Week in review: Ivanti fixes RCE vulnerability, Nissan breach affects 100,000 individuals
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-41724 | A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. NVD description · AI analysis pending | 8.8 | 13% |
| — | ||
| CVE-2024-25153 | A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells. NVD description · AI analysis pending | 9.8 | 42% |
| — | ||
| CVE-2024-27198 | Authentication Bypass in JetBrains TeamCity CI/CD Server CVE-2024-27198 is an authentication bypass (CWE-288) in JetBrains TeamCity, JetBrains' self-hosted on-premises continuous integration/continuous delivery (CI/CD) server, that allows an unauthenticated attacker to circumvent login and perform administrative actions. It is triggered by sending specially crafted requests to the TeamCity web interface that dodge the authentication check, after which the attacker gains full administrator access. With admin access, an attacker can create administrative accounts, alter build configurations, plant code that runs on the server and its build agents, and reach source code, credentials, and secrets stored in the CI/CD environment, which ransomware operators have already used as an entry point. Any TeamCity deployment an attacker can reach over the network is affected, with internet-facing instances at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2024-03-07 with known ransomware use, and EPSS estimates a 99.9% probability of exploitation within 30 days. Do: Upgrade immediately to the patched TeamCity release per JetBrains' advisory (2023.11.4 or later fixes this vulnerability), or apply vendor mitigations or discontinue use per CISA guidance if patching is not possible. Audit instances for unexpected administrator accounts, modified build configurations, and other signs of compromise, since ransomware operators are known to be actively exploiting this bug. Restrict TeamCity's network exposure to trusted users and networks until the update is applied. | 9.8 | 100% | KEV ransomware |
| largetens of thousands of internet-exposed TeamCity servers (roughly 20,000–30,000 per public scans at disclosure) |
Full article948 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
Outsmarting cybercriminal innovation with strategies for enterprise resilience
In this Help Net Security interview, Pedro Cameirão, Head of Cyber Defense Center at Nokia, discusses emerging cybersecurity trends for 2024 and advises enterprises on preparation strategies.
Cybersecurity jobs available right now: March 19, 2024
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.
Quicmap: Fast, open-source QUIC protocol scanner
Quicmap is a fast, open-source QUIC service scanner that streamlines the process by eliminating multiple tool requirements. It effectively identifies QUIC services, the protocol version, and the supported ALPNs.
Lynis: Open-source security auditing tool
Lynis is a comprehensive open-source security auditing tool for UNIX-based systems, including Linux, macOS, and BSD.
WebCopilot: Open-source automation tool enumerates subdomains, detects bugs
WebCopilot is an open-source automation tool that enumerates a target’s subdomains and discovers bugs using various free tools.
NIST’s NVD has encountered a problem
Whether the cause is insurmountable technical debt, lack of funds, a third reason or all of them, NIST’s National Vulnerability Database (NVD) is struggling, and it’s affecting vulnerability management efforts.
The most prevalent malware behaviors and techniques
An analysis of 100,000+ Windows malware samples has revealed the most prevalent techniques used by malware developers to successfully evade defenses, escalate privileges, execute the malware, and assure its persistence.
RaaS groups increasing efforts to recruit affiliates
Smaller RaaS groups are trying to recruit new and “displaced” LockBit and Alphv/BlackCat affiliates by foregoing deposits and paid subscriptions, offering better payout splits, 24/7 support, and other “perks”.
Ivanti fixes RCE vulnerability reported by NATO cybersecurity researchers (CVE-2023-41724)
Ivanti has fixed a critical RCE vulnerability (CVE-2023-41724) in Ivanti Standalone Sentry that has been reported by researchers with the NATO Cyber Security Centre.
43 million workers potentially affected in France Travail data breach
French national unemployment agency France Travail (formerly Pôle emploi) and Cap emploi, a government employment service for people with disabilities, have suffered a data breach that might have exposed personal data of 43 million people.
Nissan breach exposed data of 100,000 individuals
Nissan Oceania has confirmed that the data breach it suffered in December 2023 affected around 100,000 individuals and has begun notifying them.
Fujitsu finds malware on company systems, investigates possible data breach
Fujitsu Limited, the largest Japanese IT services provider, has announced that several of the company’s computers have been compromised with malware, leading to a possible data breach.
PoC exploit for critical Fortra FileCatalyst MFT vulnerability released (CVE-2024-25153)
Proof-of-concept (PoC) exploit code for a critical RCE vulnerability (CVE-2024-25153) in Fortra FileCatalyst MFT solution has been published.
Attackers are exploiting JetBrains TeamCity flaw to deliver a variety of malware
Attackers are exploiting the recently patched JetBrains TeamCity auth bypass vulnerability (CVE-2024-27198) to deliver ransomware, cryptominers and remote access trojans (RATs), according to Trend Micro researchers.
Attackers are targeting financial departments with SmokeLoader malware
Financially motivated hackers have been leveraging SmokeLoader malware in a series of phishing campaigns predominantly targeting Ukrainian government and administration organizations.
Surviving the “quantum apocalypse” with fully homomorphic encryption
In the past few years, an increasing number of tech companies, organizations, and even governments have been working on one of the next big things in the tech world: successfully building quantum computers.
Harnessing the power of privacy-enhancing tech for safer AI adoption
In this Help Net Security video, Dr. Ellison Anne Williams, CEO of Enveil, discusses global AI adoption and the imperative role of Privacy Enhancing Technologies (PETs).
Public anxiety mounts over critical infrastructure resilience to cyber attacks
With temporary failures of critical infrastructure on the rise in the recent years, 81% of US residents are worried about how secure critical infrastructure may be, according to MITRE and The Harris Poll.
Red teaming in the AI era
As AI gets baked into enterprise tech stacks, AI applications are becoming prime targets for cyber attacks. In response, many cybersecurity teams are adapting existing cybersecurity practices to mitigate these new threats.
Why is everyone talking about certificate automation?
Digital Certificates are not new. In this Help Net Security video, Andreas Brix, Senior Program Manager at GlobalSign, discusses why they are back in the news and what you should do about it.
Fake data breaches: Countering the damage
Amid the constant drumbeat of successful cyberattacks, some fake data breaches have also cropped up to make sensational headlines.
Security best practices for GRC teams
In this Help Net Security video, Shrav Mehta, CEO at Secureframe, talks about security best practices for GRC teams, highlights areas that security learners should pay close attention to, and discusses how security leaders can automate specific processes.
Shadow AI is the latest cybersecurity threat you need to prepare for
Similarly to shadow IT, shadow AI refers to all the AI-enabled products and platforms being used within your organization that those departments don’t know about.
Using cloud development environments to secure source code
In this Help Net Security video, Rob Whiteley, CEO at Coder, discusses the cloud development environment (CDE) technology landscape and its benefits.
Inside the book – See Yourself in Cyber: Security Careers Beyond Hacking
In this Help Net Security video, Ed Adams, president and CEO of Security Innovation, discusses his new book See Yourself in Cyber: Security Careers Beyond Hacking.
Secrets sprawl: Protecting your critical secrets
Leaked secrets, a phenomenon known as ‘secrets sprawl,’ is a pervasive vulnerability that plagues nearly every organization.
New infosec products of the week: March 22, 2024
Here’s a look at the most interesting products from the past week, featuring releases from Appdome, Drata, GlobalSign, Ordr, Portnox, Sonatype, Tufin, and Zoom.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/03/24/week-in-review-ivanti-fixes-rce-vulnerability-nissan-breach-affects-100000-individuals/