InfoSecBulletin Cybersecurity for mankind
The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have released a joint Cybersecurity Advisory to highlight the active exploitation of severe vulnerabilities in Ivanti Cloud Service Appliances (CSA). The vulnerabilities—CVE-2024-8963, CVE-2024-9379, CVE-2024-8190, and CVE-2024-9380—were targeted by threat actors in September 2024, leading to compromises of victim networks.
The vulnerabilities being exploited include:
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
CVE-2024-8963: An administrative bypass vulnerability (Path Traversal) that allows unauthorized access to restricted features of the appliance.
CVE-2024-8190: An OS command injection vulnerability enabling threat actors to authenticate remotely and execute arbitrary commands.
CVE-2024-9379: A SQL injection vulnerability permitting attackers with administrative privileges to run malicious SQL statements.
CVE-2024-9380: A command injection vulnerability allowing remote code execution (RCE) when exploited by attackers with admin privileges.
Affected Versions:
Vulnerabilities CVE-2024-8963, CVE-2024-8190, and CVE-2024-9380 impact Ivanti CSA 4.6x versions prior to build 519.CVE-2024-9379 and CVE-2024-9380 additionally affect CSA versions 5.0.1 and below.
It’s important to note that Ivanti CSA 4.6 has reached its end-of-life (EOL) and no longer receives security patches or updates. Users of version 4.6 are strongly encouraged to upgrade to a supported version to reduce these security risks.
CISA and FBI recommend upgrading to the latest supported Ivanti CSA version, deploying Endpoint Detection and Response (EDR) solutions, logging network activity to spot suspicious behavior, and ensuring regular patching of operating systems, software, and firmware within 24-48 hours of vulnerability disclosures.
