Replace Barracuda ESG appliances, company urges
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-2868 | Unauthenticated Command Injection in Barracuda Email Security Gateway Appliances via .tar Files CVE-2023-2868 is a critical (CVSS 9.8) remote command injection vulnerability in the Barracuda Email Security Gateway (ESG) appliance form factor (models 300, 400, 600, 800 and 900), caused by incomplete input validation of user-supplied .tar archives, specifically the names of the files contained within them. An attacker can deliver a specially crafted .tar file whose internal file names are formatted so that, when the ESG processes the archive, commands are executed through Perl's qx operator. Successful exploitation yields remote command execution with the privileges of the ESG product, and in the observed campaign attackers deployed a backdoor (reported as "SUBMARINE") and persisted on compromised appliances. Only customers running ESG appliances on versions 5.1.3.001 through 9.2.0.006 are affected. Exploitation is confirmed in the wild — CISA added it to the KEV on 2023-05-26, EPSS puts 30-day exploitation probability at 87.7%, and public reporting attributes active exploitation to a Chinese-nexus espionage group (associated in headlines with Salt Typhoon) targeting government, military, and telecom victims; Barracuda's BNSF-36456 patch was applied automatically to customer appliances. Do: Verify that each ESG appliance received the automatic BNSF-36456 patch (running fixed firmware at or above 9.2.0.006's successor per vendor instructions), and check appliances for indicators of compromise, including unauthorized command activity and the "SUBMARINE" backdoor, using Barracuda's IOC guidance. Because the espionage campaign established persistence, Barracuda urged full replacement rather than patching of compromised appliances; replace any ESG showing signs of compromise and review email logs for malicious .tar attachments. Limit or monitor internet exposure of ESG management interfaces while remediation proceeds. | 9.8 | 88% | KEV |
| largetens of thousands of deployed ESG appliances (public scans show Barracuda ESGs among commonly internet-exposed email security devices); Barracuda's incident… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| [email protected] | nce after receiving notice in your UI, contact support now ([email protected]),” they added . Caitlin Condon, senior manager, security re | |
| ipv4 | 5.1.3.001 | he remote command injection vulnerability affected versions 5.1.3.001 to 9.2.0.006 of the physical appliance and was being exploi |
| ipv4 | 9.2.0.006 | mand injection vulnerability affected versions 5.1.3.001 to 9.2.0.006 of the physical appliance and was being exploited by attack |
Full article536 words · extracted from helpnetsecurity.com · click to collapse
Barracuda Networks is urging customers running phyisical Email Security Gateway (ESG) appliances to replace them immediately, “regardless of patch version level.”
Vulnerability identification and disclosure
Barracuda has identified a critical vulnerability (CVE-2023-2868) in their ESG appliances on May 19, 2023, and pushed a patch to them all on the following day.
On May 21, “a script was deployed to all impacted appliances to contain the incident and counter unauthorized access methods.”
The remote command injection vulnerability affected versions 5.1.3.001 to 9.2.0.006 of the physical appliance and was being exploited by attackers in the wild, “to obtain unauthorized access to a subset of ESG appliances.”
Custom-made malware was deployed on them to achieve persistent access.
Urgent action needed
Barracuda initially advised customers to rotate any credentials connected to the ESG appliance (LDAP, AD, Barracuda Cloud Control, FTP, SMB) and promised to replace the affected device. In the meantime, they suggested to customers to spin up a new virtual appliance or opt for the cloud version of the service.
But this Tuesday (June 6), the company issued an urgent action notice, prompting all affected customers to replace their impacted ESG appliances as soon as possible. “If you have not replaced your appliance after receiving notice in your UI, contact support now ([email protected]),” they added.
Caitlin Condon, senior manager, security research at Rapid7, noted that “the pivot from patch to total replacement of affected devices is fairly stunning and implies the malware the threat actors deployed somehow achieves persistence at a low enough level that even wiping the device wouldn’t eradicate attacker access.”
Rapid7 researchers have identified ongoing malicious actions dating back to November 2022, with the most recent instances being observed in May 2023.
“In at least one case, outbound network traffic indicated potential data exfiltration. We have not yet observed any lateral movement from a compromised appliance,” Condon shared.
Barracuda has previously comfirmed that the earliest identified evidence of exploitation of CVE-2023-2868 points to attackers leveraging it as far back as October 2022.
UPDATE (June 11, 2023, 13:25 a.m. ET):
The Government of the Australian Capital Territory (ACT) has been breached by attackers leveraging CVE-2023-2868.
“A harms assessment is underway to fully understand the impact specific to our systems, and importantly to the data that may have been accessed. We are confident that actions taken to date have contained the breach and that there is no ongoing threat,” the ACT Government said on Thursday.
UPDATE (June 19, 2023, 05:05 a.m. ET):
Mandiant says that suspected state-backed Chinese hackers exploited CVE-2023-2868 to target hundreds of public and private sector organizations.
“Almost a third of identified affected organizations were government agencies, supporting the assessment that the campaign had an espionage motivation. Further, in the set of entities selected for focused data exfiltration, shell scripts were uncovered that targeted email domains and users from ASEAN Ministry of Foreign Affairs, as well as foreign trade offices and academic research organizations in Taiwan and Hong Kong,” Mandiant’s analysts shared.
“In addition, the actors searched for email accounts belonging to individuals working for a government with political or strategic interest to the PRC at the same time that this victim government was participating in high-level, diplomatic meetings with other countries.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/06/09/replace-barracuda-esg-appliances/