Article Details
Scrape Timestamp (UTC): 2024-10-14 11:39:04.428
Source: https://thehackernews.com/2024/10/nation-state-attackers-exploiting.html
Original Article Text
Click to Toggle View
Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration. A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance (CSA) a zero-day to perform a series of malicious actions. That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain unauthenticated access to the CSA, enumerate users configured in the appliance, and attempt to access the credentials of those users. "The advanced adversaries were observed exploiting and chaining zero-day vulnerabilities to establish beachhead access in the victim's network," security researchers Faisal Abdul Malik Qureshi, John Simmons, Jared Betts, Luca Pugliese, Trent Healy, Ken Evans, and Robert Reyes said. The flaws in question are listed below - In the next stage, the stolen credentials associated with gsbadmin and admin were used to perform authenticated exploitation of the command injection vulnerability affecting the resource /gsb/reports.php in order to drop a web shell ("help.php"). "On September 10, 2024, when the advisory for CVE-2024-8190 was published by Ivanti, the threat actor, still active in the customer's network, 'patched' the command injection vulnerabilities in the resources /gsb/DateTimeTab.php, and /gsb/reports.php, making them unexploitable." "In the past, threat actors have been observed to patch vulnerabilities after having exploited them, and gained foothold into the victim's network, to stop any other intruder from gaining access to the vulnerable asset(s), and potentially interfering with their attack operations." The unknown attackers have also been identified abusing CVE-2024-29824, a critical flaw impacting Ivanti Endpoint Manager (EPM), after compromising the internet-facing CSA appliance. Specifically, this involved enabling the xp_cmdshell stored procedure to achieve remote code execution. It's worth noting that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog in the first week of October 2024. Some of the other activities included creating a new user called mssqlsvc, running reconnaissance commands, and exfiltrating the results of those commands via a technique known as DNS tunneling using PowerShell code. Also of note is the deployment of a rootkit in the form of a Linux kernel object (sysinitd.ko) on the compromised CSA device. "The likely motive behind this was for the threat actor to maintain kernel-level persistence on the CSA device, which may survive even a factory reset," Fortinet researchers said.
Daily Brief Summary
A suspected nation-state adversary exploited three vulnerabilities in Ivanti Cloud Service Appliance (CSA) to gain unauthorized network entry and user information access.
The attackers utilized stolen credentials to perform further attacks and deploy a web shell on the compromised network.
Post-exploitation, the attackers "patched" the vulnerabilities used, likely to prevent other threat actors from exploiting the same flaws and interfering with their operations.
The same threat actors were also observed exploiting a critical flaw, CVE-2024-29824, in Ivanti Endpoint Manager (EPM) to enable remote code execution.
Additional malicious activities included the creation of new user accounts, execution of reconnaissance commands, and data exfiltration using DNS tunneling.
A rootkit was installed on the compromised CSA device to maintain low-level persistence, potentially surviving even a factory reset.
This incident was significant enough to be listed in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog.