Full Report
Learn about the top four Common Vulnerabilities and Exposures (CVEs) attackers are exploiting—and how you can defend against them.
Analysis Summary
Based on the provided article, here is the summary of the top exploited vulnerabilities identified by Huntress and CISA.
***
# Vulnerability: Citrix ADC Arbitrary Code Execution
## CVE Details
- **CVE ID:** CVE-2019-19781
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-20 (Improper Input Validation) / CWE-22 (Path Traversal)
## Affected Systems
- **Products:** Citrix Application Delivery Controller (ADC) and Citrix Gateway.
- **Versions:** Multiple versions including 10.5, 11.1, 12.0, 12.1, and 13.0.
- **Configurations:** Systems acting as load balancers or VPN gateways.
## Vulnerability Description
This is a path traversal flaw that allows an unauthenticated attacker to access restricted directories. By exploiting this, an attacker can execute arbitrary commands (ACE) on the target system.
## Exploitation
- **Status:** Exploited in the wild (Ranked as the most exploited flaw in 2020).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Total
- **Integrity:** Total
- **Availability:** Total (Enables full administrative takeover).
## Remediation
### Patches
- Apply firmware updates provided by Citrix for versions 10.5, 11.1, 12.0, 12.1, and 13.0.
### Workarounds
- Execute specific mitigation commands via the Citrix ADC Command Line Interface (CLI) as detailed in Citrix advisory CTX267679.
## Detection
- Monitor for unauthorized access to `/scripts/` or `/vpn/` directories.
- Check for unusual command execution from the web server user.
## References
- [hXXps://support.citrix.com/article/CTX267679]
- [hXXps://us-cert.cisa.gov/ncas/alerts/aa21-209a]
***
# Vulnerability: Pulse Secure VPN Arbitrary File Reading
## CVE Details
- **CVE ID:** CVE-2019-11510
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-22 (Path Traversal)
## Affected Systems
- **Products:** Pulse Connect Secure (VPN)
- **Versions:** 8.1R15.1, 8.2, 8.3, and 9.0.
- **Configurations:** Pulse Secure gateways with SSL VPN enabled.
## Vulnerability Description
A critical path traversal vulnerability allows unauthenticated remote attackers to send a specially crafted URI to the gateway, resulting in the ability to read arbitrary files.
## Exploitation
- **Status:** Exploited in the wild (High frequency by ransomware groups).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Total (Attacker can steal unencrypted credentials and session cookies).
- **Integrity:** None (Directly), but facilitates subsequent access.
- **Availability:** None.
## Remediation
### Patches
- Update to Pulse Connect Secure versions 8.1R15.1, 8.2R12.1, 8.3R7.1, and 9.0R3.4 or higher.
### Workarounds
- **Critical Note:** Even after patching, credentials may have already been stolen. Administrators must force a password reset for all users and rotate session cookies/keys.
## Detection
- Scan logs for HTTP requests containing `../` or `/dana-na/` patterns.
- Review CISA alerts for known malicious IP addresses targeting Pulse Secure.
## References
- [hXXps://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101]
- [hXXps://us-cert.cisa.gov/ncas/alerts/aa21-209a]
***
# Vulnerability: F5 BIG-IP Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2020-5902
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** F5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM).
- **Versions:** 11.6.x, 12.1.x, 13.1.x, 14.1.x, 15.0.x, 15.1.x.
- **Configurations:** Systems where the Traffic Management User Interface (TMUI) is accessible.
## Vulnerability Description
The vulnerability exists in the Configuration Utility (TMUI) and allows unauthenticated attackers with network access to the TMUI through the BIG-IP management port or self-IP addresses to execute arbitrary system commands and create/delete files.
## Exploitation
- **Status:** Exploited in the wild; PoC available.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Total
- **Integrity:** Total
- **Availability:** Total
## Remediation
### Patches
- Upgrade to F5 BIG-IP versions 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.1.0.4 or later.
### Workarounds
- Restrict access to the TMUI to trusted internal networks only.
- Disable access to the management interface from the internet.
## Detection
- Look for exploitation attempts in the logs for the `/tmui/` path.
- Monitor for unauthorized administrative account creation.
## References
- [hXXps://support.f5.com/csp/article/K52145254]
***
# Vulnerability: Microsoft Exchange ProxyShell (RCE Chain)
## CVE Details
- **CVE ID:** CVE-2021-34473, CVE-2021-34481, CVE-2021-31207
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-917 (Improper Neutralization of Expression Language)
## Affected Systems
- **Products:** Microsoft Exchange Server
- **Versions:** 2013, 2016, 2019
- **Configurations:** On-premises Exchange servers (Exchange Online/Office 365 not affected).
## Vulnerability Description
Known collectively as "ProxyShell," this is a chain of three vulnerabilities that allow an unauthenticated attacker to bypass authentication and execute code as SYSTEM on port 443 via the Client Access Service (CAS).
## Exploitation
- **Status:** Actively exploited in the wild.
- **Complexity:** Low/Medium
- **Attack Vector:** Network (Port 443)
## Impact
- **Confidentiality:** Total
- **Integrity:** Total
- **Availability:** Total
## Remediation
### Patches
- Install the Microsoft Cumulative Updates (CU) and Security Updates (SU) released in May and July 2021.
### Workarounds
- Block external access to the `/autodiscover/autodiscover.json` endpoint.
## Detection
- Monitor for web shells in Exchange directories (e.g., `\FrontEnd\HttpProxy\owa\auth\`).
- Audit logs for unusual PowerShell activity under the `NT AUTHORITY\SYSTEM` account.
## References
- [hXXps://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit]
- [hXXps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473]