New Python tool checks NPM packages for manifest confusion issues

2000+ Citrix NetScalers Hacked to Deploy Webshell

It has been discovered that an attacker installed web shells on susceptible Citrix NetScalers, exploiting the CVE-2023-3519 flaw to acquire persistent access. 

This critical zero-day vulnerability poses a significant risk as it can enable remote code execution (RCE) on both NetScaler ADC and NetScaler Gateway.

Exploiting this vulnerability, malicious actors have been successful in implanting web shells into the crucial infrastructure of an organization.

Even after a NetScaler has been patched and/or rebooted, the attacker can still run arbitrary commands using this web shell. 

According to Fox-IT (part of NCC Group), in a joint effort with the Dutch Institute of Vulnerability Disclosure (DIVD) reports that more than 1900 NetScalers are still backdoored.

Detecting NetScalers with Backdoors

Based on the findings, the attacker had automated exploitation on a massive scale. Although the identified web shells return a 404 Not Found, the response still differs from how Citrix servers typically react to a request for a file that does not exist. 

Moreover, unless supplied with the right arguments, the web shell won’t run any commands on the target system.

“Approximately 69% of the NetScalers that contain a backdoor are not vulnerable anymore to CVE-2023-3519”, Fox-IT reports.

“This indicates that while most administrators were aware of the vulnerability and have since patched their NetScalers to a non-vulnerable version, they have not been (properly) checked for signs of successful exploitation.”

While patches were being applied, exploitation took place at a large scale between July 20th and July 21st.

A total of 2491 web shells have been discovered among 1952 distinct NetScalers. On July 21st, were 31127 NetScalers susceptible to CVE-2023-3519 worldwide, indicating that the exploitation effort affected 6.3% of all vulnerable NetScalers.

The vast majority of vulnerable NetScalers are located in Europe. Only two of the top 10 impacted nations are outside of Europe. Furthermore, there is no specific industry that is being targeted.

Recommendation

Hence, this highlights that even when Citrix servers are upgraded, backdoors can continue functioning. 

Because of this, it is recommended that every NetScaler administrator do a fundamental assessment of their NetScalers.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

The post 2000+ Citrix NetScalers Hacked to Deploy Webshell appeared first on Cyber Security News.

   Read More 

Cyber Security News 

U.S. Cybersecurity Agencies Warn of Scattered Spider’s Gen Z Cybercrime Ecosystem

U.S. cybersecurity and intelligence agencies have released a joint advisory about a cybercriminal group known as Scattered Spider that’s known to employ sophisticated phishing tactics to infiltrate targets.
"Scattered Spider threat actors typically engage in data theft for extortion using multiple social engineering techniques and have recently leveraged BlackCat/ALPHV ransomware alongside their   Read More 

The Hacker News | #1 Trusted Cybersecurity News Site