InfoSecBulletin Cybersecurity for mankind
CISA warned U.S. government agencies on Thursday to protect their systems from a critical Microsoft Configuration Manager vulnerability that was fixed in October 2024 and is currently being exploited. Microsoft Configuration Manager is a tool for IT management of many Windows servers and workstations.
CVE-2024-43468 is an SQL injection vulnerability discovered by Synacktiv that lets remote attackers execute arbitrary commands on the server and Microsoft Configuration Manager database without any privileges.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database,” Microsoft explained when it patched the flaw in October 2024.
At the time, Microsoft tagged it as “Exploitation Less Likely,” saying that “an attacker would likely have difficulty creating the code, requiring expertise and/or sophisticated timing, and/or varied results when targeting the affected product.”
CISA has now identified CVE-2024-43468 as being actively exploited and has instructed Federal Civilian Executive Branch (FCEB) agencies to update their systems by March 5th, as required by the Binding Operational Directive (BOD) 22-01.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” the U.S. cybersecurity agency warned.
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
BOD 22-01 is aimed at federal agencies, but CISA urged all network defenders, including private sector ones, to quickly secure their devices against CVE-2024-43468 attacks.
| Action | Details |
|---|---|
| Immediate Actions | Scan with Defender or SSMS for suspicious queries. |
| Patch Fast | Install updates; test before production rollout. |
| Mitigate | Block untrusted IPs, enable IIS protection, use least privilege. |
| Cloud Twist | Enable MFA, logging, and zero-trust for Azure setups. |
Immediate Actions: Scan environments with tools like Microsoft Defender or SQL Server Management Studio for anomalous queries.
Patch Fast:Â Download updates from Microsoft Update Catalog. Test in staging first to avoid disrupting console access.
