New persistent backdoor used in attacks on Barracuda ESG appliances
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-2868 | Unauthenticated Command Injection in Barracuda Email Security Gateway Appliances via .tar Files CVE-2023-2868 is a critical (CVSS 9.8) remote command injection vulnerability in the Barracuda Email Security Gateway (ESG) appliance form factor (models 300, 400, 600, 800 and 900), caused by incomplete input validation of user-supplied .tar archives, specifically the names of the files contained within them. An attacker can deliver a specially crafted .tar file whose internal file names are formatted so that, when the ESG processes the archive, commands are executed through Perl's qx operator. Successful exploitation yields remote command execution with the privileges of the ESG product, and in the observed campaign attackers deployed a backdoor (reported as "SUBMARINE") and persisted on compromised appliances. Only customers running ESG appliances on versions 5.1.3.001 through 9.2.0.006 are affected. Exploitation is confirmed in the wild — CISA added it to the KEV on 2023-05-26, EPSS puts 30-day exploitation probability at 87.7%, and public reporting attributes active exploitation to a Chinese-nexus espionage group (associated in headlines with Salt Typhoon) targeting government, military, and telecom victims; Barracuda's BNSF-36456 patch was applied automatically to customer appliances. Do: Verify that each ESG appliance received the automatic BNSF-36456 patch (running fixed firmware at or above 9.2.0.006's successor per vendor instructions), and check appliances for indicators of compromise, including unauthorized command activity and the "SUBMARINE" backdoor, using Barracuda's IOC guidance. Because the espionage campaign established persistence, Barracuda urged full replacement rather than patching of compromised appliances; replace any ESG showing signs of compromise and review email logs for malicious .tar attachments. Limit or monitor internet exposure of ESG management interfaces while remediation proceeds. | 9.8 | 88% | KEV |
| largetens of thousands of deployed ESG appliances (public scans show Barracuda ESGs among commonly internet-exposed email security devices); Barracuda's incident… |
Full article305 words · extracted from helpnetsecurity.com · click to collapse
The Cybersecurity and Infrastructure Agency (CISA) has published an analysis report on the backdoors dropped by attackers exploiting CVE-2023-2868, a remote command injection vulnerability in Barracuda Email Security Gateway (ESG) appliances.
Barracuda ESG zero-day exploit and backdoors
In late May, Barracuda warned that attackers have been exploiting the (then zero-day) vulnerability in Barracuda Networks’ ESG physical appliances.
As previously specified by Mandiant, the threat actors then set up a reverse shell backdoor on the appliances, which they used to download the SEASPY backdoor, along with additional malicious payloads (SALTWATER, SEASIDE).
“SEASPY is a persistent and passive backdoor that masquerades as a legitimate Barracuda service. SEASPY monitors traffic from the actor’s C2 server,” noted the CISA advisory alert.
“When the right packet sequence is captured, it establishes a Transmission Control Protocol (TCP) reverse shell to the C2 server. The shell allows the threat actors to execute arbitrary commands on the ESG appliance.”
After initial attempts to address the vulnerability by releasing a patch or by urging customers to implement mitigations, Barracuda finally issued an urgent action notice advising them to replace their ESG appliances as soon as possible.
A new malware variant
CISA has identified a new malware type on the compromised ESG appliances, which has been dubbed SUBMARINE.
“SUBMARINE is a novel persistent backdoor executed with root privileges that lives in a Structured Query Language (SQL) database on the ESG appliance,” the Agency noted.
“SUBMARINE comprises multiple artifacts—including a SQL trigger, shell scripts, and a loaded library for a Linux daemon—that together enable execution with root privileges, persistence, command and control, and cleanup.”
The Agency says that this malware poses “a severe threat for lateral movement” and has provided indicators of compromise and YARA rules defenders can use to detect it, the other backdoors, and the exploit payload in their environments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/07/31/barracuda-esg-backdoors/