erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: January 10, 2024

1 editorial brief, 3 known exploited (cisa kev) additions and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Ivanti Connect Secure Zero-Day Chain: Unauthenticated RCE. Anyone running Ivanti Connect Secure or Policy Secure 9.x or 22.x, and anyone who ran an unpatched gateway between December 2023 and the February 2024 patches.
  • Do you run any of these? Ivanti Connect Secure and Policy Secure, Microsoft SharePoint Server. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-01-22.
  • Composer (PHP): 1 critical advisory (wwbn/avideo). Check with composer audit.
  • Go: 1 critical advisory (github.com/go-git/go-git/v5, gopkg.in/src-d/go-git.v4). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2023-46805, CVE-2024-21887

Ivanti Connect Secure Zero-Day Chain: Unauthenticated RCE

This chain was exploited as a zero-day by a suspected nation-state actor and then mass-exploited; any unpatched appliance should be assumed compromised, not just patched.

Must act: Anyone running Ivanti Connect Secure or Policy Secure 9.x or 22.x, and anyone who ran an unpatched gateway between December 2023 and the February 2024 patches.

Can relax: Organizations with no Ivanti Connect Secure, Policy Secure or Neurons for ZTA gateways; Ivanti says other products are not affected.

  1. Upgrade every gateway to a current supported release that includes the January 31, February 1 and February 8, 2024 fixes or later.
  2. Run Ivanti's external Integrity Checker Tool, and collect memory, logs and disk images before anything that reboots the appliance.
  3. If you were ever unpatched, export the config, factory reset, rebuild on a patched image and reimport, as CISA ED 24-01 required.

Read the brief →

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2024-21887Ivanti Connect Secure and Policy Secure
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Ransomware		2024-01-22
CVE-2023-46805Ivanti Connect Secure and Policy Secure
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability Ransomware		2024-01-22
CVE-2023-29357Microsoft SharePoint Server
Microsoft SharePoint Server Privilege Escalation Vulnerability Ransomware		2024-01-31

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 1

Check: composer audit

Go 1

Check: govulncheck ./...