CISA Adds 10 New Known Actively Exploited Vulnerabilities to its Catalog

PEAR's Archive_Tar library through version 1.4.10 sanitizes archive filenames only against phar:// stream-wrapper attacks, leaving all other PHP stream wrappers open to abuse; an attacker who controls an archive's filename can, for example, use the file:// wrapper to write files outside the intended directory. The flaw is triggered whenever a vulnerable application creates or extracts an archive using an attacker-influenced filename, as in Drupal core, which shipped emergency out-of-band updates because the file-write primitive allowed arbitrary PHP code execution. An attacker gains arbitrary file overwrite, and in web application contexts such as Drupal this can escalate to remote code execution by writing executable PHP into the web root. Any PHP application using the library is affected, including Drupal core and the Archive_Tar packages shipped by Debian and Fedora. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-08-25), carries a very high 84.6% EPSS probability of exploitation within 30 days, and public proof-of-concept exploits are available.

Do: Upgrade Archive_Tar to a version after 1.4.10 (1.4.11 fixes this flaw) and apply the emergency Drupal core security updates or the corresponding Debian/Fedora package updates per vendor instructions. Audit any application that passes attacker-controlled filenames or paths to Archive_Tar and consider rejecting or strictly validating filenames containing stream wrappers (e.g., '://'). Because this flaw is in CISA's Known Exploited Vulnerabilities Catalog, patch promptly to meet the catalog's required action deadlines.

PEAR Archive_Tar through 1.4.11 mishandles symbolic links when unpacking archives, allowing write operations with directory traversal (CWE-22/CWE-59; a related issue to CVE-2020-28948). An attacker who can get a vulnerable application to extract a crafted .tar archive can slip symlinks past the checks in Tar.php and write files outside the intended extraction directory with the privileges of the PHP process, an arbitrary file-write condition with high integrity impact and the potential for supply-chain-style compromise given how widely the library is embedded. Anyone running PHP applications that use Archive_Tar to unpack user-supplied archives is affected, including Drupal, which bundles the library, plus systems with the library packaged in Debian or Fedora. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-08-25, and EPSS estimates a ~71% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, but KEV listing confirms observed exploitation in the wild.

Do: Upgrade PEAR Archive_Tar to 1.4.12 or later (the first release after the affected range through 1.4.11) and pull in the corresponding updates from Debian, Fedora, and Drupal per vendor advisories. Audit whether your PHP applications extract user-supplied .tar archives via Archive_Tar and, until patched, restrict or validate symlink handling in extraction paths. This vulnerability is on CISA's KEV list, so apply the required vendor updates promptly.

CVE-2021-30858 is a use-after-free memory corruption flaw (CWE-416) in the web content processing component (WebKit) of Apple iOS, iPadOS, and macOS, which Apple addressed with improved memory management. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting or being redirected to an attacker-controlled site, and successful exploitation leads to arbitrary code execution on the victim's device (CVSS 3.1: 8.8 High, network vector with user interaction required). Anyone running affected builds of iOS, iPadOS, or macOS, or the affected component on Fedora or Debian Linux per the CPE data, is exposed, since virtually all Apple devices process web content by default. Apple acknowledged that the flaw was being actively exploited, reportedly as part of NSO Group's 'ForcedEntry' targeted zero-day espionage chain, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. No public proof-of-concept is known, but the confirmed in-the-wild use makes rapid patching urgent.

Do: Update iPhones and iPads to iOS/iPadOS 14.8 and Macs to macOS Big Sur 11.6 immediately, and on Fedora or Debian apply the distribution's updated WebKit packages. Use MDM or inventory data to confirm no managed devices remain on pre-patch builds, since the flaw was exploited as a zero-day in targeted espionage operations. This is a CISA KEV entry (added 2021-11-03), so the catalog's required action of applying vendor updates is mandatory for federal agencies and strongly recommended for everyone else.

CVE-2021-30860 is an integer overflow (CWE-190) in PDF processing across Apple's platforms that was addressed with improved input validation. It is triggered when a device processes a maliciously crafted PDF — notably when a PDF is rendered after being received via messaging — and successful exploitation allows arbitrary code execution in the context of the PDF renderer. Affected products include iOS/iPadOS, macOS (Big Sur and Catalina), and watchOS, as well as the Xpdf and Poppler PDF libraries, which share lineage with the vulnerable code. Apple confirmed the issue was being actively exploited in the wild, and public reporting ties it to NSO Group's 'ForcedEntry' exploit chain used to deliver Pegasus spyware; CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. Given the very high EPSS score (76%, 99th percentile) and confirmed active exploitation, defenders should treat this as a high-priority patch.

Do: Update iPhones/iPads to iOS/iPadOS 14.8, Macs to macOS Big Sur 11.6 (or apply Security Update 2021-005 Catalina), and Apple Watch to watchOS 7.6.2 immediately, and patch Poppler/Xpdf through distribution or vendor updates. Because the flaw was exploited via crafted PDFs delivered through messaging (ForcedEntry/Pegasus), organizations and individuals at risk of targeted spyware should also review devices for signs of compromise. CISA KEV requires applying updates per vendor instructions; prioritize internet-connected and high-value user endpoints.

CVE-2021-31010 is a deserialization flaw (CWE-502) in Apple's operating system components that allows a sandboxed process to circumvent the app sandbox restrictions. The CVSS vector (AV:N, no privileges, no user interaction) indicates the vulnerable deserialization path is reachable over the network, and Apple addressed it with improved validation of deserialized data. A successful attacker gains high integrity impact outside the sandbox (CVSS 7.5), a capability that is typically valuable as the second stage of an exploit chain after initial code execution rather than as a standalone bug. Affected users include iPhone and iPad users on iOS/iPadOS prior to 14.8 (or 12.5.5 on older devices), Macs on Catalina or Big Sur prior to the September 2021 updates, and Apple Watch on watchOS prior to 7.6.2. Apple reported the issue may have been actively exploited at the time of release, and CISA confirmed in-the-wild exploitation by adding it to the Known Exploited Vulnerabilities Catalog on 2022-08-25; EPSS currently estimates a 3.7% chance of exploitation in the next 30 days (89th percentile).

Do: Update iPhones and iPads to iOS/iPadOS 14.8 (or iOS 12.5.5 on devices that cannot run iOS 14), apply macOS Big Sur 11.6 or Security Update 2021-005 Catalina on Macs, and update Apple Watch to watchOS 7.6.2. Treat remediation as a priority per the CISA KEV required action, especially on internet-facing Macs and managed fleets, since a sandbox escape like this is most useful chained with another flaw. No public PoC is known; verify deployed builds via OS version reporting in your device management tooling.

Delta Electronics DOPSoft 2 (version 2.00.07 and prior) fails to properly validate user-supplied data when parsing project files, resulting in multiple out-of-bounds write vulnerabilities (CWE-787). Because the flaw requires local access and user interaction, exploitation typically involves tricking an engineer or operator into opening a maliciously crafted DOPSoft project file. Successful exploitation lets the attacker execute code in the context of the current process, i.e., as the logged-in user of the workstation running DOPSoft, which in OT environments is typically an engineering workstation with access to the control network. Only users still running the end-of-life DOPSoft 2 branch are affected; owners of Delta HMI deployments who have not migrated off this older configuration tool are in scope. The flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-08-25 as part of a batch of 10 additions, confirming active exploitation in the wild, and it carries a very high EPSS score of 76.4% (100th percentile), though no public proof-of-concept is known and ransomware use is unknown.

Do: Inventory engineering, maintenance, and other control-network-connected workstations for DOPSoft 2 (version 2.00.07 or earlier); per CISA's required action, stop using or disconnect the end-of-life DOPSoft 2 and migrate to a currently supported DOPSoft release where configuration software is still needed (no fixed version is specified in the available data). Until remediated, do not open DOPSoft project files from untrusted sources (email, downloads, removable media) on stations that have access to control networks.

Grafana contains an authentication bypass (CWE-287) in its handling of dashboard snapshot data, allowing both authenticated and unauthenticated users to access snapshot endpoints without proper authorization. An attacker can trigger the flaw by sending crafted requests to the snapshot API without valid credentials. Successful exploitation lets the attacker view and delete all snapshot data, potentially resulting in complete loss of saved snapshots, which may destroy evidence of historical dashboard state. Any organization running an affected Grafana release from Grafana Labs is exposed, particularly instances reachable by untrusted users. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-08-25 and carries a 99.9% EPSS probability of exploitation within 30 days.

Do: Apply updates per vendor instructions: upgrade Grafana to a patched release per the Grafana Labs advisory for CVE-2021-39226 and prioritize patching internet-facing instances given KEV listing. As an interim mitigation, restrict unauthenticated access to the snapshot API (e.g., via reverse-proxy access rules) and verify whether snapshots have been viewed or deleted on your instances.

CVE-2022-2294 is a heap buffer overflow (out-of-bounds write, CWE-787) in the WebRTC component used by Google Chrome. A remote attacker can trigger the flaw by luring a user to a crafted HTML page, and successful exploitation allows heap corruption with potential arbitrary code execution (CVSS 3.1: 8.8, high impact on confidentiality, integrity and availability). It affects Chrome prior to 103.0.5060.114 and, because the vulnerable code path resides in the shared WebRTC/WebKit component, it also affects Apple's iPhone OS, iPadOS, macOS/Mac OS X, tvOS and watchOS, WebKitGTK, WPE WebKit, Fedora and Extra Packages for Enterprise Linux (EPEL), and the WebRTC project library itself. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-25 with known ransomware use, and reporting indicates mercenary spyware operators used it as a Chrome zero-day; EPSS places its 30-day exploitation probability at 70.5%. Google fixed the flaw in Chrome 103.0.5060.114, and Apple and the WebKit/WPE maintainers issued their own security updates for affected products.

Do: Upgrade Google Chrome to 103.0.5060.114 or later on all managed and personal endpoints immediately. Apply Apple's released security updates for iPhone OS, iPadOS, macOS, tvOS and watchOS, and updated WebKitGTK, WPE WebKit and Fedora/EPEL packages for WebKit-based deployments. Given the CISA KEV listing, known ransomware use and 70.5% EPSS, prioritize patching and hunt for signs of exploitation (crafted-page lures and any linked spyware or ransomware activity) across browsers and WebKit applications.

VMware Tanzu's Spring Cloud Function contains a remote code execution flaw (CWE-94, expression-language code injection) in its routing functionality. When the routing feature evaluates an attacker-supplied Spring Expression Language (SpEL) routing-expression, a specially crafted expression is processed by the framework, resulting in arbitrary code execution on the server and access to local resources. Any deployment of Spring Cloud Function that evaluates untrusted routing-expressions, typically via exposed application endpoints, is affected. An attacker who can reach such an endpoint gains code execution in the context of the running application, which can lead to data theft, lateral movement, or ransomware. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-08-25 and EPSS rates the 30-day exploitation probability at 99.9% (100th percentile), although no public PoC is cataloged in this data.

Do: Apply the vendor update per VMware/Tanzu instructions immediately, as patching is the required action for this KEV-listed vulnerability. Until patched, prevent untrusted clients from supplying the routing-expression (restrict or disable the routing functionality) and limit network exposure of affected services. Review application logs for unexpected SpEL payloads in routing-expressions and check affected hosts for indicators of compromise, including ransomware staging.

CVE-2022-24112 is a client IP validation flaw (CWE-290) in the batch-requests plugin of Apache APISIX: the plugin is supposed to override the client IP with the real remote IP, but due to a coding bug this check can be bypassed, allowing an attacker to send requests that evade the IP restrictions protecting the Admin API. A remote, unauthenticated attacker sends crafted requests through the batch-requests endpoint to reach the otherwise IP-restricted Admin API or data panel. With a default APISIX configuration (default admin API key), this grants access that leads directly to remote code execution; if the admin key was changed or the Admin API runs on a different port, the attacker still gains unauthorized access to the data panel. Any deployment of Apache APISIX is affected, with default or minimally-hardened configurations facing the highest risk. The vulnerability is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-25, carries a 96% EPSS probability of exploitation within 30 days, and public proof-of-concept exploits are available.

Do: Upgrade Apache APISIX to the latest patched release per vendor instructions, prioritizing internet-facing instances since active exploitation is confirmed. As immediate mitigation, change the default admin API key, restrict access to the Admin API and data panel, and avoid exposing the Admin API port alongside the data panel. Check logs for anomalous requests to the batch-requests endpoint and Admin API routes indicating exploitation attempts.

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

The ContentResource API in dotCMS 3.0 through 22.02 accepts multipart form uploads without sanitizing the submitted filename, allowing directory traversal so the uploaded file is written outside the intended storage location. An attacker triggers this by sending a crafted multipart POST request with traversal sequences embedded in the filename. When anonymous content creation is enabled, the flaw permits a fully unauthenticated attacker to upload an executable file such as a .jsp webshell and achieve remote code execution on the server. All dotCMS deployments running affected versions are exposed, with the highest risk on instances that allow anonymous content creation and expose the ContentResource API to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-25 with known ransomware use, it carries a 91.6% EPSS probability of exploitation, and a public proof of concept is available.

Do: Upgrade every dotCMS deployment in the 3.0–22.02 range to a fixed release per vendor instructions (any version beyond the affected range, e.g., 22.03 or later, or the vendor's patched LTS branch). If patching must wait, disable anonymous content creation, restrict the upload path so files cannot be written into web-executable directories, and audit the web root for unexpected .jsp files. Review access logs for multipart POSTs to the ContentResource API containing traversal sequences in filenames, and confirm remediation via CISA's required-action guidance.