The U.S. National Security Agency (NSA) on Tuesday said a threat actor tracked as APT5 has been actively exploiting a zero-day flaw in Citrix Application Delivery Controller (ADC) and Gateway to take over affected systems.
The critical remote code execution vulnerability, identified as CVE-2022-27518, could allow an unauthenticated attacker to execute commands remotely on vulnerable devices and

Application Security / Zero-Day

The U.S. National Security Agency (NSA) on Tuesday said a threat actor tracked as APT5 has been actively exploiting a zero-day flaw in Citrix Application Delivery Controller (ADC) and Gateway to take over affected systems.

The critical remote code execution vulnerability, identified as CVE-2022-27518, could allow an unauthenticated attacker to execute commands remotely on vulnerable devices and seize control.

Successful exploitation, however, requires that the Citrix ADC or Citrix Gateway appliance is configured as a SAML service provider (SP) or a SAML identity provider (IdP).

The following supported versions of Citrix ADC and Citrix Gateway are affected by the vulnerability -

*   Citrix ADC and Citrix Gateway 13.0 before 13.0-58.32
*   Citrix ADC and Citrix Gateway 12.1 before 12.1-65.25
*   Citrix ADC 12.1-FIPS before 12.1-55.291
*   Citrix ADC 12.1-NDcPP before 12.1-55.291

Citrix ADC and Citrix Gateway versions 13.1 are not impacted. The company also said there are no workarounds available "beyond disabling SAML authentication or upgrading to a current build."

The virtualization services provider said it's aware of a "small number of targeted attacks in the wild" using the flaw, urging customers to apply the latest patch to unmitigated systems.

APT5, also known as Bronze Fleetwood, Keyhole Panda, Manganese, and UNC2630, is believed to operate on behalf of Chinese interests. Last year, Mandiant revealed espionage activity targeting verticals that aligned with government priorities outlined in China's 14th Five-Year Plan.

Those attacks entailed the abuse of a then-disclosed flaw in Pulse Secure VPN devices (CVE-2021-22893, CVSS score: 10.0) to deploy malicious web shells and exfiltrate valuable information from enterprise networks.

"APT5 has demonstrated capabilities against Citrix Application Delivery Controller deployments," NSA said. "Targeting Citrix ADCs can facilitate illegitimate access to targeted organizations by bypassing normal authentication controls."

Microsoft, last month, pointed out Chinese threat actors' history of discovering and using zero days to their advantage before being picked up by other adversarial collectives in the wild.

News of the Citrix bug also comes a day after Fortinet revealed a severe vulnerability that also facilitates remote code execution in FortiOS SSL-VPN devices (CVE-2022-42475, CVSS score: 9.3).

**VMWare releases updates for code execution vulnerabilities**

In a related development, VMware disclosed details of two critical flaws impacting ESXi, Fusion, Workstation, and vRealize Network Insight (vRNI) that could result in command injection and code execution.

*   **CVE-2022-31702** (CVSS score: 9.8) - Command injection vulnerability in vRNI
*   **CVE-2022-31703** (CVSS score: 7.5) - Directory traversal vulnerability in vRNI
*   **CVE-2022-31705** (CVSS score: 5.9/9.3) - Heap out-of-bounds write vulnerability in EHCI controller

"On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed," the company said in a security bulletin for CVE-2022-31705.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Hackers Actively Exploiting Citrix ADC and Gateway Zero-Day Vulnerability

RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via a GET parameter

1.  \[Suggested description\]
    
2.  RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to
    
3.  execute arbitrary code via "\_oups" GET parameter
    

5.  \------------------------------------------
    

7.  \[VulnerabilityType\]
    
8.  Code injection
    

10.  \------------------------------------------
    

12.  \[Vendor of Product\]
    
13.  SPIP - Systeme de Publication pour Internet
    

15.  \------------------------------------------
    

17.  \[Affected Product Code Base\]
    
18.  SPIP - 3.1.13 - 3.1.14 - 3.2.8 - 3.2.9 - 3.1.15 - 3.2.10 - 3.2.11 - 4.0.0 - 4.0.1 - 3.2.12 - 4.0.2 - 4.0.3 - 4.0.4 - 3.2.13 - 3.2.14 - 4.0.5 - 4.1.0 - 4.1.1 - 4.0.6 - 4.1.2 - 4.0.7 - 3.2.15
    

20.  \------------------------------------------
    

22.  \[Affected Component\]
    
23.  https://github.com/spip/SPIP/blob/0394b44774555ae8331b6e65e35065dfa0bb41e4/prive/formulaires/editer\_liens.php#L131
    

25.  \------------------------------------------
    

27.  \[Attack Type\]
    
28.  Remote
    

30.  \------------------------------------------
    

32.  \[Impact Code execution\]
    
33.  true
    

35.  \------------------------------------------
    

37.  \[Attack Vectors\]
    
38.  To exploit vulnerability, an authenticated user with backend access must send a malicious payload (PHP code) in a GET parameter. The server will interpret it and render results to user.
    

40.  \------------------------------------------
    

42.  \[Reference\]
    
43.  https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-1-5-SPIP-4-0-8-et-SPIP-3-2-16.html
    
44.  https://github.com/Abyss-W4tcher/ab4yss-wr4iteups/blob/85e563c1800bf7e5f36205dbebe0f8692bb731d8/SPIP%204.1.2%20Vulnerabilities/SPIP\_4.1.2\_AUTH\_RCE/SPIP\_4.1.2\_AUTH\_RCE\_Abyss\_Watcher\_12\_07\_22.md
    
45.  https://spawnzii.github.io/posts/2022/07/how-we-have-pwned-root-me-in-2022/
    

47.  \------------------------------------------
    

49.  \[Has vendor confirmed or acknowledged the vulnerability?\]
    
50.  true
    

52.  \------------------------------------------
    

54.  \[Discoverer\]
    
55.  abyss-w4tcher@proton.me ; spzsec@protonmail.com

CVE-2022-37155: [Suggested description]  RCE in SPIP 3.1.13 through 4.1.2 allows remote auth - Pastebin.com

Here's what you need to patch now, including six critical updates for Microsoft's final Patch Tuesday of the year.

Microsoft has released fixes for 48 new vulnerabilities across its products, including one that attackers are actively exploiting and another that has been publicly disclosed but is not under active exploit now.

Six of the vulnerabilities that the company patched in its final monthly security update for the year are listed as critical. It assigned an important severity rating to 43 vulnerabilities and gave three flaws a moderate severity assessment. 

Microsoft's update includes patches for out-of-band CVEs it addressed over the past month, plus 23 vulnerabilities in Google's Chromium browser technology, on which Microsoft's Edge browser is based.

**Actively Exploited Security Bug**

The flaw that attackers are actively exploiting (CVE-2022-44698) is not among the more critical of the bugs for which Microsoft released patches today. The flaw gives attackers a way to bypass the Windows SmartScreen security feature for protecting users against malicious files downloaded from the Internet. 

"An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging," Microsoft said.

CVE-2022-44698 presents only a relatively small risk for organizations, says Kevin Breen, director of cyber-threat research at Immersive Labs. "It has to be used in partnership with an executable file or other malicious code like a document or script file," Breen says. "In these situations, this CVE bypasses some of Microsoft's built-in reputation scanning and detection — namely SmartScreen, which would normally pop up to tell a user the file may not be safe." 

At the same time, users should not underestimate the threat and should patch the issue quickly, Breen recommends.

Microsoft described another flaw — an elevation of privilege issue in the DirectX Graphics kernel — as a publicly known zero-day but not under active exploit. The company assessed the vulnerability (CVE-2022-44710) as being "Important" in severity and one that would allow an attacker to gain system-level privileges if exploited. However, the company described the flaw as one that attackers are less likely to exploit.

**Vulnerabilities to Patch Now**

Trend Micro's ZDI flagged three other vulnerabilities in the December Patch Tuesday security update as being significant: CVE-2022-44713, CVE-2022-41076, and CVE-2022-44699.

CVE-2022-44713 is a spoofing vulnerability in Microsoft Outlook for Mac. The vulnerability allows an attacker to appear as a trusted user and cause a victim to mistake an email message as if it came from a legitimate user. 

"We don't often highlight spoofing bugs, but anytime you're dealing with a spoofing bug in an email client, you should take notice," ZDI's head of threat awareness Dustin Childs said in a blog post. The vulnerability could prove especially troublesome when combined with the aforementioned SmartScreen MoTW bypass flaw that attackers are actively exploiting, he said.

CVE-2022-41076 is a PowerShell remote code execution (RCE) vulnerability that allows an authenticated attacker to escape the PowerShell Remoting Session Configuration and run arbitrary commands on an affected system, Microsoft said. 

The company assessed the vulnerability as something that attackers are more likely compromise, even though attack complexity itself is high. According to Childs, organizations should pay attention the vulnerability because it is the type of flaw that attackers often exploit when looking to "live off the land" after gaining initial access on a network. 

"Definitely don’t ignore this patch," Childs wrote.

And finally, CVE-2022-44699 is another security bypass vulnerability — this time in Azure Network Watcher Agent — that, if exploited, could affect an organization's ability to capture logs needed for incident response. 

"There might not be many enterprises relying on this tool, but for those using this \[Azure Network Watcher\] VM extension, this fix should be treated as critical and deployed quickly,' Childs said.

Researchers with Cisco Talos identified three other vulnerabilities as critical and issues that organizations need to address immediately. One of them is CVE-2022-41127, an RCE vulnerability that affects Microsoft Dynamics NAV and on-premises versions of Microsoft Dynamics 365 Business Central. A successful exploit could allow an attacker to execute arbitrary code on servers running Microsoft's Dynamics NAV ERP application, Talos researchers said in a blog post. 

The other two vulnerabilities that the vendor considers to be of high importance are CVE-2022-44670 and CVE-2022-44676, both of which are RCE flaws in the Windows Secure Socket Tunneling Protocol (SSTP). 

"Successful exploitation of these vulnerabilities requires an attacker to win a race condition but could enable an attacker to remotely execute code on RAS servers," according to Microsoft's advisory.

Among the vulnerabilities that the SANS Internet Storm Center identified as important are (CVE-2022-41089), an RCE in the .NET Framework, and (CVE-2022-44690) in Microsoft SharePoint Server.

In a blog post, Mike Walters, vice president of vulnerability and threat research at Action1 Corp., also pointed to a Windows Print Spooler elevation of privilege vulnerability (CVE-2022-44678), as another issue to watch. 

"The newly resolved CVE-2022-44678 is most likely to be exploited, which is probably true because Microsoft fixed another zero-day vulnerability related to Print Spooler last month," Walters said. "The risk from CVE-2022-44678 is the same: an attacker can get SYSTEM privileges after successful exploitation — but only locally."

**A Confusing Bug Count**

Interestingly, several vendors had different takes on the number of vulnerabilities that Microsoft patched this month. ZDI, for instance, assessed that Microsoft patched 52 vulnerabilities; Talos pegged the number at 48, SANS at 74, and Action1 initially had Microsoft patching 74, before revising it down to 52.

Johannes Ullrich, dean of research for the SANS Technology Institute, says the issue has to do with the different ways one can count the vulnerabilities. Some, for instance, include Chromium vulnerabilities in their count while others do not. 

Others, like SANS, also include security advisories that sometimes accompany Microsoft updates as vulnerabilities. Microsoft also sometimes releases patches during the month, which it also includes in the following Patch Tuesday update, and some researchers don't count these. 

"The patch count can sometimes be confusing, as the Patch Tuesday cycle is technically November to December, so this will also include patches that were released out of band earlier in the month, and can also include updates from third party vendors," Breen says. "The most notable of these are patches from Google from Chromium, which is the base for Microsoft's Edge browser."  
Breen says by his count there are 74 vulnerabilities patched since the last Patch Tuesday in November. This includes 51 from Microsoft and 23 from Google for the Edge browser. 

"If we exclude both the out-of-band and Google Chromium \[patches\], 49 patches for vulnerabilities were released today," he says.

A Microsoft spokesman says the number of new CVEs for which the company issued patches today was 48.

Microsoft Squashes Zero-Day, Actively Exploited Bugs in Dec. Update

.NET Framework Remote Code Execution Vulnerability.

Dupe of GHSA-2c7v-qcjp-4mg2 

**.NET Framework Remote Code Execution Vulnerability.**

High severity GitHub Reviewed Published Dec 13, 2022 • Updated Dec 14, 2022

GHSA-9qcm-fqj9-93m4: .NET Framework Remote Code Execution Vulnerability.

Windows Terminal Remote Code Execution Vulnerability

CVE-2022-44702

Microsoft Office Graphics Remote Code Execution Vulnerability

CVE-2022-47211

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2022-44693

CVE-2022-44692

Microsoft Office Visio Remote Code Execution Vulnerability

Tag

#rce