---
title: "The Cyber Insider: Week 12/11 – 12/17"
url: "https://www.armorcode.com/blog/the-cyber-insider-week-4"
markdown_url: "https://www.armorcode.com/blog/the-cyber-insider-week-4.md"
llm_canonical: "https://www.armorcode.com/blog/the-cyber-insider-week-4.md"
canonical_for_llm: true
entity_type: "Article"
primary_entity: "The Cyber Insider: Week 12/11 – 12/17"
citation_value: "Published on ArmorCode; canonical URL https://www.armorcode.com/blog/the-cyber-insider-week-4."
last_updated: "2025-04-14T12:38:25-07:00"
---
The Cyber Insider: Week 12/11 – 12/17
1. Atlassian Issues Critical Software Fixes to Prevent RCE
Atlassian has issued security advisories for **four critical remote code execution** vulnerabilities that **affect** **Confluence, Jira, and Bitbucket servers**, in addition to a **companion macOS application.**
The following are the four vulnerabilities:
- [**CVE-2023-22522**](https://confluence.atlassian.com/security/cve-2023-22522-rce-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html): A **critical template injection flaw** has been identified, enabling authenticated users, including those with anonymous access, to**introduce insecure input into Confluence pages**. This vulnerability carries a **severity score of 9.0** and affects all Confluence Data Center and Server **versions from 4.0.0 to 8.5.3.**
- [**CVE-2023-22523**](https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html): A **critical Privileged Remote Code Execution (RCE)** issue has been discovered in the Assets Discovery agent, impacting**Jira Service Management Cloud, Server, and Data Center**with a **severity score of 9.8.** Vulnerable versions of Asset Discovery include those **below 3.2.0 for Cloud and 6.2.0 for Data Center and Server.**
- [**CVE-2023-22524**](https://confluence.atlassian.com/security/cve-2023-22524-rce-vulnerability-in-atlassian-companion-app-for-macos-1319249492.html): A critical security flaw involves the **bypass of blocklist and macOS Gatekeeper** on the **companion app for Confluence Server and Data Center for macOS**. This vulnerability affects all versions of the app prior to 2.0.0 and carries a **severity score of 9.6.**
- ****[**CVE-2022-1471**](https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html): A **critical Remote Code Execution (RCE**) vulnerability has been identified in the **SnakeYAML library**, impacting multiple versions of **Jira, Bitbucket, and Confluence products.** This security issue carries a **severity score of 9.8.**
Mitigation
To address all four of the above problems, users are recommended to update to one of the following product versions:
- Confluence Data Center and Server 7.19.17 (LTS), 8.4.5, and 8.5.4 (LTS)
- Jira Service Management Cloud (Assets Discovery) 3.2.0 or later, and Jira Service Management Data Center and Server (Assets Discovery) 6.2.0 or later.
- Atlassian Companion App for MacOS 2.0.0 or later
- Automation for Jira (A4J) Marketplace App 9.0.2, and 8.2.4
- Bitbucket Data Center and Server 7.21.16 (LTS), 8.8.7, 8.9.4 (LTS), 8.10.4, 8.11.3, 8.12.1, 8.13.0, 8.14.0, 8.15.0 (Data Center Only), and 8.16.0 (Data Center Only)
- Confluence Cloud Migration App (CCMA) 3.4.0
- Jira Core Data Center and Server, Jira Software Data Center and Server 9.11.2, 9.12.0 (LTS), and 9.4.14 (LTS)
- Jira Service Management Data Center and Server 5.11.2, 5.12.0 (LTS), and 5.4.14 (LTS)
**References**
[Atlassian patches critical RCE flaws across multiple products](https://www.bleepingcomputer.com/news/security/atlassian-patches-critical-rce-flaws-across-multiple-products/)[CVE-2023-22522 – RCE Vulnerability In Confluence Data Center and Confluence Server
](https://confluence.atlassian.com/security/cve-2023-22522-rce-vulnerability-in-confluence-data-center-and-confluence-server-1319570362.html)[Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution](https://thehackernews.com/2023/12/atlassian-releases-critical-software.html)[CVE-2023-22523 – RCE Vulnerability in Assets Discovery](https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html)[CVE-2023-22524 – RCE Vulnerability in Atlassian Companion App for MacOS
](https://confluence.atlassian.com/security/cve-2023-22524-rce-vulnerability-in-atlassian-companion-app-for-macos-1319249492.html)[CVE-2022-1471 – SnakeYAML library RCE Vulnerability impacts Multiple Products
](https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-impacts-multiple-products-1296171009.html)
2. Microsoft’s Final 2023 Patch Tuesday: 4 Critical Fixes, 33 Vulnerabilities Addressed
Microsoft’s latest Patch Tuesday updates for **December 2023 marked the final release of the year,**addressing a total of **33 vulnerabilities** across its software. This release stands out as one of the lighter ones in recent memory.
Among the identified flaws, **four are classified as Critical,**while the remaining **29 are rated as Important in terms of severity.**
Complementing these updates, Microsoft has also resolved **18 vulnerabilities in its Chromium-based Edge browser** since the November 2023 Patch Tuesday release.
Some important CVEs from the latest patch:
- [**CVE-2023-36019**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36019) (CVSS score: 9.6) – Microsoft Power Platform Connector Spoofing Vulnerability
- [**CVE-2023-35630**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35630) (CVSS score: 8.8) – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
- [**CVE-2023-35639**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35639) (CVSS score: 8.8) – Microsoft ODBC Driver Remote Code Execution Vulnerability
- [**CVE-2023-35641**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35641) (CVSS score: 8.8) – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
- [**CVE-2023-35628**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35628) (CVSS score: 8.1) – Windows MSHTML Platform Remote Code Execution Vulnerability
- [**CVE-2023-35638**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35638) (CVSS score: 7.5) – DHCP Server Service Denial-of-Service Vulnerability
- [**CVE-2023-35643**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35643) (CVSS score: 7.5) – DHCP Server Service Information Disclosure Vulnerability
- [**CVE-2023-35642**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35642) (CVSS score: 6.5) – Internet Connection Sharing (ICS) Denial-of-Service Vulnerability
- [**CVE-2023-35636**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35636) (CVSS score: 6.5) – Microsoft Outlook Information Disclosure Vulnerability[****](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36012)
- [**CVE-2023-36012**](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36012) (CVSS score: 5.3) – DHCP Server Service Information Disclosure Vulnerability
The comprehensive December edition covers a range of software components, including **Microsoft Office and Components, Windows Win32K, Windows Kernel, Microsoft Bluetooth Driver, Windows DHCP Server, Windows ODBC Driver, and more.**
The fixes encompass various security concerns such as **Denial of Service (DoS), Elevation of Privilege (EoP), Information Disclosure, Remote Code Execution (RCE), and Spoofing**. Microsoft’s proactive approach ensures a strengthened security posture for users across diverse software platforms.
***Source:***[***Qualys
***](https://blog.qualys.com/vulnerabilities-threat-research/2023/12/12/microsoft-patch-tuesday-december-2023-security-update-review)
Microsoft has **patched more than 900 flaws this year**, making it one of the busiest years for software patching according to the[Zero Day Initiative’s](https://www.zerodayinitiative.com/blog/2023/12/12/the-december-2023-security-update-review) data.
**References
**[Microsoft December 2023 Security Updates](https://msrc.microsoft.com/update-guide/releaseNote/2023-Dec)[Microsoft and Adobe Patch Tuesday, December 2023 Security Update Review](https://blog.qualys.com/vulnerabilities-threat-research/2023/12/12/microsoft-patch-tuesday-december-2023-security-update-review)[Microsoft’s Final 2023 Patch Tuesday: 33 Flaws Fixed, Including 4 Critical](https://thehackernews.com/2023/12/microsofts-final-2023-patch-tuesday-33.html)
3. Apple Rolls Out Crucial Updates to Address Critical Flaws in iOS and macOS
Apple released security updates for **iOS, iPadOS, macOS, tvOS, watchOS, and Safari**. These patches address multiple vulnerabilities, including two zero-days for older devices.
In iOS and iPadOS, **12 vulnerabilities were fixed,** spanning various components.**macOS Sonoma 14.2 resolves 39 issues,**including six affecting the **ncurses library.**
Notable is**CVE-2023-45866**, a critical**Bluetooth flaw allowing keystroke injection** in privileged network positions.
Safari 17.2 addresses WebKit flaws (**CVE-2023-42890 and CVE-2023-42883)** causing **arbitrary code execution and a denial-of-service**. This update applies to Macs running **macOS Monterey and macOS Ventura.**
iOS 17.2 and iPadOS 17.2 introduce Contact Key Verification, **fixing a Siri bug**and enhancing iMessage privacy.
Apple also**released iOS 16.7.3 and iPadOS 16.7.3**, addressing eight security issues, including**two actively exploited WebKit vulnerabilities**. These have been patched in tvOS 17.2 and watchOS 10.2. No details on the exploitation nature or threat actors are available yet.
**References
**[Apache Patches Critical RCE Vulnerability in Struts 2](https://www.securityweek.com/apache-patches-critical-rce-vulnerability-in-struts-2/)[New Critical RCE Vulnerability Discovered in Apache Struts 2 – Patch Now
](https://thehackernews.com/2023/12/new-critical-rce-vulnerability.html)
4. Critical Remote Code Execution Vulnerability Uncovered in Apache Struts 2
Apache has issued a security advisory alerting users to a**critical vulnerability in the Struts 2 open-source web application framework**, posing a significant risk of remote code execution. Identified as **CVE-2023-50164,** the flaw originates from a flawed “**file upload logic**,” potentially allowing unauthorized path traversal.
Struts 2, a Java framework utilizing the **Model-View-Controller (MVC) architecture**, is employed for constructing enterprise-centric web applications. The discovery and disclosure of this vulnerability credit Steven Seeley of Source Incite.
The impacted software versions include
- Struts 2.3.37 (End of Life)
- Struts 2.5.0 to Struts 2.5.32
- Struts 6.0.0 to Struts 6.3.0
**Patches** addressing the vulnerability are accessible in **versions 2.5.33 and 6.3.0.2 or later,** with **no alternative workarounds available.**
Although there is **currently no evidence of the vulnerability being actively exploited** in real-world attacks, it is worth noting that a previous security flaw in Struts (**CVE-2017-5638, CVSS score: 10.0) was exploited by threat actors in 2017** to compromise the security of consumer credit reporting agency Equifax.
Mitigation
- Update your Struts 2 to **version 2.5.33 and 6.3.0.2 or later.**
**References**
[New Critical RCE Vulnerability Discovered in Apache Struts 2 – Update Now
](https://www.cyberkendra.com/2023/12/new-critical-rce-vulnerability.html)[New Critical RCE Vulnerability Discovered in Apache Struts 2 – Patch Now
](https://thehackernews.com/2023/12/new-critical-rce-vulnerability.html)[Apache Patches Critical RCE Vulnerability in Struts 2](https://www.securityweek.com/apache-patches-critical-rce-vulnerability-in-struts-2/)
5. Warning: Adversaries Exploiting AWS STS for Unauthorized Access to Cloud Accounts
**AWS Security Token Service (STS)**is a web service designed to facilitate the issuance of**short-term access tokens**to AWS users, including federated users authenticated through third-party identity platforms.
- STS tokens have a fixed duration, **not exceeding 36 hours.** Once this timeframe elapses, the access and permissions granted by the token are automatically revoked.
- **STS tokens are user-specific**, ensuring that users do not possess credentials susceptible to easy theft.
Malicious actors can steal long-term Identity and Access Management (IAM) tokens through diverse methods, such as**malware infections, publicly exposed credentials, and phishing emails.** Subsequently, they exploit these stolen tokens to **ascertain the roles and privileges**associated with them through API calls.
*Process of generating STS
*
Process of generating STS
“Depending on the token’s permission level, adversaries may also be able to use it to **create additional IAM users with long-term AKIA tokens**to ensure persistence if their initial AKIA token and all of the ASIA short-term tokens it generated are discovered and revoked,” the researcher said.
In the subsequent phase, a **Multi-Factor Authentication (MFA)-authenticated Security Token Service (STS) token generates multiple new short-term tokens.** This is followed by the **execution of post-exploitation actions**, including but not limited to data exfiltration.
If the compromised IAM token or credential is valid, an adversary can then execute API calls or perform actions like aws:MultiFactorAuthPresent, aws:MultiFactorAuthAge, and **extract MFA code and device details.**
Responding to identified compromise
- **Revoke permissions for all temporary credentials** that have been verified to be exploited in the attack.
- **Delete or rotate long-term Identity and Access Management (IAM) user access keys** (AKIA tokens) associated with the compromise.
- Attach a specific “**Deny-All” IAM policy** to the IAM users (AKIA tokens) engaged in suspicious activity.
- **Remove any resources created by the adversary** during the unauthorized access.
To prevent AWS token abuse, it is recommended to **log CloudTrail events, detect role-chaining and MFA abuse, and rotate long-term IAM user access keys.**
**References**
[AWS STS Threat Allows Cloud Infiltration
](https://cybermaterial.com/aws-sts-threat-allows-cloud-infiltration/)[By the same token: How adversaries infiltrate AWS cloud accounts
](https://redcanary.com/blog/aws-sts/)[Alert: Threat Actors Can Leverage AWS STS to Infiltrate Cloud Accounts](https://thehackernews.com/2023/12/alert-threat-actors-can-leverage-aws.html)