CISA adds flaw in Citrix ShareFile to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-24489 | Unauthenticated RCE in Citrix ShareFile Storage Zones Controller (CVE-2023-24489) CVE-2023-24489 is an improper access control flaw (CWE-284), rated critical at CVSS 9.8, in the customer-managed Citrix Content Collaboration ShareFile storage zones controller. It can be triggered remotely over the network by an unauthenticated attacker with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N). A successful attack allows the attacker to remotely compromise the customer-managed storage zones controller — described in vendor-adjacent coverage as remote code execution — giving control of the server that stores and syncs that organization's ShareFile files. Only organizations that self-host customer-managed storage zones controllers are affected; the vendor-managed (cloud) ShareFile service is not listed as affected. The flaw is being actively exploited in the wild: CISA added it to the KEV catalog on 2023-08-16, EPSS assigns a 97.3% probability of exploitation within 30 days (100th percentile), and the vendor urged customers to shut down or take unpatched controllers offline; ransomware use is not yet confirmed. Do: Apply the fix specified in the Citrix/ShareFile security bulletin by upgrading every customer-managed storage zones controller to the vendor's patched release, and follow vendor guidance to shut down or take offline any controller that cannot be patched immediately. Check whether controllers are internet-exposed and hunt for signs of compromise (unexpected files, processes, or webshells on storage zones), since the flaw is in the KEV catalog and ransomware use has not been ruled out. | 9.8 | 97% | KEV |
| moderate≈ thousands of internet-exposed customer-managed storage zone controllers (order-of-magnitude estimate) |
Full article755 words · extracted from securityaffairs.com · click to collapse
US CISA added critical vulnerability CVE-2023-24489 in Citrix ShareFile to its Known Exploited Vulnerabilities catalog.
US Cybersecurity and Infrastructure Security Agency (CISA) added critical flaw CVE-2023-24489 (CVSS score 9.8) affecting Citrix ShareFile to its Known Exploited Vulnerabilities Catalog.
Citrix ShareFile is a secure file sharing and storage platform designed for businesses and professionals to collaborate on documents, exchange files, and manage content in a secure and efficient manner.
Citrix Content Collaboration is affected by an improper access control issue that can allow a remote, unauthenticated attacker to compromise customer-managed ShareFile storage zones controllers
Citrix addressed the vulnerability in June 2023 with the release of version 5.11.24.
“A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.” the company said in an advisory. “This vulnerability affects all currently supported versions of customer-managed ShareFile storage zones controller before version 5.11.24.”
Researchers from threat intelligence firm Greynoise warned at the end of July of the first attempts to exploit the vulnerability in Citrix ShareFile.
“Attackers can exploit this vulnerability by taking advantage of errors in ShareFile’s handling of cryptographic operations. The application uses AES encryption with CBC mode and PKCS7 padding but does not correctly validate decrypted data.” states Greynoise. “This oversight allows attackers to generate valid padding and execute their attack, leading to unauthenticated arbitrary file upload and remote code execution.”
“As of the publishing timestamp of this post, GreyNoise has observed IPs attempting to exploit this vulnerability. Two have never seen GreyNoise before this activity” adds GreyNoise.
Researchers at the cybersecurity firm Assetnote published technical details of the vulnerability and published proof-of-concept (PoC) code for this flaw.
“A search online shows roughly 1000-6000 instances are internet accessible. This popularity, combined with the software being used to store sensitive data, meant if we found anything it could have quite an impact.” reads the analysis published by Assetnote.
Other PoC exploits have been published online, for this reason, experts warn that the number of attacks exploiting this issue will rapidly increase in the forthcoming days.
“we saw how a few small errors in ShareFile lead to an unauthenticated file upload and then remote code execution. Although the particular endpoint is not enabled in all configurations, it has been common amongst the hosts we have tested.” concludes Assetnote. “Given the number of instances online and the reliability of the exploit, we have already seen a big impact from this vulnerability.”
GreyNoisesearchers reported a huge spike in exploit activity today.
⚠️ We are continuing to monitor CVE-2023-24489 (Citrix ShareFile RCE) exploit activity closely. All flagged IPs are marked malicious. There's been a huge spike in activity today. Make sure your systems are up to date with the latest patches. pic.twitter.com/AlgCE57QH6
— GreyNoise (@GreyNoiseIO) August 16, 2023
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this flaw by September 6, 2023.
Update August 16, 2023
The company contacted Security Affairs to provide the following update:
- Timeline:
- A fix for CVE-2023-24489 was released on May 11, 2023 with Version 5.11.24 (one month before the security bulletin was issued).
- Customer patching was proactively handled and, by June 13, over 83% of these customers had patched their environments, before the incident was made public. Also, by June 13, all unpatched SZC hosts were blocked from connecting to the ShareFile cloud control plane, making unpatched SZC hosts unusable with ShareFile.
- On Aug. 16, CISA added the CVE to their known exploited vulnerability catalog; while there was a spike to 75 attacks following this, this died down immediately given that the issue has been addressed.
- Impact of Incident:
- When this vulnerability was discovered, we worked with and notified impacted customers in advance of the announced CVE to update to the latest version of our software to assure the safety of their data. Our control plane is no longer connected to any ShareFile StorageZones Controller (SZC) that is not patched.
- The incident affected less than 3% of our install base (2800 customers)
- There is no known data theft from this incident
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/149578/hacking/citrix-sharefile-known-exploited-vulnerabilities-catalog.html