The hack of MSP provider CTS potentially impacted hundreds of UK law firms
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation. Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts. | 7.5 | 100% | KEV ransomware |
| masshundreds of thousands of internet-exposed NetScaler ADC/Gateway appliances (public internet scan counts), plus an unknown number of VPN-only or internal… |
Full article368 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 27, 2023
The cyber attack that hit the managed service provider (MSP) CTS potentially impacted hundreds in the United Kingdom.
CTS is a trusted provider of IT services to the legal sector in the UK. The company announced that it is investigating a cyber attack that caused a service outage. The incident impacted a portion of the services.
The security incident potentially impacted hundreds of British law firms.
“We are experiencing a service outage which has impacted a portion of the services we deliver to some of our clients. The outage was caused by a cyber-incident. We are working closely with a leading global cyber forensics firm to help us with an urgent investigation into the incident and to assist us in service restoration.” reads the update published by CTS.
“We continue to work around the clock with the assistance of third-party experts. Whilst we are confident that we will be able to restore services, we are unable to give a precise timeline for full restoration. We will continue to communicate directly with those of our clients which are impacted by the service outage, providing regular updates on the status of our work to restore services and our investigations into the incident.”
The company is investigating the incident with the help of a cyber forensics firm. The company plans to full restore the services, but at this time it is not able to provide a precise timeline for full restoration.
The Record Media is aware of at least one law firm that was directly impacted by the CTS security breach.
Estate Agent Today reported that threat actors allegedly exploited the CitrixBleed vulnerability (CVE-2023-4966). The flaw allowed attackers to gain initial access to the organization’s infrastructure.
In late October, Citrix urged administrators to actively secure all NetScaler ADC and Gateway appliances. The company was aware of attacks in the wild exploiting the CVE-2023-4966 vulnerability.
On October 10, Citrix published a security bulletin related to the critical vulnerability CVE-2023-4966 in Citrix NetScaler ADC/Gateway devices.
MSPs are high-value targets for threat actors that aims at carrying out supply chain attacks.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, MSP)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/154807/hacking/cts-suffered-cyber-attack.html