Two Cisco Zero-Day Vulnerabilities Exploited

THE THREAT

On April 24th, Cisco, in coordination with the Canadian Center for Cyber Security (CCCS), the Australian Cyber Security Centre (ACSC), and the National Cyber Security Centre (NCSC), disclosed two high-severity vulnerabilities in Cisco products that are under active exploitation.

The vulnerabilities are as follows:

• CVE-2024-20353 (CVSS: 8.6): Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability 
  • The vulnerability in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software would enable an unauthenticated, remote attacker to perform a Denial-of-Service (DoS) attack
• CVE-2024-20359 (CVSS: 6.0): Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability
  • A vulnerability in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software allows an authenticated attacker to execute arbitrary code with root-level privileges

Cisco, along with multiple government agencies, have identified exploitation of both vulnerabilities in a sophisticated, state-sponsored campaign, tracked under the name ArcaneDoor. As exploitation is confirmed, it is critical that organizations apply security patches to all impacted devices as soon as possible. 

What we’re doing about it

• In February 2024, eSentire’s Threat Intelligence team performed threat hunts related to active exploitation based on Indicators of Compromise (IoCs) provided by intelligence sharing partners
  • Threat hunts based on new IoCs have been performed
• New rules have been created and deployed to eSentire MDR for Network
• IP addresses, associated with real-world attacks, are blocked via the eSentire Global Block List
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• eSentire’s Threat Response Unit (TRU) is actively tracking these vulnerabilities for additional details and detection opportunities 

What you should do about it

• After performing a business impact review, apply all relevant security patches
  • As of the time of writing, the most recent versions available are:
    • 9.16.4.57
    • 9.18.4.22
    • 9.20.2.10
• Enable logging on all Cisco ASA devices
• Review all potentially impacted devices for signs of malicious or unusual activity 
• Verify the integrity of Cisco ASA or FTD devices, using the following steps outlined by Cisco 
  1. Log into the suspect device Command Line Interface (CLI). 
     • Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
  2. Use the enable command to change into privileged EXEC mode.
     • Note: On devices that are running Cisco FTD Software, the enable password is blank.
  3. Collect the outputs of the following commands:
     • show version
     • verify /SHA-512 system:memory/text
     • debug menu memory 8
  4. Open a case with the Cisco Technical Assistance Center (TAC). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3

Additional information

At this time, the initial access method used in real-world attacks has not been identified, and investigations are ongoing. According to CCCS, attacks have been confirmed against multiple governments and critical national infrastructure networks. The techniques and capabilities observed in these attacks suggest that they have been carried out by a sophisticated state-sponsored APT group. Attacks have not been attributed to a specific group at this time, and the adversary is currently tracked under the monikers UAT4356 by Talos and STORM-1849 by the Microsoft Threat Intelligence Center.

In ArcaneDoor incidents, threat actors exploited CVE-2024-20353 and CVE-2024-20359 to deliver a previously unidentified webshell dubbed LINE RUNNER and an in-memory implant dubbed LINE DANCER. The LINE RUNNER webshell establishes persistence by abusing CVE-2024-20359 and is capable of running arbitrary Lua code. LINE DANCER is a shellcode loader used to deploy additional payloads. The two threats have been used by threat actors to modify configurations, conduct reconnaissance, capture and exfiltrate network traffic, and perform lateral movement to other systems.

Access, gained via exploitation of these vulnerabilities and malware deployment, allowed threat actors to “generate text versions of the device’s configuration file so that it could be exfiltrated through web requests… control the enabling and disabling of the devices’ syslog service to obfuscate additional commands… [and] modify the authentication, authorization, and accounting (AAA) configuration so that specific actor-controlled devices, matching a particular identification, could be provided access within the impacted environment.”

Cisco reported that in July 2023 threat actors began developing and testing exploits followed by infrastructure stand up in November 2023. In early January 2024, the first confirmed attacks were reported by a victim. Additional attacks continued throughout January and February. On February 1st, eSentire’s Threat Intelligence team received information on the attacks from intelligence sharing partners and performed threat hunts based on this information. An update was sent a week later with additional information that was operationalized by our Threat Response Unit. On April 24th, alongside public disclosure of the vulnerabilities, new detections were deployed to eSentire MDR for Network; threat hunts were performed based on newly available Indicators of Compromise (IoCs).

It should be noted that Cisco addressed a third vulnerability in this release that has not been confirmed to be exploited at this time. CVE-2024-20358 (CVSS: 6.0) - Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection vulnerability. While not exploited at this time, organizations are urged to apply security patches as there is an increased focus, by both threat actors and researchers, which increases the likelihood of real-world attacks in the near future.

References:  

[1]https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response
[2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2
[3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h  
[4] https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
[5] https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns
[6] https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-runner.pdf
[7] https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf