Summary
A zero-day vulnerability has been identified in SysAid On-Prem Software known as CVE-2023-47246. Not much information is available about this vulnerability in the National Vulnerability Database, but SysAid has provided a blog post explaining the situation. On November 2nd, 2023, a potential vulnerability on their on-premises software was brought to their attention. Through internal and third-party services, they concluded that a zero-day vulnerability existed in the SysAid On-Prem Software. The vulnerability was identified as a path traversal vulnerability leading to code execution which was exploited by a threat actor known as Lace Tempest, identified by the Microsoft Threat Intelligence team.
Impact Assessment
This is a zero-day vulnerability with evidence of active exploitation. An explanation of the exploitation has been provided by the vendor along with exploit scripts, potentially increasing the chance of this vulnerability being exploited further. The vendor has provided a patch for this vulnerability which should be applied promptly. If exploited there is a high chance that malware will be implanted into the targeted systems as explained in their advisory.
What it means for you
It is recommended to review your organization’s software inventory to identify if they utilize SysAid On-Prem Software. If you do, a patching campaign alongside an internal investigation to search for potential evidence of exploitation should be conducted.
Remediation
A patch has been made available for this vulnerability. Documentation for installing the latest version is supplied at this article.
Along with patching it is recommended by the vendor to conduct a thorough compromise assessment of your SysAid server to look for any indicators of compromise. Alongside this reviewing any credentials or information that would have been available had full access to the server had been achieved as well as checking activity logs for suspicious behavior.
Business Implications
Exploitation of this vulnerability could be a massive detriment to day-to-day operations. It affects a business-critical workflow, automation, and ticketing system and if exploited installation of malware/ransomware is inevitable. Monetary loss will occur during incident response and disaster recovery due to the cost of such activities as well as potential loss in productivity due to lack of access to the service desk system.
Access Point Technology Recommends
Patch: A patching campaign should be started as soon as possible as evidence of active exploitation has been found for this vulnerability. A patch is available and must be applied to remediate this vulnerability.
Look for indicators of compromise: It is recommended that an investigation occurs to search for any indicators of compromise in the affected system. The vendor supplied indicators of compromise in their advisory.
Associated Bulletins
https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
.webp)
.png)
