Chinese Hackers Exploited New Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-2868 | Unauthenticated Command Injection in Barracuda Email Security Gateway Appliances via .tar Files CVE-2023-2868 is a critical (CVSS 9.8) remote command injection vulnerability in the Barracuda Email Security Gateway (ESG) appliance form factor (models 300, 400, 600, 800 and 900), caused by incomplete input validation of user-supplied .tar archives, specifically the names of the files contained within them. An attacker can deliver a specially crafted .tar file whose internal file names are formatted so that, when the ESG processes the archive, commands are executed through Perl's qx operator. Successful exploitation yields remote command execution with the privileges of the ESG product, and in the observed campaign attackers deployed a backdoor (reported as "SUBMARINE") and persisted on compromised appliances. Only customers running ESG appliances on versions 5.1.3.001 through 9.2.0.006 are affected. Exploitation is confirmed in the wild — CISA added it to the KEV on 2023-05-26, EPSS puts 30-day exploitation probability at 87.7%, and public reporting attributes active exploitation to a Chinese-nexus espionage group (associated in headlines with Salt Typhoon) targeting government, military, and telecom victims; Barracuda's BNSF-36456 patch was applied automatically to customer appliances. Do: Verify that each ESG appliance received the automatic BNSF-36456 patch (running fixed firmware at or above 9.2.0.006's successor per vendor instructions), and check appliances for indicators of compromise, including unauthorized command activity and the "SUBMARINE" backdoor, using Barracuda's IOC guidance. Because the espionage campaign established persistence, Barracuda urged full replacement rather than patching of compromised appliances; replace any ESG showing signs of compromise and review email logs for malicious .tar attachments. Limit or monitor internet exposure of ESG management interfaces while remediation proceeds. | 9.8 | 88% | KEV |
| largetens of thousands of deployed ESG appliances (public scans show Barracuda ESGs among commonly internet-exposed email security devices); Barracuda's incident… | |
| CVE-2023-7101 | Arbitrary Code Execution in Spreadsheet::ParseExcel Perl Module (CVE-2023-7101) CVE-2023-7101 is an arbitrary code execution flaw in version 0.65 of the Spreadsheet::ParseExcel Perl module, which is used to parse Microsoft Excel files: Excel 'Number format' strings taken from the file are passed into Perl's string-form eval() without validation (CWE-95), so embedded content is evaluated as Perl code. It is triggered whenever an application, script, or appliance using the module processes a maliciously crafted .xls file, meaning exploitation typically requires user interaction (opening or ingesting the file) consistent with the CVSS local-attack/user-interaction vector. A successful attacker gains code execution with the privileges of the process parsing the file, with high impact on confidentiality, integrity, and availability. Anyone running the vulnerable module is affected, including Debian and Fedora users of its packages and operators of products that bundle the library, and the flaw drew wide attention after it was implicated in the Barracuda Email Security Gateway zero-day exploitation attributed to Chinese-nexus hackers. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2024-01-02, confirming exploitation in the wild; EPSS assigns a roughly 19% probability of exploitation in the next 30 days (97th percentile), and no public proof-of-concept is known. Do: Upgrade Spreadsheet::ParseExcel to the vendor-patched release (version 0.65 is cited as vulnerable) via CPAN or by applying updated Debian/Fedora packages, and identify products that bundle the module, such as Barracuda ESG, applying those vendors' fixes per their instructions. Until patched, avoid processing untrusted .xls files with the module or restrict spreadsheet ingestion to trusted sources, and review systems where Perl code parses externally supplied spreadsheets for signs of exploitation. Ransomware linkage is currently unknown, per CISA. | 7.8 | 19% | KEV |
| largetens of thousands to hundreds of thousands of systems (long-standing library shipped in Debian/Fedora package repositories and bundled in third-party products) | |
| CVE-2023-7102 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic. NVD description · AI analysis pending | 9.8 | 45% |
| — |
Full article480 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 27, 2023Zero-Day / Email Security
Barracuda has revealed that Chinese threat actors exploited a new zero-day in its Email Security Gateway (ESG) appliances to deploy backdoors on a "limited number" of devices.
Tracked as CVE-2023-7102, the issue relates to a case of arbitrary code execution that resides within a third-party and open-source library named Spreadsheet::ParseExcel that's used by the Amavis scanner within the gateway to screen Microsoft Excel email attachments for malware.
The company attributed the activity to a threat actor tracked by Google-owned Mandiant as UNC4841, which was previously linked to the active exploitation of another zero-day in Barracuda devices (CVE-2023-2868, CVSS score: 9.8) earlier this year.
Successful exploitation of the new flaw is accomplished by means of a specially crafted Microsoft Excel email attachment. This is followed by the deployment of new variants of known implants called SEASPY and SALTWATER that are equipped to offer persistence and command execution capabilities.
“Once a target receives an email with the malicious Excel attachment from UNC4841, the email is scanned by the Barracuda ESG appliance, thereby executing the malicious code contained in the Excel file,” Austin Larsen, Mandiant senior incident response consultant, said in a statement shared with The Hacker News. “This requires no interaction from an end-user, making it highly impactful and effective.”
Barracuda said it released a security update that has been "automatically applied" on December 21, 2023, and that no further customer action is required.
It further pointed out that it "deployed a patch to remediate compromised ESG appliances which exhibited indicators of compromise related to the newly identified malware variants" a day later. It did not disclose the scale of the compromise.
That said, the original flaw in the Spreadsheet::ParseExcel Perl module (version 0.65) remains unpatched and has been assigned the CVE identifier CVE-2023-7101, necessitating that downstream users take appropriate remedial action.
According to Mandiant, which has been investigating the campaign, a number of private and public sector organizations located in at least 16 countries are estimated to have been impacted since October 2022.
Google Cloud said it observed the exploitation of CVE-2023-7102 targeting high-tech, information technology providers, and government entities, chiefly located in the U.S. and Asia-Pacific regions, no earlier than November 30, 2023.
The latest development once again speaks to UNC4841's adaptability, leveraging new tactics and techniques to retain access to high priority targets as existing loopholes get closed.
“This latest campaign further demonstrates this actor’s persistence from the last UNC4841 campaign,” Larsen said. “Mandiant anticipates this threat actor may broaden their targeted attack surface to other appliances with a greater variety of exploits in the future.”
(The story was updated after publication to include additional commentary from Google Cloud and Mandiant on the campaign.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/12/chinese-hackers-exploited-new-zero-day.html