--- title: "The Cyber Insider: Week 1/29 – 2/4" url: "https://www.armorcode.com/blog/the-cyber-insider-week-7" markdown_url: "https://www.armorcode.com/blog/the-cyber-insider-week-7.md" llm_canonical: "https://www.armorcode.com/blog/the-cyber-insider-week-7.md" canonical_for_llm: true entity_type: "Article" primary_entity: "The Cyber Insider: Week 1/29 – 2/4" citation_value: "Published on ArmorCode; canonical URL https://www.armorcode.com/blog/the-cyber-insider-week-7." last_updated: "2025-04-14T12:38:18-07:00" ---

The Cyber Insider: Week 1/29 – 2/4

Ivanti Zero-Day: CVE-2024-21888 and CVE-2024-21893

Ivanti has issued urgent fixes for**two high-severity vulnerabilities** detected in its **Connect Secure and Policy Secure products.** **CVE-2024-21888 (CVSS score: 8.8)** allows **unauthorized users to escalate their privileges to that of an administrator** through a flaw in the web component of I**vanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x).** While no evidence of customer impact has been found yet, Ivanti is urging proactive measures to mitigate potential risks. On the other hand, **CVE-2024-21893 (CVSS score: 8.2)**exposes a **server-side request forgery vulnerability in the SAML**component of the same products, along with Ivanti Neurons for ZTA, **enabling attackers to access restricted resources without proper authentication**. Ivanti has confirmed targeted exploitation of this vulnerability and has**identified a limited number of impacted customers.** The U.S. Cybersecurity and Infrastructure Security Agency (**CISA) has issued a fresh advisory** highlighting the exploitation of these vulnerabilities to capture credentials and deploy web shells, emphasizing the critical importance of applying the provided patches and implementing necessary security measures promptly.

Mitigation

- Customers are **advised to factory reset** their appliances before applying the patches. - **Temporarily**, users are recommended to **import the “mitigation.release.20240126.5.xml” file.** - **Fixes released**for Connect Secure versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 and 22.5R1.1, and ZTA version 22.6R1.3. **References** [https://thehackernews.com/2024/01/alert-ivanti-discloses-2-new-zero-day.html](https://thehackernews.com/2024/01/alert-ivanti-discloses-2-new-zero-day.html)[https://www.cisa.gov/news-events/alerts/2024/01/30/new-mitigations-defend-against-exploitation-ivanti-connect-secure-and-policy-secure-gateways ‍](https://www.cisa.gov/news-events/alerts/2024/01/30/new-mitigations-defend-against-exploitation-ivanti-connect-secure-and-policy-secure-gateways)[https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ‍](https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US)

Critical Vulnerability in GNU C Library Grants Root Access on Linux Systems

A newly disclosed security flaw in the**GNU C library (glibc)**, tracked as **CVE-2023-6246**, poses a severe risk to Linux systems,**allowing malicious local attackers to obtain full root access. ** The vulnerability, a **heap-based buffer overflow** in the**__vsyslog_internal()** function used for system logging, was inadvertently introduced in glibc 2.37 released in August 2022. Saeed Abbasi, product manager of the Threat Research Unit at Qualys, emphasized that **CVE-2023-6246 impacts major Linux distributions like Debian, Ubuntu, and Fedora.** Exploiting this flaw **enables unprivileged users to escalate their privileges,**posing a significant threat to system security. Cybersecurity experts caution that while the vulnerability requires specific conditions to exploit, such as unusually long inputs to logging functions, its **impact is substantial due to the widespread use of glibc**.  Further analysis by Qualys revealed two additional flaws, **CVE-2023-6779 and CVE-2023-6780,** in the**__vsyslog_internal()**function, along with a **memory corruption bug in the qsort() function affecting all glibc versions since 1992.** **References** ‍[https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt ‍](https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt)[https://thehackernews.com/2024/01/new-glibc-flaw-grants-attackers-root.html ‍](https://thehackernews.com/2024/01/new-glibc-flaw-grants-attackers-root.html)[https://blog.qualys.com/vulnerabilities-threat-research/2024/01/30/qualys-tru-discovers-important-vulnerabilities-in-gnu-c-librarys-syslog ‍](https://blog.qualys.com/vulnerabilities-threat-research/2024/01/30/qualys-tru-discovers-important-vulnerabilities-in-gnu-c-librarys-syslog)

GitLab Releases Fixes for Critical File Write Vulnerability in Community and Enterprise Editions

GitLab has issued urgent fixes to address a critical security flaw, tracked as **CVE-2024-0402 (CVSS 9.9)**, affecting both its Community Edition (CE) and Enterprise Edition (EE), **enables authenticated users to write files to arbitrary locations on the GitLab server while creating a workspace.** According to GitLab’s advisory released on January 25, 2024, the issue **impacts all versions from 16.0 to 16.5.8, 16.6 to 16.6.6, 16.7 to 16.7.4, and 16.8 to 16.8.1.** Patches for CVE-2024-0402 have been backported to these versions to ensure comprehensive protection. This latest update follows recent fixes aimed at resolving two critical shortcomings, including one vulnerability **(CVE-2023-7028)** that could be **exploited to take over accounts without any user interaction**, emphasizing the continuous commitment to enhancing security measures. Additionally, **GitLab has addressed four medium-severity flaws**, including vulnerabilities leading to **regular expression denial-of-service (ReDoS), HTML injection, and disclosure of a user’s public email address** via the tags RSS feed.

Mitigation

- Users are strongly advised to upgrade their installations to the patched versions at the earliest opportunity. **References** ‍[https://thehackernews.com/2024/01/urgent-upgrade-gitlab-critical.html ‍](https://thehackernews.com/2024/01/urgent-upgrade-gitlab-critical.html)[https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/](https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/)‍ ‍

Juniper Networks Releases Urgent Updates to Address High-Severity Vulnerabilities in SRX and EX Series

Juniper Networks has issued out-of-band updates to mitigate**high-severity vulnerabilities affecting SRX Series and EX Series**, which could potentially allow threat actors to **take control of vulnerable systems. ** Tracked as **CVE-2024-21619 and CVE-2024-21620,** these vulnerabilities are found within the **J-Web component**and **impact all versions of Junos OS**. The vulnerabilities are categorized as follows: - CVE-2024-21619 (CVSS score: 5.3): A **missing authentication vulnerability** leading to potential **exposure of sensitive configuration information.** - CVE-2024-21620 (CVSS score: 8.8): A **cross-site scripting**(XSS) vulnerability enabling the **execution of arbitrary commands** with the target’s permissions via a specially crafted request.

Mitigation

- **Temporarily,** Juniper Networks recommends disabling J-Web or restricting access to trusted hosts. - **CVE-2024-21619 is addressed in version** 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases**‍** - **CVE-2024-21620 is addressed in version** 20.4R3-S10, 21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3-S1, 23.2R2, 23.4R2, and all subsequent releases **References** ‍[https://thehackernews.com/2024/01/juniper-networks-releases-urgent-junos.html](https://thehackernews.com/2024/01/juniper-networks-releases-urgent-junos.html)[https://supportportal.juniper.net/s/article/2024-01-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-have-been-addressed?language=en_US ‍](https://supportportal.juniper.net/s/article/2024-01-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-have-been-addressed?language=en_US)[https://labs.watchtowr.com/the-second-wednesday-of-the-first-month-of-every-quarter-juniper-0day-revisited/ ‍](https://labs.watchtowr.com/the-second-wednesday-of-the-first-month-of-every-quarter-juniper-0day-revisited/)

Jenkins Resolves Critical Remote Code Execution Vulnerability: Urgent Update Required

Tracked as **CVE-2024-23897**, is capable of leading to**remote code execution**(RCE). This flaw, characterized as an**arbitrary file read vulnerability through the built-in CLI**, could allow threat actors to **access sensitive files on the Jenkins controller file system.** Jenkins utilizes the**args4j library** for parsing command arguments, enabling a feature that replaces @ followed by a file path with the file’s contents **(expandAtFiles)**. Exploiting this feature**, attackers could read arbitrary files, potentially leading to various attacks,** including **RCE via different vectors** such as Resource Root URLs, “Remember me” cookie, and stored XSS attacks. SonarSource security researcher **Yaniv Nizry** discovered and reported the flaw, prompting Jenkins to**release fixes in versions 2.442 and LTS 2.426.3** by disabling the vulnerable feature. Provided the binary secrets can be extracted, Jenkins says it could open the door to various attacks – - Remote code execution via Resource Root URLs - Remote code execution via “Remember me” cookie - Remote code execution via stored cross-site scripting (XSS) attacks through build logs - Remote code execution via CSRF protection bypass - Decrypt secrets stored in Jenkins - Delete any item in Jenkins - Download a Java heap dump The**proof-of-concept exploits are already available on GitHub** thus, users must update their installations promptly to mitigate potential risks.

Mitigation

- Until the patch can be applied, users are advised to disable CLI access as a short-term workaround. **References** ‍[https://github.com/h4x0r-dz/CVE-2024-23897](https://github.com/h4x0r-dz/CVE-2024-23897)[https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/ ‍](https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/)[https://thehackernews.com/2024/01/critical-jenkins-vulnerability-exposes.html](https://thehackernews.com/2024/01/critical-jenkins-vulnerability-exposes.html)‍