.webp)
Barracuda has an ongoing investigation regarding a threat actor exploiting an arbitrary code execution vulnerability affecting its Email Security Gateway Appliance (ESG). The vulnerability, tracked as CVE-2023-7102, is a zero-day which affects an open-source third-party library called Speadsheet::ParseExcel. Using this library, attackers can deploy a specially crafted Excel email attachment to targeted ESG devices.
This vulnerability is still under analysis, but there is evidence of exploitation as well as proof of concept exploit code available. There is a high chance that if an organization is vulnerable there will be attempts to exploit this vulnerability.
This vulnerability impacts the Speadsheet:ParseExcel Perl Module version 0.65.
If this Perl library is used in your organization, apply updates to Barracuda ESG devices. Manual mitigations may need to be applied to custom in-house solutions to mitigate the threat from this vulnerable Perl library.
No action is required from Barracuda ESG users because an update was applied automatically on December 21st. Indicators of compromise are available. If you believe you either use Barracuda ESG or use the Speadsheet:ParseExcel Perl Module review using the indicators provided in Barracuda’s advisory.
If this vulnerability is exploited, arbitrary code that has a good chance of leading to the installation of malware will likely be executed. Multiple strains of malware use this vulnerability and can result in persistent access, email scanning, credential harvesting, and data exfiltration.
We recommend tracking this vulnerability and using the Spreadsheet::ParseExcel Perl Module within your organization. An in-house mitigation may need to be applied and further research must be done for a full mitigation. Review the page for the ParseExcel Perl module for any updates.
Ensure updates are applied: If you use the Barracuda ESG appliance ensure updates have been applied to mitigate this vulnerability.
https://www.barracuda.com/company/legal/esg-vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2023-7102
https://metacpan.org/pod/Spreadsheet::ParseExcel
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
