Week in review: VMware patches critical vulnerability, 1Password affected by Okta breach

CVE-2023-20198 is a critical (CVSS 10.0) unauthenticated privilege escalation flaw in the web UI of Cisco IOS XE software, triggered by sending crafted network requests to the exposed web management interface. An attacker with no credentials can use the flaw to gain initial access and issue a privilege 15 command, creating a local user with normal login access; the attacker then chained CVE-2023-20273 (CVSS 7.2) to elevate that account to root and write an implant to the file system. Successful exploitation yields full administrative control of the device, including persistence via the planted implant, on Cisco IOS XE devices with the web UI enabled and reachable from the internet or untrusted networks, including Rockwell Automation Allen-Bradley Stratix 5200 and 5800 switches running IOS XE. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-16 with a BOD 23-02 directive, EPSS stands at 99.6% (100th percentile), and ongoing campaigns (including the 'BADCANDY' activity flagged by Australia's ASD and Cisco-related telecom intrusions attributed to Salt Typhoon) have been reported.

Do: Upgrade affected devices to the fixed releases listed in Cisco's advisory (use Cisco's Software Checker) and, as immediate mitigation, disable the web UI or restrict it to trusted networks/addresses only. Check for compromise by looking for unexpected local user accounts and the implant artifacts Cisco identified (unexpected cisco_tac_alarm.log and cisco_tac.log files in /tmp or /usr/binos/conf), and immediately report positive findings to CISA per BOD 23-02. Keep in mind that patching alone does not remove a root implant, so devices with evidence of compromise should be reimaged or otherwise cleaned per vendor instructions.

VMware vCenter Server contains an out-of-bounds write vulnerability (CWE-787) in its implementation of the DCERPC protocol. A remote, unauthenticated attacker with network access to vCenter Server can send crafted DCERPC traffic that corrupts memory, potentially leading to remote code execution on the vCenter appliance. Because vCenter is the central management plane for VMware vSphere environments, full compromise of it hands attackers a high-value foothold for lateral movement, consistent with the critical 9.8 CVSS score. Any organization running an affected VMware vCenter Server release is exposed (exact version ranges per VMware's advisory, including VMware Cloud Foundation deployments that bundle vCenter). Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-01-22, a public PoC is available, news reports describe China-linked APT UNC3886 exploiting it as a zero-day, and EPSS estimates a 99.4% probability of exploitation within 30 days.

Do: Immediately upgrade vCenter Server — and VMware Cloud Foundation deployments that bundle it — to the patched builds identified in VMware's advisory, prioritizing internet-facing instances; if patching must wait, restrict network access to the vCenter management interface as the CISA KEV required action permits. Because exploitation is confirmed in the wild including by an APT, also hunt for signs of compromise such as unexpected processes or authentication activity on vCenter hosts and managed ESXi estate.

CVE-2023-5631 is a stored cross-site scripting (XSS) flaw in Roundcube Webmail caused by insufficient sanitization of SVG content embedded in HTML email by program/lib/Roundcube/rcube_washtml.php. A remote attacker triggers it by sending a crafted HTML email containing a malicious SVG document; when the recipient views the message, arbitrary JavaScript is loaded in their browser session. This lets the attacker act as the victim within the webmail session — for example reading mail or capturing session data — and it has been used in targeted espionage rather than commodity attacks. Anyone running Roundcube before 1.4.15, 1.5.x before 1.5.5, or 1.6.x before 1.6.4 is affected, including Roundcube packages shipped by Debian and Fedora. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-26, the Winter Vivern espionage group is reported to have exploited it as a zero-day against government entities, and EPSS puts the 30-day exploitation probability at ~76% (99th percentile).

Do: Upgrade to Roundcube 1.6.4, or 1.5.5 on the 1.5.x branch and 1.4.15 on the 1.4.x branch; apply the corresponding patched roundcube packages for Debian or Fedora. Per the CISA KEV required action, apply vendor mitigations or discontinue use if patching is unavailable. Hunt for compromise by reviewing webmail logs and stored messages for crafted SVG/HTML emails sent around the exploitation window, and review sessions for signs of hijacking.