Summary
Barracuda has an ongoing investigation regarding a threat actor exploiting an arbitrary code execution vulnerability affecting its Email Security Gateway Appliance (ESG). The vulnerability, tracked as CVE-2023-7102, is a zero-day which affects an open-source third-party library called Speadsheet::ParseExcel. Using this library, attackers can deploy a specially crafted Excel email attachment to targeted ESG devices.
Impact Assessment
This vulnerability is still under analysis, but there is evidence of exploitation as well as proof of concept exploit code available. There is a high chance that if an organization is vulnerable there will be attempts to exploit this vulnerability.
This vulnerability impacts the Speadsheet:ParseExcel Perl Module version 0.65.
What it means for you
If this Perl library is used in your organization, apply updates to Barracuda ESG devices. Manual mitigations may need to be applied to custom in-house solutions to mitigate the threat from this vulnerable Perl library.
Remediation
No action is required from Barracuda ESG users because an update was applied automatically on December 21st. Indicators of compromise are available. If you believe you either use Barracuda ESG or use the Speadsheet:ParseExcel Perl Module review using the indicators provided in Barracuda’s advisory.
Business Implications
If this vulnerability is exploited, arbitrary code that has a good chance of leading to the installation of malware will likely be executed. Multiple strains of malware use this vulnerability and can result in persistent access, email scanning, credential harvesting, and data exfiltration.
Access Point Technology Recommends
We recommend tracking this vulnerability and using the Spreadsheet::ParseExcel Perl Module within your organization. An in-house mitigation may need to be applied and further research must be done for a full mitigation. Review the page for the ParseExcel Perl module for any updates.
Ensure updates are applied: If you use the Barracuda ESG appliance ensure updates have been applied to mitigate this vulnerability.
Associated Bulletins
https://www.barracuda.com/company/legal/esg-vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2023-7102
https://metacpan.org/pod/Spreadsheet::ParseExcel
.webp)
.png)
