The Cybersecurity and Infrastructure Security Agency put out a Cybersecurity Advisory to alert government agencies about cybercriminals using a vulnerability in Adobe Coldfusion to gain initial access to servers.
Adobe ColdFusion is a platform for building and deploying web and mobile applications.
The Common Vulnerabilities and Exposures database lists publicly disclosed computer security flaws.
The exploited vulnerability is listed as CVE-2023-26360, which affects Adobe ColdFusion versions 2018 Update 15 and 2021 Update 5.
The vulnerability is an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user.
A patch for this vulnerability has been available since March 14, 2023.
As we reported at the time, Adobe stated it was aware that CVE-2023-26360 had been exploited in the wild in very limited attacks.
The due date for patching the vulnerability set by CISA was April 5, 2023.
The problem is that the vulnerability also affects ColdFusion 2016 and ColdFusion 11 installations, which have reached end-of-life and are no longer supported with security patches.
According to the CSA, CISA now has confirmation that the vulnerability has been used in attacks on two Federal Civilian Executive Branch.
An analysis of network logs has reportedly confirmed the compromise of at least two public-facing servers within agencies' environments between June and July 2023.
Both servers were running outdated versions of the software that were vulnerable due to several unpatched flaws.
The investigation learned that it was a reconnaissance attack, and there was no evidence of data theft or lateral movement in the network.
In the CSA, CISA shares several indicators of compromise and tactics, techniques, and procedures used in the two attacks.
Create a plan for patching vulnerabilities in internet-facing systems quickly; and disable or harden remote access like RDP and VPNs. Prevent intrusions.
Use endpoint security software that can prevent exploits and malware used to deliver ransomware.
Use EDR or MDR to detect unusual activity before an attack occurs.
Keep backups offsite and offline, beyond the reach of attackers.
Once you've isolated the outbreak and stopped the first attack, you must remove every trace of the attackers, their malware, their tools, and their methods of entry, to avoid being attacked again.
Keep vulnerabilities in tow by using ThreatDown Vulnerability and Patch Management.
This Cyber News was published on www.malwarebytes.com. Publication date: Wed, 06 Dec 2023 14:43:06 +0000