Week in review: VirusTotal data leak, Citrix NetScaler zero-day exploitation

CVE-2023-29298 is an improper access control flaw (CWE-284) in Adobe ColdFusion that lets a remote, unauthenticated attacker reach ColdFusion's administrative CFM and CFC endpoints, bypassing the access controls meant to protect them. It is triggered directly over the network with no user interaction and no privileges required (CVSS 3.1: 7.5, high confidentiality impact). An attacker gains access to administrative endpoints as a security feature bypass; in practice, Adobe patched this flaw in the same July 2023 out-of-band update as a critical, actively exploited ColdFusion RCE, and it can be used to reach the server's admin surface. All Adobe ColdFusion deployments running 2018 Update 16 (and earlier), 2021 Update 6 (and earlier), or 2023.0.0.330468 (and earlier) are affected. Exploitation is confirmed in the wild: CISA added it to the KEV on 2023-07-20 and EPSS assigns a 99.8% probability of exploitation within 30 days.

Do: Apply Adobe's July 2023 out-of-band ColdFusion updates immediately - upgrade beyond the affected builds (ColdFusion 2018 later than Update 16, e.g. Update 17; 2021 later than Update 6, e.g. Update 7; and the patched 2023 hotfix newer than build 330468) or follow Adobe's advisory instructions, as CISA requires mitigations or discontinuation of use for KEV entries. Until patched, restrict network access to ColdFusion Administrator/CFIDE endpoints from untrusted networks. Because no authentication or interaction is required, review access logs for unauthenticated requests to admin CFM/CFC endpoints and assume possible compromise on unpatched, internet-facing servers.

CVE-2023-34192 is a critical (CVSS 3.1: 9.0) cross-site scripting (CWE-79) flaw in Synacor Zimbra Collaboration Suite (ZCS) 8.8.15. A remote, authenticated attacker submits a crafted script through the /h/autoSaveDraft endpoint (the autosave-draft handler of the web client), and because the vulnerability requires user interaction and changes scope, the script can execute in another user's browser session. By running code/actions in the security context of the victim's session, the attacker gains high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H per the CVSS vector). Organizations running ZCS 8.8.15 are affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-02-25 amid reported active exploitation, and EPSS is at 77.3% (100th percentile), though no public proof-of-concept is known.

Do: Upgrade ZCS 8.8.15 deployments to the latest available patch release per Synacor/Zimbra's instructions (or move to a supported release), as required by CISA's KEV listing and BOD 22-01 guidance for federal agencies. In the interim, restrict who can reach the /h/autoSaveDraft handler, review logs for suspicious POSTs to that endpoint and for injected drafts, and hunt for indicators of compromise such as unexpected mailbox rules or account activity.

Privilege Escalation to root administrator (nsroot)

CVE-2023-3519 is a critical (CVSS 9.8) unauthenticated remote code execution flaw caused by improper code-injection handling (CWE-94) in Citrix NetScaler ADC and NetScaler Gateway. A remote attacker with no credentials can trigger it by sending crafted requests to an appliance configured as a Gateway (VPN/ICA proxy/RDP proxy) or AAA authentication virtual server, gaining arbitrary code execution on the appliance. Exploitation typically yields a foothold behind the VPN edge — access to internal networks, credential theft, and follow-on activity such as espionage or ransomware deployment. Any organization running unpatched NetScaler ADC/Gateway appliances, especially internet-facing remote-access endpoints, is affected; NetScaler is one of the most widely deployed enterprise VPN/ADC platforms. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-07-19 with known ransomware use, EPSS estimates a 99.7% exploitation probability, and researchers have linked activity to China-nexus espionage (Silk Typhoon) and ransomware operations.

Do: Immediately upgrade internet-facing NetScaler ADC/Gateway appliances to the fixed builds in Citrix's advisory (14.1-8.50+, 13.1-49.13+, 13.0-82.45+, 12.1-55.300+, including FIPS/NDcPP equivalents) — per CISA KEV, apply these mitigations or discontinue use if patching is unavailable. Confirm whether each appliance is configured as a Gateway or AAA virtual server (only those are affected), and hunt for compromise — unexpected configuration changes, unfamiliar accounts, webshells, or anomalous VPN sessions — rotating credentials on any suspected compromise.

CVE-2023-38203 is a critical (CVSS 9.8) deserialization-of-untrusted-data flaw (CWE-502) in Adobe ColdFusion that can lead to arbitrary code execution. It is triggered over the network when an affected ColdFusion server processes crafted untrusted serialized data, and exploitation requires no authentication and no user interaction. A successful attacker gains arbitrary code execution with high impact on confidentiality, integrity, and availability of the host. Organizations running ColdFusion 2018 (Update 17 or earlier), ColdFusion 2021 (Update 7 or earlier), or ColdFusion 2023 (Update 1 or earlier) are affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-01-08 with known ransomware use, EPSS assigns a 96.7% probability of exploitation within 30 days (100th percentile), and Adobe has shipped out-of-band patches in response.

Do: Upgrade all ColdFusion 2018, 2021, and 2023 installations beyond the affected levels (at least past 2018u17, 2021u7, and 2023u1, using the latest update Adobe provides in its advisory). If patching must be delayed, apply the mitigations per Adobe's instructions, restrict or remove internet exposure of ColdFusion servers, and prioritize internet-facing hosts. Because exploitation is confirmed with known ransomware use, review ColdFusion logs and affected hosts for signs of exploitation, webshells, or follow-on malware, and discontinue use of the product if mitigations are unavailable per CISA's required action.