The Most Affected Products by Vulnerabilities

The products most affected by vulnerabilities in recent years include Apache Log4j, Microsoft Exchange Server, and Atlassian Confluence. They also include VMware vSphere, Zoho ManageEngine, Pulse Secure, and Fortinet FortiOS. CISA lists them among the vulnerabilities routinely exploited in 2021. Ransomware groups such as Conti, LockBit and Hive have used many of them to gain initial access.

Introduction

Ransomware Attacks and Vulnerabilities

Ransomware is used by threat actors to encrypt targeted victim systems. Threat actors get the data on the targeted system and demand ransom payments from victims in exchange for not disclosing the data to the public. Once the victims pay the ransom, the data sharing is stopped and the targeted system is decrypted. Ransomware campaigns against institutions and firms are increasing day by day. In these campaigns, threat actors get key data from institutions and firms. They then demand large amounts of ransom money.

Threat groups use initial access vectors to launch ransomware distribution campaigns on the systems of targeted institutions and firms. Initial access vectors include exploiting security vulnerabilities, using obtained credentials, and brute forcing services such as RDP or SSH. Threat actors exploit security vulnerabilities in the applications used on targeted systems. This lets them run ransomware on those systems.

What is a CWE?

CWE (Common Weakness Enumeration) lists common software security weaknesses. The MITRE Corporation maintains CWE, which is based on contributions from the general software community. CWE is a changing resource that identifies and categorizes software vulnerabilities through a common language. It explains how to evaluate security measurement tools, how to find vulnerabilities, and how to prevent and reduce them. CWE strives to stop vulnerabilities and bugs by educating software developers to build better products that are not vulnerable to exploitation. Developers can use CWE as a resource when writing code to prevent vulnerabilities during development.

CWEs are often well documented and have detailed descriptions. Usually, the documentation includes common vulnerabilities, similar CVEs and relationships with similar vulnerabilities. Security professionals can use CWE records to generate proactive alerts and remediation from related attack patterns. Each CWE has a section that lists different attack patterns with an associated vulnerability. Using this data, firms can develop custom detection methods around CWEs. They can take their risk tolerance level into account.

What is CVE?

CVE (Common Vulnerabilities and Exposures) is a database that details and categorizes security vulnerabilities in publicly disclosed applications. Each vulnerability in the database has a CVE identifier number. Through these CVE numbers, users can easily access detailed data about the vulnerability. Institutions and firms often use CVE and related CVSS scores for planning and prioritization in vulnerability management programs.

What is the difference between CWE and CVE?

The main difference between CWE and CVE is that CWE classifies vulnerabilities while CVE only classifies known vulnerabilities related to specific systems and products. For example, a CVE might detail a specific vulnerability in an operating system that allows threat actors to execute code remotely. However, CWE outlines a vulnerability independent of any particular product or system.

A CWE uses a common language so that software security vulnerabilities can be fixed or reduced. Software developers have access to data about security vulnerabilities early in their product lifecycle. They can therefore develop products without introducing those vulnerabilities. This lets developers keep pace with rapid development lifecycles. They can deliver better products with a smaller attack surface to customers faster.

Most Abused CWEs in 2022

Some of the CWE categories and vulnerabilities often exploited by threat actors in 2022 are listed in the table below.

Out-of-bounds Write

Software writes data after the end or before the beginning of the intended buffer. This often occurs when the pointer or index is incremented or decremented to a location beyond the buffer boundaries. It can also occur when pointer arithmetic results in a location outside the current memory location. This can result in the corruption of sensitive data, crashes or code execution.

Cross-site Scripting

Cross-site scripting vulnerabilities, also known as XSS, allow threat actors to inject malicious code into websites. These attacks often take two types. In Stored XSS, an attacker injects malicious code into a site, and the code is then displayed to visitors, for example through a comment or like function. In Reflected XSS, an attacker injects malicious code into their own browser, and it is then automatically sent back to your website when they visit it.

SQL Injection

The software builds all or part of an SQL command from externally influenced input from an upstream part. It does not sanitize, or wrongly sanitizes, special parts that may alter the intended SQL command when it is sent to the downstream part. If SQL syntax in user-controllable inputs is not sufficiently removed or quoted, these inputs can be read as SQL instead of ordinary user data. This can be used to change the query logic and bypass security checks. It can also add statements that modify the backend database, including the execution of system commands.

Improper Input Validation

The product does not validate, or wrongly validates, input that could affect the control flow or data flow of a program. When software fails to validate input properly, an attacker can create input in a form the rest of the application does not expect. Parts of the system can then receive unwanted input. This can result in altered control flow, arbitrary control of a resource or arbitrary code execution.

Out-of-bounds Read

The software reads data after the end or before the beginning of the intended buffer. This often occurs when the pointer or index is incremented or decremented to a location beyond the buffer boundaries. It can also occur when pointer arithmetic results in a location outside the current memory location. This can result in the corruption of sensitive data, crashes or code execution.

OS Command Injection

The software builds all or part of an operating system command from externally influenced input from an upstream part. It does not sanitize, or wrongly sanitizes, special parts that could modify the intended command when it is sent to the downstream part. This could allow attackers to execute unexpected, dangerous commands directly on the operating system. The weakness can lead to a vulnerability in environments where the threat actor has no direct access to the operating system, such as web applications. If the vulnerability occurs in a privileged program, it could also allow the threat actor to specify commands that would not normally be accessible. They could also invoke alternative commands with privileges the attacker does not have.

Directory Tree/Path Traversal Errors

The software uses outside input to create a pathname that is meant to find a file or directory under a restricted parent directory. However, it does not properly sanitize special parts that can resolve to a location outside the restricted directory. By using special parts such as “…” and “/” separators, attackers can go outside the restricted location to access files or directories located elsewhere on the system. One of the most common special parts is the “../” sequence. In most modern operating systems it is read as the parent directory of the current location. This is called relative path traversal. Path traversal also includes absolute pathnames such as “/usr/local/bin”, which can be useful for accessing unexpected files.

Cross-Site Request Forgery

Some web servers receive requests from a client without any method to verify that the request was sent intentionally. An attacker can then trick a client into making an unintentional request to the web server, which accepts it as a genuine request. This can be done via a URL, image upload, XMLHttpRequest, etc., and can result in data exposure or execution of unwanted code.

Unrestricted Upload of File with Dangerous Type

The software allows the attacker to upload or transfer dangerous types of files that can be automatically processed in the product’s environment.

Improper Authentication

Improper authentication occurs when an application improperly authenticates a user. This vulnerability, which occurs in the Weakness, Architecture, Design and Implementation phases, allows threat actors to gain certain privileges within the application. They can also access sensitive data and execute arbitrary code.

Which vulnerabilities were most abused in 2021?

In their attack campaigns, threat actors exploit CWE vulnerability categories found in targeted user systems to gain access to them. Vulnerabilities found in targeted user products point to the specific weaknesses of that product. Some of the security vulnerabilities often exploited by threat actors in 2021 are listed in the table below.

Log4Shell (CVE-2021-44228)

Found in Log4j in the Apache Java logging library and first detected in late 2021. The vulnerability allows remote code execution by threat actors. It is very common because the Log4j library is widely used in web applications.

Zoho ManageEngine ADSelfService Plus (CVE-2021-40539)

Zoho ManageEngine ADSelfService Plus version 6113 and earlier have been found as a vulnerability causing a REST API authentication bypass and remote code execution. The bug was patched in September 2021. It allows threat actors to use specially crafted Rest API URLs to bypass authentication, because the URL is not normalized before the authentication attempt. By bypassing the authentication filter, threat actors can exploit endpoints and perform attacks such as arbitrary command execution.

ProxyShell (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523)

ProxyShell consists of three separate flaws in the Microsoft Exchange email server. They allow security features to be bypassed, remote code execution (RCE) and privilege escalation. When combined in vulnerable environments, ProxyShell allows an attacker to establish persistence and execute malicious PowerShell commands. A successful exploit allows threat actors to take full control of vulnerable Microsoft Exchange email servers.

ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-26858, CVE-2021-27065)

The ProxyLogon vulnerability can be exploited against unpatched mail servers running Microsoft Exchange Server 2013, 2016 or 2019. The servers must be set to receive untrusted connections from the outside environment. The vulnerability allows threat actors to execute commands on unpatched and internal Exchange Servers by sending commands through port 443. ProxyLogon is a pre-authenticated vulnerability, so a threat actor does not need to log in or complete any authentication process to execute code remotely. The flaw has its own page: ProxyLogon (CVE-2021-26855).

Atlassian Confluence Server & Data Center (CVE-2021-26084)

CVE-2021-26084 is a critical security vulnerability that could allow an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. Confluence is a Wiki-style service widely used in enterprise environments. The vulnerability was disclosed in August 2021. It has been and remains actively exploited in the wild, because unauthenticated users can exploit it regardless of configuration.

VMware vSphere Client (CVE-2021-21972)

VMware enables remote code execution in a vCenter Server plugin of the vSphere Client (HTML5), allowing threat actors to access port 443.

ZeroLogon (CVE-2020-1472)

ZeroLogon is a privilege escalation bug caused by a cryptographic error in Microsoft’s Active Directory Netlogon Remote Protocol (MS-NRPC). An unauthenticated attacker can exploit this flaw to log on to servers using NT LAN Manager (NTLM).

Microsoft Exchange Server (CVE-2020-0688)

This is another remote code execution vulnerability in Microsoft Exchange Server. It occurs when the server fails to generate unique keys properly during installation. Knowing the authentication key allows an authenticated user with a mailbox to forward arbitrary objects to be serialized by the web application running as SYSTEM.

Pulse Secure – Pulse Connect Secure (CVE-2019-11510)

Pulse Secure is a vulnerability affecting VPN devices that allows threat actors to gain access to victim networks. An unauthenticated, remote attacker could send a specially crafted URI to perform an arbitrary file read vulnerability.

Fortinet FortiOS and FortiProxy (CVE-2018-13379)

This is a path traversal vulnerability in the FortiProxy SSL VPN web portal. Exploiting this vulnerability could allow an unauthenticated, remote attacker to download FortiProxy system files via specially crafted HTTP resource requests.

Which security vulnerabilities do threat groups exploit?

The number of security vulnerabilities found in applications is increasing day by day. Ransomware threat groups exploit them to gain access to targeted systems. The user profiles and system types that these groups target differ. The vulnerabilities they exploit for initial access may differ as well. Examples of ransomware campaigns by some groups that exploit security vulnerabilities are listed below.

Conti

Threat actors linked to the Conti threat group have used two flaws together to gain access to VMware servers. One is the VMware remote code execution vulnerability (CVE-2021-21985). The other is the popular Log4J vulnerability (CVE-2021-44228). Initial access to the firm itself is achieved using RDP, VPN or phishing. Gaining access to vCenter then lets the threat actor have a greater impact, because many firms virtualize important parts of their operational infrastructure. The campaign is generally known to target Europe and the US.

Vuln ID: CVE-2021-44228
CVSS Severity: V3.1: 10.0 CRITICAL
CWE: CWE-917 – Expression Language Injection
Published: 10/12/2021
Affected Product: Apache Log4j2

Vuln ID: CVE-2021-21985
CVSS Severity: V3.1: 9.8 CRITICAL
CWE: CWE-20 – Improper Input Validation
Published: 26/05/2021
Affected Product: VMware vCenter

Cring

Threat actors exploited CVE-2018-13379 in Fortinet FortiGate security appliances. After gaining initial access to targeted systems, they distributed Cring ransomware. In the campaign, threat actors targeted industrial firms across Europe. They waited for the software version used in the FortiGate VPN server to be 6.0.2 to exploit the vulnerability tracked as CVE-2018-13379.

Vuln ID: CVE-2018-13379
CVSS Severity: V3.1: 9.8 CRITICAL
CWE: CWE-22 – Path Traversal
Published: 04/06/2019
Affected Product: Fortinet FortiOS

DearCry

According to cybersecurity researchers, DearCry ransomware was deployed on compromised Microsoft Exchange servers in 2021 after exploiting four vulnerabilities found as ProxyLogon. One of them, CVE-2021-26855, allows an unauthenticated threat actor to authenticate to the Exchange Server via HTTP requests.

After authenticating to the Exchange server, the threat actor can gain access to the Active Directory (AD) environment. The threat actor can use a tool like BloodHound to list the AD environment and then view the path to elevated privileges. The other three vulnerabilities in Exchange (CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) allow threat actors to execute code remotely. The image below shows the number of campaigns by sector in the related ransomware campaign.

Vuln ID: CVE-2021-26855
CVSS Severity: CVSS:3.1: 9.8 CRITICAL
CWE: CWE-918 – Server-Side Request Forgery (SSRF)
Published: 02/03/2021
Affected Product: Microsoft Exchange Server

Vuln ID: CVE-2021-26857
CVSS Severity: CVSS:3.1: 7.8 HIGH
CWE: CWE-502 – Deserialization of Untrusted Data
Published: 02/03/2021
Affected Product: Microsoft Exchange Server

Vuln ID: CVE-2021-26858
CVSS Severity: CVSS:3.1: 7.8 HIGH
CWE: –
Published: 02/03/2021
Affected Product: Microsoft Exchange

Vuln ID: CVE-2021-27065
CVSS Severity: CVSS:3.1: 7.8 HIGH
CWE: CWE-22 – Path Traversal
Published: 02/03/2021
Affected Product: Microsoft Exchange

Magniber

Threat actors are exploiting the critical PrintNightmare (CVE-2021-34527) vulnerability in the Windows Print Spooler to distribute the Magniber ransomware on Windows servers. The vulnerability allows code execution on the targeted system. Threat actors are known to target vulnerable systems in South Korea with this ransomware campaign.

Vuln ID: CVE-2021-34527
CVSS Severity: CVSS:3.1: 8.8 HIGH
CWE: NVD-CWE-noinfo
Published: 02/07/2021
Affected Product: Microsoft Windows

eCh0raix

Threat actors distributing eCh0raix ransomware have been found gaining access to targeted QNAP systems. They exploit the vulnerability tracked as CVE-2021-28799, which involves hard-coded credentials in backdoor software. Access to the targeted QNAP systems enables the distribution of eCh0raix ransomware.

Vuln ID: CVE-2021-28799
CVSS Severity: CVSS:3.1: 9.8 CRITICAL
CWE: CWE-285 – Improper Authorization
Published: 12/05/2021
Affected Product: QNAP NAS

HelloKitty

Threat actors have accessed systems by exploiting the critical vulnerability CVE-2019-7481. It affects SonicWall Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) products. It allows an unauthenticated user to gain read-only access to unauthorized resources. The access was then used to distribute HelloKitty ransomware.

Vuln ID: CVE-2019-7481
CVSS Severity: CVSS:3.1: 7.5 HIGH
CWE: CWE-89 – SQL Injection
Published: 17/12/2019
Affected Product: SonicWall SMA100

Vulnerabilities Exploited by Ransomware Threat Groups

Clop

Hive

Conti

LockBit

AvosLocker

How can firms reduce the risk from these vulnerabilities?

• Keep systems and applications up to date by scanning for security vulnerabilities.
• Do not access links in unsafe spam messages or unknown websites.
• Do not provide personal data to untrusted sources.
• Do not rely on e-mails, attachments, files, and links from suspicious or unknown parties.
• Never use USB sticks obtained from unknown sources.
• Use VPN services on public Wi-Fi networks.
• Sensitive data in the system should be backed up at regular intervals.
• Institutions and firms should provide awareness training to their staff against cyber security threats.
• Up-to-date security tools should be used in systems and e-mail mail servers.
• Threat intelligence services should be obtained in order to take precautions before any cyber attack occurs.

Conclusion

Threat actors are targeting more and more institutions and firms with ransomware, using advanced techniques. They exploit current security vulnerabilities to access targeted systems. To prevent internet users from being affected by ransomware campaigns, we recommend vulnerability management and attack surface management against the initial access methods.