activity such as espionage or ransomware deployment. Any organization running unpatched NetScaler ADC/Gateway appliances, especially internet-facing remote-access endpoints, is affected; NetScaler is one of the most widely deployed enterprise VPN/ADC platforms. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-07-19 with known ransomware use, EPSS estimates a 99.7% exploitation probability, and researchers have linked activity to China-nexus espionage (Silk Typhoon) and ransomware operations.

Do: Immediately upgrade internet-facing NetScaler ADC/Gateway appliances to the fixed builds in Citrix's advisory (14.1-8.50+, 13.1-49.13+, 13.0-82.45+, 12.1-55.300+, including FIPS/NDcPP equivalents) — per CISA KEV, apply these mitigations or discontinue use if patching is unavailable. Confirm whether each appliance is configured as a Gateway or AAA virtual server (only those are affected), and hunt for compromise — unexpected configuration changes, unfamiliar accounts, webshells, or anomalous VPN sessions — rotating credentials on any suspected compromise.