.webp)
A zero-day vulnerability has been identified in SysAid On-Prem Software known as CVE-2023-47246. Not much information is available about this vulnerability in the National Vulnerability Database, but SysAid has provided a blog post explaining the situation. On November 2nd, 2023, a potential vulnerability on their on-premises software was brought to their attention. Through internal and third-party services, they concluded that a zero-day vulnerability existed in the SysAid On-Prem Software. The vulnerability was identified as a path traversal vulnerability leading to code execution which was exploited by a threat actor known as Lace Tempest, identified by the Microsoft Threat Intelligence team.
This is a zero-day vulnerability with evidence of active exploitation. An explanation of the exploitation has been provided by the vendor along with exploit scripts, potentially increasing the chance of this vulnerability being exploited further. The vendor has provided a patch for this vulnerability which should be applied promptly. If exploited there is a high chance that malware will be implanted into the targeted systems as explained in their advisory.
It is recommended to review your organization’s software inventory to identify if they utilize SysAid On-Prem Software. If you do, a patching campaign alongside an internal investigation to search for potential evidence of exploitation should be conducted.
A patch has been made available for this vulnerability. Documentation for installing the latest version is supplied at this article.
Along with patching it is recommended by the vendor to conduct a thorough compromise assessment of your SysAid server to look for any indicators of compromise. Alongside this reviewing any credentials or information that would have been available had full access to the server had been achieved as well as checking activity logs for suspicious behavior.
Exploitation of this vulnerability could be a massive detriment to day-to-day operations. It affects a business-critical workflow, automation, and ticketing system and if exploited installation of malware/ransomware is inevitable. Monetary loss will occur during incident response and disaster recovery due to the cost of such activities as well as potential loss in productivity due to lack of access to the service desk system.
Patch: A patching campaign should be started as soon as possible as evidence of active exploitation has been found for this vulnerability. A patch is available and must be applied to remediate this vulnerability.
Look for indicators of compromise: It is recommended that an investigation occurs to search for any indicators of compromise in the affected system. The vendor supplied indicators of compromise in their advisory.
https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
