NetScaler, Atlassian, VMWare Disclose Critical Flaws

IT infrastructure mainstays including NetScaler, Atlassain and VMWare on Tuesday released fixes for vulnerabilities including some allowing malicious takeover of appliances.

See Also: Live Webinar | Integrating Splunk and Panther for Real-Time Alerting and Custom Dashboarding

NetScaler – formerly known as Citrix – warned customers of two zero day vulnerabilities that researchers say are being exploited in the wild.

One flaw, tracked as CVE-2023-6548, allows attackers with access to low-privilege accounts to potentially execute remote code on NetScaler ADC and Gateway appliances. The flaw, NetScaler, said, only impact the management interface – which should not be exposed to the internet.

The other flaw, tracked as CVE-2023-6549, could result in denial or service if the appliance is configured as a gateway, such as VPN virtual server.

Only customer-managed NetScaler appliances are impacted; NetScaler-managed cloud services are unaffected.

The Shadowserver Foundation reported finding than 1,400 exposed Netscaler management interfaces on the internet. British cybersecurity researcher Kevin Beaumont downplayed the overall impact of the bugs since they require of access and account rights. “I don’t think they will be impactful, i.e. don’t drop everything, patch as usual, unless the information changes. The RCE one needs management interface access and an account according to Citrix,” Beaumont said on Mastadon.

The U.S. Cybersecurity and Infrastructure Security Agency on Wednesday added the two vulnerabilities to its known exploited vulnerabilities catalog.

Atlassian Patches Critical Bugs

Australian tech firm Atlassian released patches more two dozen vulnerabilities, including a critical remote code execution flaw, tracked as CVE-2023-22527, affecting Confluence Data Center and Confluence Server products.

The Australian Cyber Security Centre issued a security advisory recommending organizations to follow guidance issued by Atlassian.

CVE-2023-22527 is a template injection vulnerability on out-of-date versions of Confluence Data Center and Server instances allowing an unauthenticated attacker remote code execution on an affected version, Atlassian said. The company advised users of out-of-date instances to update their installations to the latest available version.

Security researcher Petrus Viet, credited for discovering this vulnerability, said in a X post that the bug was present in a previous version, meaning those who updated their serves in December are are not affected. The company nonetheless created a CVE for its unpatched customers and awarded a bounty to the researcher.

VMware Patches Aria Automation Flaw

VMWare issued a patch for a bug in VMware Aria Automation, telling customers the flaw “qualifies as an emergency change, necessitating prompt action.” The company said it is not aware of exploits in the wild.

Tracked as CVE-2023-34063, the flaw allows an authenticated attacker to gain access to organizations and workflows. Aria Automation is a multi-cloud provisioning service.