CISA adds 3 new bugs to Known Exploited Vulnerabilities Catalog

Apache HTTP Server contains a path traversal flaw (CWE-22) that can lead to remote code execution; CVE-2021-42013 resolves an incomplete patch previously issued for CVE-2021-41773. The flaw is triggered when files outside directories mapped by Alias-like directives are not protected by the default 'require all denied' configuration, or when CGI scripts are enabled, allowing an attacker to traverse outside the intended directory roots. An attacker can read files outside the configured paths, and where CGI script execution is enabled, achieve remote code execution on the server. The affected product per CISA is Apache HTTP Server; the source data does not specify exact version ranges, so defenders should consult the vendor advisory for fixed releases. Exploitation is confirmed in the wild: the vulnerability was added to CISA KEV on 2021-11-03 with known ransomware use, EPSS estimates a 100% probability of exploitation within 30 days, and no public PoC is listed.

Do: Apply the Apache HTTP Server update per vendor instructions immediately, since this is a CISA KEV item with known ransomware use and near-certain near-term exploitation. Until patched, ensure directories targeted by Alias-like directives are covered by 'require all denied' defaults and disable CGI script execution where it is not required. Review access logs for path traversal probes and confirm no replaced version retains the incomplete earlier patch.

CVE-2022-28810 is an operating system command injection flaw (CWE-78) in the policy custom script feature of Zoho ManageEngine ADSelfService Plus, compounded by use of a default administrator password (CWE-798). A remote authenticated administrator can run arbitrary OS commands through a crafted custom script, and, because the password field is unsanitized, a partially authenticated attacker may also inject commands through it. Successful exploitation executes commands as SYSTEM, giving the attacker full control of the hosting Windows server. Organizations running ADSelfService Plus builds before 6122 are affected. The flaw has public proof-of-concept code and a Metasploit module, a 71% EPSS score, and was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-07, indicating active in-the-wild exploitation.

Do: Upgrade ManageEngine ADSelfService Plus to build 6122 or later per the vendor's instructions; this is a required action for federal agencies under the CISA KEV listing. Until patched, restrict internet exposure of the console and self-service endpoints, replace default administrator credentials, and review configured policy custom scripts and SYSTEM-context process logs for signs of command injection. Given the product's history of APT targeting, hunt for follow-on activity on any host that ran ADSelfService Plus unpatched.

CVE-2022-33891 is an OS command injection flaw (CWE-78) in Apache Spark's HttpSecurityFilter, which handles access-control checks for the Spark UI. When ACLs are enabled via the spark.acls.enable configuration option, a remote party reaching the Spark UI can supply an arbitrary username that is accepted for impersonation, and that attacker-controlled input is ultimately used to build and execute a Unix shell command. A successful attacker gains arbitrary shell command execution as the operating-system user under which Spark is running, with the CVSS v3.1 vector (network vector, low complexity, low privileges, no user interaction, high C/I/A) rating this 8.8 High. It affects Apache Spark 3.0.3 and earlier, 3.1.1 through 3.1.2, and 3.2.0 through 3.2.1 — essentially deployments with ACLs enabled and a Spark UI reachable by untrusted users. Exploitation is confirmed in the wild: a public PoC exists, CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2023-03-07, and headlines report a Zerobot botnet variant spreading by exploiting Apache Spark, with EPSS at 93.1% (100th percentile).

Do: Upgrade Apache Spark to a patched release per Apache's and CISA's vendor instructions, as the flaw is in the KEV Catalog with a required action of applying updates. As an interim mitigation, disable spark.acls.enable if ACLs are not required, and restrict network access to the Spark UI from untrusted networks or expose it only behind authentication at the network layer. Check Spark hosts for suspicious child processes or unexpected commands executed under the Spark service account, which would indicate successful exploitation.

GLPI, a widely deployed open-source IT asset management platform, bundles a third-party htmlawed library whose htmLawedTest.php script permits unauthenticated PHP code injection (CWE-74) in GLPI versions through 10.0.2. An attacker triggers it by sending a crafted HTTP request with injected PHP parameters to the directly web-reachable /vendor/htmlawed/htmlawed/htmLawedTest.php script, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields remote code execution on the web server as the web service account, enabling data theft, lateral movement, and follow-on activity such as ransomware staging or botnet recruitment. Any organization running GLPI 10.0.2 or earlier is affected, particularly internet-facing instances where the test script is directly reachable. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-07 (required action: apply vendor updates), carries a 99.7% EPSS score, and multiple public proof-of-concept exploits are available.

Do: Upgrade GLPI to a fixed release newer than 10.0.2 (or update the bundled htmlawed library to a patched version); as an interim mitigation, remove or block direct web access to /vendor/htmlawed/htmlawed/htmLawedTest.php. Prioritize internet-facing instances given active exploitation and the 99.7% EPSS score, and review web access logs for requests to htmLawedTest.php plus signs of webshells or unexpected administrator accounts. As a CISA KEV entry, federal agencies and other KEV subscribers are required to apply vendor updates per the catalog instructions.