Digest · Tuesday

Security digest: October 10, 2023

2 editorial briefs and 5 known exploited (cisa kev) additions.

All digests · RSS · Markdown

Take stock

Act now: Citrix Bleed. Every organization running customer-managed NetScaler ADC or Gateway as a VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual server, especially on end-of-life 12.1 or 13.0 builds.
Check exposure: HTTP/2 Rapid Reset. Anyone terminating HTTP/2 directly on self-managed servers, proxies, or app runtimes (NGINX, Tomcat, Node.js, Go, nghttp2-based stacks) that are reachable from the internet.
Do you run any of these? IETF HTTP/2, Microsoft Skype for Business, Microsoft WordPad, Adobe Acrobat and Reader, Cisco IOS and IOS XE. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-10-31.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Oct 10, 2023 · Vulnerability · CVE-2023-4966, CVE-2023-4967

Citrix Bleed: NetScaler Gateway Leaks Session Tokens

If a NetScaler configured as a Gateway or AAA server is still on a vulnerable build, assume it is being probed and patch, kill every session, and hunt; patching alone does not evict an attacker holding a stolen session.

Must act: Every organization running customer-managed NetScaler ADC or Gateway as a VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual server, especially on end-of-life 12.1 or 13.0 builds.

Can relax: Users of Citrix-managed cloud services and Citrix-managed Adaptive Authentication, and appliances not configured as a Gateway or AAA virtual server.

Confirm the build with `show version` and upgrade to a fixed release; move off end-of-life 12.1 and 13.0 trains.
Immediately after upgrading run: `kill icaconnection -all`, `kill rdp connection -all`, `kill pcoipConnection -all`, `kill aaa session -all`, `clear lb persistentSessions`.
If you cannot patch at once, isolate the appliance from the internet as CISA advised.

Read the brief →

Check exposure

Oct 10, 2023 · Vulnerability · CVE-2023-44487

HTTP/2 Rapid Reset: Record DDoS Flaw in HTTP/2 Servers

This is availability-only and was exploited at record scale, but if your HTTP/2 traffic terminates at a major CDN or cloud load balancer the provider already absorbed it; check what terminates HTTP/2 on your own servers.

Must act: Anyone terminating HTTP/2 directly on self-managed servers, proxies, or app runtimes (NGINX, Tomcat, Node.js, Go, nghttp2-based stacks) that are reachable from the internet.

Can relax: Sites whose public HTTP/2 traffic terminates at Cloudflare, Google Cloud load balancing, AWS edge services, or a similar provider, and services that do not speak HTTP/2 at all.

Inventory every component that terminates HTTP/2 from untrusted clients: reverse proxies, ingress controllers, app servers, language runtimes.
Upgrade each to a release with a rapid-reset mitigation (for example nghttp2 1.57.0+, Node.js 18.18.2+/20.8.1+, Tomcat 10.1.14+, NGINX Plus R29p1/R30p1).
On NGINX keep keepalive_requests at its default of 1000 and http2_max_concurrent_streams at 128, and add limit_conn and limit_req.

Read the brief →

Known exploited (CISA KEV) 5

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2023-44487	IETF HTTP/2 HTTP/2 Rapid Reset Attack Vulnerability	2023-10-31
CVE-2023-41763	Microsoft Skype for Business Microsoft Skype for Business Privilege Escalation Vulnerability	2023-10-31
CVE-2023-36563	Microsoft WordPad Microsoft WordPad Information Disclosure Vulnerability	2023-10-31
CVE-2023-21608	Adobe Acrobat and Reader Adobe Acrobat and Reader Use-After-Free Vulnerability	2023-10-31
CVE-2023-20109	Cisco IOS and IOS XE Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability	2023-10-31

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.