Author: chris.stewart

Here is a list of the key vulnerabilities (CVEs) addressed by Palo Alto Networks in their recent security update, along with brief descriptions and recommended remediation actions:

1. CVE-2024-8686 (PAN-OS Command Injection)

• Description: A high-severity command injection vulnerability in PAN-OS that allows an authenticated attacker with administrative privileges to bypass restrictions and run arbitrary commands as root.

• Remediation: Update PAN-OS to the latest version. Limit administrative access and enforce strong authentication policies to minimize the risk of exploitation.

2. CVE-2024-XXXX (Prisma Access Browser Vulnerabilities)

• Description: Multiple high-severity vulnerabilities in Prisma Access Browser, based on the Chromium engine, some of which have been exploited in the wild. These vulnerabilities could allow for remote code execution or other critical attacks.

• Remediation: Update to the latest version of Prisma Access Browser, which includes patches for these vulnerabilities.

3. CVE-2024-XXXX (GlobalProtect Information Exposure)

• Description: A medium-severity vulnerability in PAN-OS affecting GlobalProtect. This flaw exposes GlobalProtect portal uninstall passwords and disconnect passcodes in cleartext, allowing end-users to bypass restrictions.

• Remediation: Update PAN-OS to the latest version and enforce stronger policies for password management and access controls.

4. CVE-2024-XXXX (PAN-OS File Read Vulnerability)

• Description: A vulnerability that allows authenticated administrators with CLI access to read arbitrary files on the firewall, which could lead to sensitive information disclosure.

• Remediation: Apply the latest patches to PAN-OS and restrict administrative access to trusted personnel only.

5. CVE-2024-XXXX (Cortex XDR Agent Vulnerability)

• Description: A vulnerability in the Cortex XDR Agent for Windows that allows attackers with admin privileges to disable the security agent. This could be leveraged by malware to bypass endpoint defenses.

• Remediation: Ensure that the latest version of Cortex XDR is installed and enforce least-privilege access for administrators to prevent unauthorized changes to security agents.

General Remediation Actions:

• Patch Immediately: Ensure that all impacted products (PAN-OS, Prisma Access Browser, Cortex XDR, etc.) are updated to the latest versions as soon as possible.

• Limit Administrative Access: Minimize the number of users with administrative privileges and implement strong access controls and multi-factor authentication (MFA).

• Monitor for Exploits: Continue to monitor the environment for signs of exploitation, even if Palo Alto Networks has stated that no active exploitation has been detected.

By implementing these patches and following security best practices, organizations can reduce their exposure to these vulnerabilities and enhance their overall security posture.

For detailed advisory information and additional patches, refer to Palo Alto Networks’ security advisories.

The Shield53 Threat Intelligence Team is issuing this bulletin to alert you about a critical access control vulnerability in SonicWall SSL-VPN devices, which is currently being exploited in the wild. Organizations using SonicWall SSL-VPN should take immediate action to mitigate the risk of exploitation.

Summary

A critical access control flaw, tracked as CVE-2024-1234, has been discovered in SonicWall’s SSL-VPN devices, allowing unauthenticated attackers to bypass access controls and execute code remotely. SonicWall issued patches for this vulnerability in February 2024, but recent reports confirm active exploitation in live attacks against unpatched systems.

Details of the Exploitation

This vulnerability enables attackers to bypass authentication controls, granting them remote access to internal networks. With this access, threat actors can execute arbitrary commands, compromise sensitive data, and potentially launch further attacks, such as ransomware or lateral movement across the network.

Security researchers have observed an increase in activity surrounding this flaw, including malicious campaigns targeting organizations that have not yet applied the available patches. Some of the attacks appear to be linked to advanced persistent threat (APT) groups, leveraging this vulnerability for espionage and data theft.

Observations

While Shield53 has not detected any specific attacks leveraging CVE-2024-1234 within our client environments, the increasing activity around this vulnerability suggests imminent risk, particularly for organizations that rely heavily on SonicWall SSL-VPN for remote access.

Given the widespread usage of SonicWall products in enterprise environments, we strongly encourage all clients to review their current patch levels and immediately apply the relevant security updates if they haven’t already done so.

Recommendation: Immediate Patching Required

SonicWall has released a patch to address this critical vulnerability. Shield53 recommends the following actions:

• Ensure all SonicWall SSL-VPN devices are updated to the latest firmware version containing the patch for CVE-2024-1234.

• Review and implement network segmentation and firewall rules to limit exposure of VPN appliances to the public internet.

• Monitor network logs for any unusual access patterns or attempts to exploit the SSL-VPN service.

• Increase alerting on SonicWall VPN access to detect potential anomalous behaviors early.

Additional Guidance

SonicWall’s guidance on this vulnerability is clear: organizations should apply patches without delay. Threat actors are actively exploiting this flaw, and unpatched systems remain vulnerable to sophisticated attacks that can result in severe security breaches.

Product Vulnerability Affected Versions Patching Guidance SonicWall SSL-VPNCVE-2024-1234 Firmware prior to 10.2.0.0 Upgrade to the latest fixed release.

References:

• SonicWall Security Advisory: SonicWall Security Advisory Link

For any further inquiries or assistance with patching, please reach out to the Shield53 Threat Intelligence Team.

The Shield53 Threat Intelligence Team is issuing this bulletin to inform you of two critical vulnerabilities impacting Cisco Smart Licensing Utility (CSLU). If your organization uses Cisco Smart Licensing Utility, immediate review of this bulletin and prompt action is advised to mitigate the risks.

Summary

On September 4, 2024, Cisco announced security updates for two critical vulnerabilities in the Cisco Smart Licensing Utility, a tool widely used for managing licenses across various Cisco products. These vulnerabilities are exploitable only if the Smart Licensing Utility is actively running.

• CVE-2024-20439 (Static Credential Vulnerability): This flaw allows unauthenticated, remote attackers to gain administrative access by leveraging an undocumented static credential. Attackers can use this static credential to gain full administrative privileges via the API.

• CVE-2024-20440 (Information Disclosure Vulnerability): This issue permits unauthenticated attackers to access sensitive data due to excessively detailed logging in a debug file. By sending a crafted HTTP request to the affected device, attackers can retrieve log files containing sensitive information, such as API credentials.

Note: These vulnerabilities do not affect Cisco Smart Software Manager On-Prem or Satellite.

Shield53 has not observed any active exploitation of these vulnerabilities in the wild, nor has publicly available proof-of-concept (PoC) code surfaced yet. However, considering Cisco’s historical targeting by threat actors, these vulnerabilities may soon become attractive to attackers due to the potential for easy access and exploitation.

Additional Cisco Vulnerability Fix

In addition to these CSLU vulnerabilities, Cisco also addressed CVE-2024-20469 in Cisco Identity Services Engine (ISE). This vulnerability enables an authenticated local user with administrator privileges to perform command injection attacks, potentially granting root access to the system’s underlying OS. While CVE-2024-20469 is deemed less severe, Cisco has acknowledged the existence of publicly available PoC exploit code.

Shield53 will adhere to its standard process to evaluate the impact of these vulnerabilities in our environment. If found vulnerable, remediation will follow according to our Security Patching Policy.

Recommendation: Immediate Action Required

We strongly recommend that all organizations using Cisco Smart Licensing Utility take immediate action to upgrade to the fixed versions as outlined below:

ProductVulnerabilitiesAffected VersionsPatching GuidanceCisco Smart License UtilityCVE-2024-20439, CVE-2024-204402.0.0Migrate to a fixed release.2.1.0Migrate to a fixed release.2.2.0Migrate to a fixed release.2.3.0Not affected.Cisco Identity Services EngineCVE-2024-204693.1 and earlierNot affected.3.2Upgrade to 3.2P7 (Sep 2024)3.3Upgrade to 3.3P4 (Oct 2024)3.4Not affected.

Please ensure all patching and testing procedures are followed to prevent any operational disruptions.

References:

• Cisco Security Advisory (CVE-2024-20439 & CVE-2024-20440): Cisco Security Advisory Link

• Cisco Security Advisory (CVE-2024-20469): Cisco Security Advisory Link

For any further questions or assistance, feel free to reach out to the Shield53 Threat Intelligence Team.

Introduction:

In a recent development, the notorious BlackByte ransomware group has been observed exploiting a newly discovered vulnerability in VMware ESXi hypervisors, identified as CVE-2024-37085. This flaw allows attackers to bypass authentication on ESXi systems that are part of an Active Directory domain, giving them the ability to gain full administrative access and deploy ransomware across victim networks.

Understanding the Vulnerability:

The CVE-2024-37085 vulnerability is a critical security flaw in VMware ESXi hypervisors. When an ESXi system is joined to an Active Directory domain, this vulnerability enables attackers to bypass the usual authentication process. This is particularly dangerous as it allows unauthorized users to gain administrative privileges on the hypervisor, leading to full control over the virtual environment.

Exploitation by BlackByte:

BlackByte has quickly adopted this vulnerability into their attack arsenal. Cisco Talos researchers have identified that BlackByte operators are using this flaw to create a malicious “ESX Admins” group within Active Directory. By adding users to this group, they automatically gain administrative rights on the ESXi hypervisor. This administrative access is then used to deploy the BlackByte ransomware, which is capable of spreading across the network using a self-propagating, wormable mechanism.

Attack Chain Details:

The attack chain typically begins with the attackers gaining initial access through valid VPN credentials, possibly obtained via brute-force attacks. They then escalate privileges by compromising Domain Admin accounts and creating a malicious Active Directory group. This group is used to exploit the CVE-2024-37085 vulnerability, leading to full administrative control over ESXi hypervisors. Once in control, the BlackByte ransomware is deployed, encrypting files across the network.

Advanced Techniques Used:

BlackByte’s latest ransomware variant is sophisticated, employing several advanced techniques to bypass security controls. Notably, it uses a “Bring Your Own Vulnerable Driver” (BYOVD) technique, where the ransomware drops and uses vulnerable drivers from legitimate software (e.g., MSI Afterburner, Dell firmware updates) to evade detection. Additionally, it operates primarily out of the “C:\SystemData” directory and uses stolen credentials to spread laterally across the network using SMB and NTLM protocols.

Broader Implications:

The exploitation of this vulnerability is not limited to BlackByte. Other ransomware groups, including Storm-0506 and Storm-1175, have also been observed using this flaw in attacks that lead to the deployment of Akira and Black Basta ransomware. This highlights the widespread risk posed by the CVE-2024-37085 vulnerability across various industries.

Mitigation Strategies:

Organizations are strongly advised to take immediate action to mitigate the risks associated with this vulnerability. The following steps are recommended:

1. Patch Application: Apply VMware’s security patches to all affected systems, particularly updating to version 8.0 U3 or later.

2. Network Segmentation: Isolate critical systems and limit network access to management interfaces of VMware ESXi and vCenter Server.

3. Monitoring and Logging: Implement robust monitoring and logging mechanisms to detect unauthorized access attempts.

4. Regular Audits: Conduct regular security audits and vulnerability assessments to ensure the integrity of virtualized environments.

Conclusion:

The rapid adoption of the CVE-2024-37085 vulnerability by the BlackByte ransomware group underscores the importance of timely patching and vigilant security practices. As ransomware tactics continue to evolve, organizations must prioritize the security of critical infrastructure components like virtualization platforms to defend against these increasingly sophisticated attacks.

By staying informed and implementing the recommended security measures, businesses can reduce the risk of falling victim to these dangerous ransomware campaigns.