CISA Flags Critical BeyondTrust Vulnerability As Exploited

December 20, 2024December 20, 2024

Critical Security Flaw Discovered in BeyondTrust Remote Access Products: What You Need to Know

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical security flaw affecting BeyondTrust’s Privileged Remote Access (PRA) and Remote Support (RS) products. This vulnerability, identified as CVE-2024-12356, has a high CVSS score of 9.8 and poses a significant risk to users, with evidence of active exploitation in the wild. In this article, we delve into the details of the vulnerability, its implications, and the necessary steps for users to protect their systems.

Understanding the Vulnerability in BeyondTrust Products

CISA has classified this command injection flaw as a serious threat that could allow malicious actors to execute arbitrary commands with user-level privileges. According to CISA, “BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.”

Recommended Updates for Users

To mitigate this risk, users of self-hosted versions of BeyondTrust software are strongly advised to update to the latest patches:

Privileged Remote Access (versions 24.3.1 and earlier)
- PRA patch: BT24-10-ONPREM1 or BT24-10-ONPREM2
Remote Support (versions 24.3.1 and earlier)
- RS patch: BT24-10-ONPREM1 or BT24-10-ONPREM2

Recent Cybersecurity Incidents Involving BeyondTrust

The urgency of this update follows a recent cyberattack on BeyondTrust, where unknown threat actors compromised some Remote Support SaaS instances. During the investigation, BeyondTrust discovered that the attackers accessed a Remote Support SaaS API key, enabling them to reset passwords for local application accounts.

Additionally, a medium-severity vulnerability, tracked as CVE-2024-12686 (CVSS score: 6.6), was identified. This flaw allows an attacker with existing administrative privileges to inject commands and execute them as a site user. Users are encouraged to update to the following patched versions:

Privileged Remote Access (PRA)
- PRA patches: BT24-11-ONPREM1 to BT24-11-ONPREM7 (depending on the PRA version)
Remote Support (RS)
- RS patches: BT24-11-ONPREM1 to BT24-11-ONPREM7 (depending on the RS version)

Conclusion: Stay Informed and Secure

While BeyondTrust has not confirmed any active exploitation of the newly discovered vulnerabilities, the company has notified all affected customers. The scale of the attacks and the identities of the perpetrators remain unknown.

For users of BeyondTrust products, it is crucial to stay updated with the latest software patches and security advisories. For more information on cybersecurity best practices, visit the CISA website and explore their resources.

If you found this article helpful, share your thoughts in the comments below and follow us on Twitter and LinkedIn for more updates on cybersecurity and technology news.

Oracle Alerts Users: Critical Agile PLM Vulnerability Exploited

December 1, 2024December 1, 2024

Oracle has issued a critical alert about a high-severity security flaw, CVE-2024-21287, in its Agile Product Lifecycle Management (PLM) Framework, with a CVSS score of 7.5. This vulnerability, already exploited in the wild, allows unauthorized access to sensitive information without authentication. Attackers could potentially disclose files from affected systems, posing significant risks to organizations. Oracle recommends users promptly apply the latest security patches, monitor for suspicious activity, and educate employees on cybersecurity best practices. The discovery was made by CrowdStrike security experts, though details about the exploitation remain unclear.

WordPress Plugin Flaw Lets Hackers Install Vulnerable Add-ons

December 12, 2024December 12, 2024

A critical vulnerability (CVE-2024-11972) in the Hunk Companion plugin for WordPress is being actively exploited, posing significant security risks for over 10,000 users. With a CVSS score of 9.8, this flaw allows attackers to install vulnerable plugins, leading to Remote Code Execution (RCE), SQL Injection, and Cross-Site Scripting (XSS) attacks. All versions prior to 1.9.0 are affected. WPScan highlights the urgency for WordPress users to update to the latest version to prevent exploitation. Additionally, a separate vulnerability in the WPForms plugin has been resolved, underscoring the importance of maintaining updated plugins for site security.

Fortinet Firewalls Targeted in Suspected Zero-Day Attacks

January 14, 2025January 14, 2025

Cybersecurity experts are warning about a new threat targeting Fortinet FortiGate firewalls, particularly those with exposed management interfaces. Beginning in mid-November 2024, attackers exploited vulnerabilities in firmware versions 7.0.14 to 7.0.16, likely leveraging a zero-day vulnerability. The campaign involved unauthorized access, account creation, and SSL VPN authentication. Activities unfolded in four phases: reconnaissance, configuration changes, account manipulation, and lateral movement. Victims span various sectors, indicating opportunistic targeting. Organizations are urged to limit internet exposure of management interfaces and restrict access to trusted users to mitigate risks. Vigilance and robust security practices are essential in this evolving threat landscape.

Urgent Patch Released for Ivanti Connect Secure VPN Vulnerability

January 11, 2025January 11, 2025

A critical vulnerability in Ivanti Connect Secure VPN, identified as CVE-2025-0282, is actively being exploited by threat actors for remote takeover attacks. This stack-based buffer overflow flaw allows unauthorized code execution, posing significant risks to targeted networks. Cybersecurity researchers from Google’s Mandiant team are urging system administrators to immediately apply emergency patches to mitigate risks. Additionally, a second vulnerability, CVE-2025-0283, has been identified but is not currently exploited. Administrators are advised to monitor network activity and review security protocols to prevent breaches. Prompt action is essential to safeguard against this substantial threat.

CISA Warns of Critical Flaws in Mitel and Oracle Systems

January 8, 2025January 8, 2025

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, focusing on Mitel MiCollab and Oracle WebLogic Server. Notable flaws include CVE-2024-41713 (CVSS 9.1) and CVE-2024-55550 (CVSS 4.4) in MiCollab, allowing unauthorized access to system files. Additionally, CVE-2020-2883 (CVSS 9.8) in WebLogic Server permits unauthenticated access via network protocols. CISA confirmed active exploitation of these vulnerabilities, prompting federal agencies to implement updates by January 28, 2025. Organizations are urged to remain vigilant against potential attacks.

Critical Apache Struts Flaw Detected, Exploits Underway

December 18, 2024December 18, 2024

A critical vulnerability in Apache Struts, designated CVE-2024-53677, poses severe risks of remote code execution, scoring 9.5 on the CVSS scale. It affects versions below 6.4.0, specifically Struts 2.0.0 to 2.3.37 and 2.5.0 to 2.5.33. Attackers can exploit file upload parameters, enabling harmful file uploads and further attacks. Experts warn of ongoing exploitation attempts, highlighting that this flaw may stem from an incomplete patch of CVE-2023-50164. Organizations are urged to upgrade to version 6.4.0 or later and revise their code to mitigate risks. Immediate action is essential for maintaining IT security.