US CISA added 17 flaws to its Known Exploited Vulnerabilities Catalog

Apache Struts 1 versions before 1.2.9, when used with BeanUtils 1.7, contain a denial-of-service vulnerability in how ActionForm beans are populated from request data. An attacker can send crafted HTTP request parameters that, when applied to an ActionForm via BeanUtils, consume excessive server resources and disrupt or crash the affected web application. The impact is availability only — no code execution or access — so an unauthenticated remote attacker gains the ability to degrade or take down the service. Any organization running legacy Java web applications built on Apache Struts 1 prior to 1.2.9 is affected. CISA added this flaw to its Known Exploited Vulnerabilities Catalog on 2022-01-21, confirming in-the-wild exploitation; no public proof-of-concept is known, and any ransomware association is not reported.

Do: Upgrade Apache Struts 1 to version 1.2.9 or later as required by CISA's KEV catalog, and inventory deployed WAR/EAR files for bundled Struts 1 and BeanUtils 1.7 jars since the framework is end-of-life. For legacy applications that cannot be patched or migrated to a supported framework, restrict internet exposure or apply WAF/request-filtering controls to limit unauthenticated access to the vulnerable form-handling paths.

Apache Struts 2 versions before 2.2.3.1 contain an improper input validation flaw (CWE-20) in the ExceptionDelegator component, which handles exception processing for the framework: crafted user-supplied input reaches the exception-handling path and is evaluated as an OGNL expression, allowing remote code execution. An attacker triggers it simply by sending maliciously crafted request parameters to an affected web application, with no authentication required. Successful exploitation lets the attacker execute arbitrary commands or code with the privileges of the application server hosting the Struts-based application. Any web application built on an affected Struts 2 release is exposed, regardless of industry or hosting model. The flaw is being exploited in the wild - CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-21, and its high EPSS (75.6%, 99th percentile) indicates substantial near-term exploitation risk.

Do: Upgrade any application built on Apache Struts 2 to version 2.2.3.1 or later, per CISA's required action to apply vendor updates. Because Struts is typically embedded inside applications, inventory which webapps depend on the framework instead of only checking standalone installations, and monitor web server logs for exploit attempts. If immediate patching is not possible, prioritize internet-facing applications and consider filtering or restricting suspicious request parameters as an interim measure.

CVE-2018-8453 is an elevation of privilege vulnerability in the Windows Win32k kernel component, which fails to properly handle objects in memory, including the Win32k user-callback path reachable via NtUserSetWindowFNID. An attacker who can already execute code on an affected machine can trigger the flaw to escalate privileges, gaining the equivalent of SYSTEM-level rights with high impact on confidentiality, integrity, and availability. All broadly deployed Windows releases of the era are affected, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 1809), and Windows Server 2008 through 2019, so any unpatched Windows desktop or server is in scope. The flaw was exploited as a zero-day by the FruityArmor APT in targeted attacks in the Middle East, disclosed and patched in Microsoft's October 2018 Patch Tuesday, and has public proof-of-concept code. It is confirmed exploited in the wild: it sits in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-21) with known ransomware use, and EPSS assigns a 70% probability of exploitation within 30 days.

Do: Apply Microsoft's October 2018 (or later) cumulative security updates to all affected Windows 7/8.1/RT 8.1/Windows 10 clients and Windows Server 2008-2019 systems, per the vendor instructions required by CISA's KEV catalog. Prioritize multi-user hosts such as terminal/RDS servers and workstations where users can run untrusted code, since the attack requires local code execution with user interaction. Systems still on Windows 7/8.1 or Server 2008/2008 R2/2012 should be moved to Extended Security Updates or upgraded, and defenders should hunt for signs of FruityArmor-style activity on long-lived unpatched hosts.

CVE-2020-11978 is an OS command injection flaw (CWE-78) in the example DAGs shipped by default with Apache Airflow 1.10.10 and earlier. Any authenticated user can trigger one of these bundled example DAGs and inject arbitrary shell commands, which execute under the account running the Airflow worker or scheduler depending on the executor in use. Successful exploitation gives an attacker remote code execution with those privileges on the workflow infrastructure. Only deployments running Airflow 1.10.10 or below that load the default example DAGs (i.e., load_examples is not set to False in the config) are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-01-18), has public PoCs available, and EPSS assigns a 99.2% probability of exploitation within 30 days, indicating an active exploitation threat.

Do: Upgrade Apache Airflow to a version newer than 1.10.10 per vendor instructions; as an interim mitigation, set load_examples=False in the configuration so the vulnerable example DAGs are not loaded. Verify no example DAGs remain enabled in production, and review command and process history under the airflow worker/scheduler user for signs of exploitation, given the KEV listing and very high EPSS score.

CVE-2020-13671 is a file-upload flaw in Drupal core: improper sanitization of uploaded file names and their extensions allows a submitted file to bypass the allowed-extension checks (CWE-434, Unrestricted Upload of File with Dangerous Type). It is triggered when a user with upload privileges submits a crafted file name (for example, one carrying a dangerous or double extension) through any Drupal form or API path that stores uploaded files. An attacker gains the ability to plant arbitrary files on the server, and on sites where the web server executes uploaded files this can escalate to full remote code execution and site compromise. Any site running an affected release of Drupal core is exposed; the provided data lists 'Drupal core' as the affected product without enumerating version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-18, confirming exploitation in the wild (ransomware use unknown), and EPSS assigns a 35.4% probability of exploitation within 30 days.

Do: Update Drupal core to the patched release specified in the vendor's security advisory (CISA required action: apply updates per vendor instructions). Until patched, restrict which roles can upload files, enforce strict allowed-extension lists, and ensure the public upload directory is configured so the web server does not execute uploaded files as scripts. Given the KEV listing, inspect upload directories and web logs for unexpected files or web shells.

Apache Airflow versions before 1.10.11 shipped with an insecure default for its Experimental API, which accepted all incoming requests with no authentication (CWE-306). An attacker who can reach the API over the network exploits it simply by sending unauthenticated requests — no credentials, special conditions, or user interaction are required. Successful abuse grants full unauthenticated access to the Experimental API's endpoints, and the two public PoCs demonstrate that on Airflow 1.10.10 this unauthenticated access leads to remote code execution. Any Airflow deployment predating 1.10.11 is affected, and even instances upgraded to 1.10.11 or later can remain exposed if they retained the old permissive API configuration, since the new deny-all default only protects fresh installs. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-01-18, and EPSS assigns a 99.8% probability of exploitation within 30 days.

Do: Upgrade to Apache Airflow 1.10.11 or later and, critically, set [api] auth_backend = airflow.api.auth.backend.deny_all (or another authenticating backend) in airflow.cfg on existing installs, since upgrading alone does not fix retained configurations. Restrict network access to the Airflow webserver/API and verify the Experimental API cannot be reached without credentials. Per CISA's KEV required action, apply updates per vendor instructions.

Oracle Business Intelligence Enterprise Edition (OBIEE) contains a path traversal flaw (CWE-22) in its Installation component, affecting versions 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. An unauthenticated attacker with network access over HTTP can send crafted requests containing directory traversal sequences to reach files or data outside the intended path. Successful exploitation results in unauthorized access to critical data, potentially all OBIEE-accessible data, with confidentiality-only impact per the CVSS vector (C:H/I:N/A:N). The vulnerability is easily exploitable and requires no privileges or user interaction. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-18, confirming exploitation in the wild, and EPSS assigns a 97.2% probability of exploitation within 30 days, although no public proof-of-concept is known.

Do: Apply Oracle's October 2020 Critical Patch Update (or a later CPU) for OBIEE 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0, as required by the CISA KEV catalog action. Until patched, restrict HTTP access to OBIEE servers to trusted networks and review access logs for directory traversal patterns. Because exploitation is confirmed in the wild, prioritize internet-exposed BI instances and verify no unauthorized data access has occurred.

The systeminformation npm package, a widely used Node.js library for retrieving hardware, system, and OS details, contains a command injection flaw (CWE-78) in versions before 5.3.1. The flaw is triggered when untrusted, user-controlled parameters are passed to functions such as si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), allowing injected commands to be executed by the underlying operating system. A successful attacker gains the ability to run arbitrary commands with the privileges of the Node.js process on the affected host, potentially enabling further compromise. Any application or service built on the npm package that forwards attacker-influenced input into these functions is affected, including deployments where the library is bundled into other products (e.g., Apache Cordova applications per the CPE data). The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-01-18, indicating exploitation in the wild, and its EPSS score of 90.7% places it in the top percentile for near-term exploitation probability.

Do: Upgrade the systeminformation npm package to version 5.3.1 or later wherever it appears in your Node.js dependency trees. If upgrading is not immediately possible, sanitize all parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), accepting only plain strings and rejecting arrays. Audit internet-facing Node.js applications (including any Cordova-packaged deployments) for use of these functions and confirm they are patched, per the CISA KEV required action.

CVE-2021-21975 is a server-side request forgery (CWE-918) in the vRealize Operations Manager API affecting versions prior to 8.4. A malicious actor with network access to the vRealize Operations Manager API endpoint can trigger the flaw without authentication or user interaction, causing the server to make attacker-influenced requests. Successful abuse lets the attacker steal administrative credentials for vRealize Operations Manager; a public proof-of-concept additionally demonstrates chaining the SSRF into code execution. Organizations running vRealize Operations Manager on-premises, including VMware Cloud Foundation and vRealize Suite Lifecycle Manager deployments that include it, are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-01-18) with known ransomware use and carries a very high EPSS score of 78.3%, indicating active, widespread exploitation.

Do: Upgrade vRealize Operations Manager to version 8.4 or later (or apply the update in the bundled Cloud Foundation / vRealize Suite Lifecycle Manager releases per VMware's advisory instructions), as required by CISA's KEV listing. Restrict network access to the vRealize Operations Manager API to trusted management networks until patched, and review logs for signs of SSRF-driven requests or unauthorized use of stolen administrative credentials, given the known ransomware exploitation.

CVE-2021-22991 is a buffer overflow (CWE-119) in the URI normalization routine of F5 BIG-IP's Traffic Management Microkernel (TMM), the core component that processes traffic for all BIG-IP modules. It is triggered when undisclosed requests sent to a virtual server are incorrectly handled by TMM, causing a buffer overflow that typically results in a denial-of-service; in certain situations it may theoretically allow bypass of URL-based access controls or remote code execution. An unauthenticated, remote attacker (AV:N/PR:N/UI:N, CVSS 9.8) can reach the flaw simply by sending crafted requests to an affected virtual server. Organizations running BIG-IP versions 16.0.x, 15.1.x, 14.1.x, 13.1.x, or 12.1.x prior to the fixed releases are affected, including all listed BIG-IP modules (LTM, DNS, ASM, APM, AFM, AWAF, and others); versions past End of Software Development are not evaluated. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-01-18, and EPSS places it in the 99th percentile (61.1% chance of exploitation within 30 days), though no public PoC is known.

Do: Upgrade affected BIG-IP systems to 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, or 12.1.5.3 (or later) as applicable, per the vendor's instructions, as this is a CISA KEV requirement. Audit virtual servers exposed to untrusted traffic, since crafted requests to a virtual server are the trigger, and note that any BIG-IP modules on End-of-Software-Development branches are not evaluated and should be migrated. Because impact can include traffic-handling DoS and, in some situations, URL-based access control bypass or RCE, treat internet-facing BIG-IP appliances as priority targets for patching.

CVE-2021-25298 is an OS command injection flaw (CWE-78) in Nagios XI version xi-5.7.5, located in /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. Because user-controlled input is not properly sanitized before being passed to the operating system, an authenticated user with low privileges can trigger the flaw with a single crafted HTTP request to the cloud-vm configuration wizard. Successful exploitation results in arbitrary OS command execution on the Nagios XI server, giving the attacker code execution on the monitoring host with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8). Any organization running Nagios XI 5.7.5 is affected, especially deployments whose web interface is reachable by untrusted or low-privileged users. The flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-01-18), has multiple public PoC exploits and a Metasploit module, and EPSS estimates a 75.1% probability of exploitation within 30 days.

Do: Apply the vendor's update per CISA KEV required action by upgrading Nagios XI from 5.7.5 to a patched release (a version newer than 5.7.5) as soon as possible; as an interim mitigation, restrict access to the Nagios XI web interface, require strong authentication, and disable or remove the cloud-vm configuration wizard if it is unused. Hunt for compromise by reviewing logs for unexpected OS commands spawned by the Nagios XI web process via the cloud-vm wizard endpoint and for anomalous outbound connections from monitoring servers.

October CMS, a content management system built on the Laravel PHP framework, contains an improper authentication flaw (CWE-287) in its october/system package: an attacker can initiate a password reset for any account and then submit a specially crafted request that bypasses the reset-code check, gaining access to that account without knowing the current password. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1: 9.1, critical), and takeover of a back-end administrator account would grant the attacker full control of the CMS's content, users, and configuration. Any October CMS deployment running october/system versions prior to Build 472 or v1.1.5 is affected. Exploitation is confirmed in the wild: CISA added CVE-2021-32648 to its Known Exploited Vulnerabilities Catalog on 2022-01-18 as part of a batch of 17 added flaws, requiring patching per vendor instructions, and EPSS assigns a 90.4% probability of exploitation within 30 days (100th percentile). CISA lists ransomware use as unknown, and no public proof-of-concept exploit is known.

Do: Update October CMS to Build 472 or v1.1.5 (or later) following the vendor's update instructions; because the flaw is in CISA's KEV, patching is required for federal agencies. Organizations that cannot patch immediately should restrict network access to the CMS back end and audit recent password-reset requests, back-end logins, and account modifications for signs of takeover, rotating credentials for any accounts with unexpected resets.

CVE-2021-33766, publicly known as 'ProxyToken', is an information disclosure vulnerability caused by an authentication bypass in the Exchange Control Panel (ECP) of Microsoft Exchange Server. An unauthenticated attacker sends specially crafted requests to the exposed ECP endpoint that abuse Exchange's default authentication-token handling in its proxy layer, so the backend treats the request as an authenticated session for another user's mailbox. The attacker gains access to victims' mailboxes — reading emails — and, as the related reporting notes, can reconfigure mailbox/server settings such as adding delegates or forwarding rules. Organizations running affected on-premises Exchange servers (Exchange Server 2016 and 2019 per Microsoft's advisory) with ECP/OWA exposed are affected; the cloud-hosted Exchange Online service is not. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2022-01-18 and EPSS estimates a 98.1% probability of exploitation within 30 days, though no public proof-of-concept is cataloged and ransomware use is unknown.

Do: Apply the July 2021 security updates — or any later cumulative or security update — for Exchange Server 2016/2019, per Microsoft's instructions and CISA's KEV required action. Until patched, limit internet exposure of ECP/OWA and review mailbox audit logs, delegate assignments, and inbox forwarding rules for signs of tampering, since ProxyToken has been used to read mail and reconfigure mailboxes.

CVE-2021-35247 is an improper input validation flaw (CWE-20) in the SolarWinds Serv-U web login screen's LDAP authentication path, where submitted characters are not sufficiently sanitized before being passed to the LDAP server. It is triggered remotely over the network with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), by sending crafted, non-sanitized characters through the login-to-LDAP flow; SolarWinds notes that LDAP servers ignored the improper characters and no downstream effect was detected, and the 5.3 (medium) CVSS score reflects a low integrity impact with no confidentiality or availability impact. An attacker gains the ability to feed unsanitized input into the LDAP authentication process; no confirmed code execution or full compromise is documented for this specific bug, but it is nevertheless on CISA's Known Exploited Vulnerabilities catalog. Affected organizations are those running SolarWinds Serv-U whose web login screen uses LDAP authentication. Exploitation is confirmed in the wild: CISA added the bug to the KEV catalog on 2022-01-21, Microsoft warned that threat actors attempted to exploit the Serv-U bug in real-world attacks, and reporting on this flaw surfaced alongside the Log4j (Log4Shell) attack wave targeting SolarWinds products.

Do: Schedule an upgrade to the latest SolarWinds Serv-U release, which adds the required input validation and sanitization to the LDAP login path; this is the CISA KEV required action, so KEV deadlines apply. Until patched, restrict access to the Serv-U web login from untrusted networks and review LDAP/authentication logs for suspicious or malformed login input. While updating, also confirm Serv-U is patched for the related critical Serv-U 15.5 root code execution flaws and any Log4j exposure covered in the same reporting cycle.

CVE-2021-40870 is an unrestricted file-upload flaw (CWE-23) in the Aviatrix Controller, affecting 6.x releases before 6.5-1804.1922, which scores a critical 9.8 because it requires no authentication, no user interaction, and is reachable over the network. An unauthenticated attacker sends a crafted upload request whose filename or path includes directory-traversal sequences and a dangerous file type, letting them write files outside the intended directory — including executable content — onto the controller host. Successful exploitation yields arbitrary code execution on the controller, the central management component of Aviatrix's cloud networking platform, which could give an attacker control of network orchestration and a foothold to pivot into connected cloud and on-premises environments. Any organization running an affected Aviatrix Controller version is at risk, with the highest exposure where the controller's management interface is reachable from the internet. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-01-18, public proof-of-concept code exists, and EPSS estimates a 93% probability of exploitation within 30 days.

Do: Upgrade the Aviatrix Controller to 6.5-1804.1922 or later per the vendor's instructions, as required by CISA's KEV catalog. Until patched, restrict access to the controller's management interface (firewall/allow-list, VPN, or keep it off the public internet) and review the host for signs of compromise such as unexpected uploaded files, web shells, or unfamiliar processes, since ransomware use remains unknown.