MITRE breach details reveal attackers' successes and failures
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-21887 +1 in the same advisory: …46805 | Command Injection RCE in Ivanti Connect Secure and Policy Secure Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure appliances contain a command injection flaw (CWE-77) in their web components, triggered when an authenticated administrator sends crafted requests to the appliance. The bug can be chained with the separate authentication bypass CVE-2023-46805, allowing an unauthenticated attacker to achieve the same result. Successful exploitation lets an attacker execute arbitrary commands and code on the appliance, providing a foothold into the networks behind the VPN or network access control gateway. Any organization running these appliances, typically enterprises and government agencies often deployed directly on the internet perimeter, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use and EPSS assigns a 100% probability of exploitation within 30 days, although no public proof-of-concept is available. Do: Apply Ivanti's mitigations or patched builds immediately per vendor instructions, addressing the chained authentication bypass CVE-2023-46805 at the same time, and discontinue or restrict use of any appliance for which mitigations are unavailable, especially if it is internet-facing. Because exploitation with ransomware use is known, assume compromise is possible: review appliance web logs for suspicious requests and run Ivanti's integrity-checking guidance to verify appliance images before and after remediation. Where feasible, restrict direct internet exposure of the appliance web interface and monitor for further vendor advisories. | 9.1 group max | 100% | KEV ransomware PoC |
| largetens of thousands of appliances (roughly 20,000-30,000 internet-exposed ICS gateways at disclosure; total deployed base likely higher) |
Full article311 words · extracted from helpnetsecurity.com · click to collapse
MITRE has shared a timeline of the recent breach if fell victim to and has confirmed that it began earlier than previously thought: on December 31, 2023.
On that day, the attackers deployed a web shell on an external-facing Ivanti Connect Secure VPN appliance by exploiting CVE-2023–46805 and CVE-2024–21887, two zero days whose existence became publicly known in early January, when patches were still unavailable.
Tools and techniques used to breach MITRE
The attackers leveraged the Ivanti zero-days to gain access to the organization’s research and prototyping network, from which they performed additional reconnaissance, moved into its VMware environment and exfitrated data.
They used compromised administrative account credentials, web shells and backdoors to maintain persistent access and communicate with the command-and-control infrastructure, the organization’s principal cybersecurity engineer Lex Crumpton and CTO Charles Clancy shared.
Some of the web shells used have previously been documented by Volexity and Mandiant, and are believed to be wielded by a Chinese threat actor.
“UNC5221 is a suspected China-nexus actor that Mandiant is tracking as the only group exploiting CVE-2023-46805 and CVE-2024-21887 during the pre-disclosure time frame since early Dec. 2023,” Mandiant analysts noted in early April.
(MITRE does not say that UNC5221 is behind the attack, only that “indicators observed during the incident overlap with those described in the Mandiant threat intelligence report on UNC5221.)
One of the web shells (“BEEFLUSH”) used by that attackers has been spotted for the first time.
The exfiltration of compromised data began on January 19 and the attackers tried (and failed) to pivot to other resources outside the VMware environment throughout February and March.
MITRE has promised to shared additional details on the adversary’s persistence techniques next week, when they will also provide tools for detection.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/05/08/mitre-breach/