Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868)

AI Analysis

Indicators of Compromise

• vulnerability: CVE-2023-2868
• domain: xxl17z.dnslog.cn
• domain: mx01.bestfindthetruth.com
• domain: troublendsef.com
• domain: togetheroffway.com
• domain: singnode.com
• domain: singamofing.com
• domain: goldenunder.com
• domain: gesturefavour.com
• domain: fessionalwork.com
• domain: bestfindthetruth.com
• ip: 64.176.7.59
• ip: 64.176.4.234
• ip: 51.91.79.17
• ip: 45.154.253.154
• ip: 45.154.253.153
• ip: 45.148.16.46
• ip: 45.148.16.42
• ip: 38.60.254.165
• ip: 38.54.113.205
• ip: 38.54.1.82
• ip: 37.9.35.217
• ip: 23.224.78.134
• ip: 23.224.78.133
• ip: 23.224.78.132
• ip: 23.224.78.131
• ip: 23.224.78.130
• ip: 23.224.42.29
• ip: 216.238.112.82
• ip: 213.156.153.34
• ip: 199.247.23.80
• ip: 198.2.254.223
• ip: 198.2.254.222
• ip: 198.2.254.221
• ip: 198.2.254.220
• ip: 198.2.254.219
• ip: 195.234.82.132
• ip: 192.74.254.229
• ip: 192.74.226.142
• ip: 185.243.41.209
• ip: 182.239.114.254
• ip: 155.94.160.95
• ip: 139.84.227.9
• ip: 137.175.78.66
• ip: 137.175.60.253
• ip: 137.175.60.252
• ip: 137.175.53.218
• ip: 137.175.53.170
• ip: 137.175.53.17
• ip: 137.175.51.147
• ip: 137.175.30.86
• ip: 137.175.30.36
• ip: 137.175.28.251
• ip: 137.175.19.25
• ip: 113.52.106.3
• ip: 107.148.223.196
• ip: 107.148.219.55
• ip: 107.148.219.53
• ip: 107.148.219.227
• ip: 104.223.20.222
• ip: 103.93.78.142
• ip: 103.77.192.13
• ip: 103.27.108.62
• ip: 101.229.146.218
• hash: f289b565839794fe4f450ed0c9343b8fb699f97544d9af2a60851abc8b4656e0
• hash: caab341a35badbc65046bd02efa9ad2fe2671eb80ece0f2fa9cf70f5d7f4bedc
• hash: ca72fa64ed0a9c22d341a557c6e7c1b6a7264b0c4de0b6f717dd44bddf550bca
• hash: 9f04525835f998d454ed68cfc7fcb6b0907f2130ae6c6ab7495d41aa36ad8ccf
• hash: 9bb7addd96f99a29658aca9800b66046823c5ef0755e29012983db6f06a999cf
• hash: 949d4b01f31256e5e9c2b04e557dcca0a25fc2f6aa3618936befc7525e1df788
• hash: 8c5c8e7b3f8ab6651b906356535bf45992d6984d8ed8bd600a1a056a00e5afcb
• hash: 8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347
• hash: 83ca636253fd1eb898b244855838e2281f257bbe8ead428b69528fc50b60ae9c
• hash: 601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80
• hash: 56e8066bf83ff6fe0cec92aede90f6722260e0a3f169fc163ed88589bffd7451
• hash: 4028eadf4c27b4007930606551e3a32b2af23d746d5b866cc1c6587e7fd0d776
• hash: 3ff3250e07ad74fa419e4a8d6564357b22683d152cd8e9f106c8da3751ea9ff3
• hash: 3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115
• hash: 2a5de691243f2b91f164c3021c157fbd783b4f3e7d5f5950182e52ec868cd40b
• hash: 1c6cad0ed66cf8fd438974e1eac0bc6dd9119f84892930cb71cb56a5e985f0a4
• hash: fda9dfa7b41a05c6ae32f71f2b31a5d56d7eca9b
• hash: dc5841d8ed9ab8a5f3496f2258eafb1e0cedf4d3
• hash: cf22082532d4d6387ea1c9bc4dc5b255aa7a0290
• hash: c71d363472d927cf13674e95b79d4d38b3fed754
• hash: c637a9ce65083b21c834e7a68bd1bc51b412fa11
• hash: 87df97d6214aecb5c395d84c3a35f359a90ad716
• hash: 77b1864c489affe0ac2284135050373951b7987e
• hash: 6505513ca06db10b17f6d4792c30a53733309231
• hash: 5ce46efc6b28bd94955138833dc97916957dbde1
• hash: 290e5cb4d32f97963bdc95ef2cc4b44a4de5666d
• hash: 254b6bcbc5f60e30c596c263b8a4f393badbf1aa
• hash: 1cca66cb1f4527eaffbcfeb2237922c93b332d64
• hash: 191e16b564c66b3db67f837e1dc5eac98ff9b9ef
• hash: 1903a3553bcb291579206b39e7818c77e2c07054
• hash: 10b621c5e07648bd7a7391e569aa62a510be82f4
• hash: 0ea36676bd7169bcbf432f721c4edb5fde0a46a9
• hash: ff005f1ff98ec1cd678785baa0386bd1
• hash: fe1e2d676c91f899b706682b70176983
• hash: fe031a93c84aa3d01e2223a6bb988fa0
• hash: f6857841a255b3b4e4eded7a66438696
• hash: f667939000c941e5b9dc91303c98b7fc
• hash: f5ab04a920302931a8bd063f27b745cc
• hash: ef00c92fa005c2f61ec23d5278a8fa25
• hash: ed648c366b6e564fc636c072bbcac907
• hash: ec0d46b2aa7adfdff10a671a77aeb2ae
• hash: e80a85250263d58cc1a1dc39d6cf3942
• hash: e68cd991777118d76e7bce163d8a2bc1
• hash: e52871d82de01b7e7f134c776703f696
• hash: e4e86c273a2b67a605f5d4686783e0cc
• hash: dde2d3347b76070fff14f6c0412f95ba
• hash: db4c48921537d67635bb210a9cb5bb52
• hash: da06e7c32f070a9bb96b720ef332b50b
• hash: d8e748b1b609d376f57343b2bde94b29
• hash: d81263e6872cc805e6cf4ca05d86df4e
• hash: d1392095086c07bd8d2ef174cb5f6ca8
• hash: d098fe9674b6b4cb540699c5eb452cb5
• hash: ce67bb99bc1e26f6cb1f968bc1b1ec21
• hash: cd2813f0260d63ad5adf0446253c2576
• hash: cd2813f0260d63ad5adf0446253c2172
• hash: cb0f7f216e8965f40a724bc15db7510b
• hash: c9ae8bfd08f57d955465f23a5f1c09a4
• hash: c979e8651c1f40d685be2f66e8c2c610
• hash: c7a89a215e74104682880def469d4758
• hash: c5c93ba36e079892c1123fe9dffd660f
• hash: c56d7b86e59c5c737ee7537d7cf13df1
• hash: c528b6398c86f8bdcfa3f9de7837ebfe
• hash: c2e577c71d591999ad5c581e49343093
• hash: bef722484288e24258dd33922b1a7148
• hash: ba7af4f98d85e5847c08cf6cefdf35dc
• hash: b860198feca7398bc79a8ec69afc65ed
• hash: b745626b36b841ed03eddfb08e6bb061
• hash: b601fce4181b275954e3f35b18996c92
• hash: b354111afc9c6c26c1475e761d347144
• hash: ad1dc51a66201689d442499f70b78dea
• hash: ac4fb6d0bfc871be6f68bfa647fc0125
• hash: a45ca19435c2976a29300128dc410fd4
• hash: a28de396aa91b7faca35e861b634c502
• hash: a08a99e5224e1baf569fda816c991045
• hash: 9bc6d6af590e7d94869dee1d33cc1cae
• hash: 9aa90d767ba0a3f057653aadcb75e579
• hash: 94b6f76da938ef855a91011f16252d59
• hash: 9033dc5bac76542b9b752064a56c6ee4
• hash: 8fdf3b7dc6d88594b8b5173c1aa2bc82
• hash: 8fc03800c1179a18fbd58d746596fa7d
• hash: 8f1c40bd3ab33d517839ca17591d8666
• hash: 881b7846f8384c12c7481b23011d8e45
• hash: 878cf1de91f3ae543fd290c31adcbda4
• hash: 87847445f9524671022d70f2a812728f
• hash: 85c5b6c408e4bdb87da6764a75008adf
• hash: 858174c8f4a45e9564382d4480831c6b
• hash: 8406f74ac2c57807735a9b86f61da9f9
• hash: 831d41ba2a0036540536c2f884d089f9
• hash: 830fca78440780aef448c862eee2a8ac
• hash: 82eaf69de710abdc5dea7cd5cb56cf04
• hash: 827d507aa3bde0ef903ca5dec60cdec8
• hash: 806250c466824a027e3e85461dc672db
• hash: 7ebd5f3e800dcd0510cfcbe2351d3838
• hash: 7d7fd05b262342a9e8237ce14ec41c3b
• hash: 76811232ede58de2faf6aca8395f8427
• hash: 724079649f690ca1ee80b8b3125b58b9
• hash: 6f79ef58b354fd33824c96625590c244
• hash: 69ef9a9e8d0506d957248e983d22b0d5
• hash: 694cdb49879f1321abb4605adf634935
• hash: 683acdb559bbc7fb64431d1f579a8104
• hash: 67a4556b021578e0a421fdc251f07e04
• hash: 666da297066a2596cacb13b3da9572bf
• hash: 64c690f175a2d2fe38d3d7c0d0ddbb6e
• hash: 61514ac639721a51e98c47f2ac3afe81
• hash: 5fdee67c82f5480edfa54afc5a9dc834
• hash: 5d6cba7909980a7b424b133fbac634ac
• hash: 5392fb400bd671d4b185fb35a9b23fd3
• hash: 4ec4ceda84c580054f191caa09916c68
• hash: 4cd0f3219e98ac2e9021b06af70ed643
• hash: 4ca4f582418b2cc0626700511a6315c0
• hash: 4c1c2db989e0e881232c7748593d291e
• hash: 4b511567cfa8dbaa32e11baf3268f074
• hash: 479315620c9a5a62a745ab586ba7b78c
• hash: 45b79949276c9cb9cf5dc72597dc1006
• hash: 4495cb72708f486b734de6b6c6402aba
• hash: 446f3d71591afa37bbd604e2e400ae8b
• hash: 436587bad5e061a7e594f9971d89c468
• hash: 42722b7d04f58dcb8bd80fe41c7ea09e
• hash: 407738e565b4e9dafb07b782ebcf46b0
• hash: 3e3f72f99062255d6320d5e686f0e212
• hash: 3c20617f089fe5cc9ba12c43c6c072f5
• hash: 3b93b524db66f8bb3df8279a141734bb
• hash: 35cf6faf442d325961935f660e2ab5a0
• hash: 35a432e40da597c7ab63ff16b09d19d8
• hash: 349ca242bc6d2652d84146f5f91c3dbb
• hash: 336c12441b7a678280562729c974a840
• hash: 32ffe48d1a8ced49c53033eb65eff6f3
• hash: 3273a29d15334efddd8276af53c317fb
• hash: 2e30520f8536a27dd59eabbcb8e3532a
• hash: 2d841cb153bebcfdee5c54472b017af2
• hash: 2ccb9759800154de817bf779a52d48f8
• hash: 23f4f604f1a05c4abf2ac02f976b746b
• ip: 45.63.76.67
• ip: 155.94.160.72
• ip: 107.173.62.158
• ip: 107.148.219.54
• ip: 104.156.229.226
• ip: 103.77.192.88
• ip: 103.146.179.101
• ip: 182.239.114.135
• ip: 107.148.149.156
• vulnerability: CVE-2023-2868
• text: A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.
• datetime: 2023-06-01T20:14:00+00:00
• float: 9.8
• text: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• datetime: 2023-05-24T19:15:00+00:00
• text: Published
• cpe: cpe:2.3:o:barracuda:email_security_gateway_300_firmware:*:*:*:*:*:*:*:*
• cpe: cpe:2.3:h:barracuda:email_security_gateway_300:-:*:*:*:*:*:*:*
• cpe: cpe:2.3:o:barracuda:email_security_gateway_400_firmware:*:*:*:*:*:*:*:*
• cpe: cpe:2.3:h:barracuda:email_security_gateway_400:-:*:*:*:*:*:*:*
• cpe: cpe:2.3:o:barracuda:email_security_gateway_600_firmware:*:*:*:*:*:*:*:*
• cpe: cpe:2.3:h:barracuda:email_security_gateway_600:-:*:*:*:*:*:*:*
• cpe: cpe:2.3:o:barracuda:email_security_gateway_800_firmware:*:*:*:*:*:*:*:*
• cpe: cpe:2.3:h:barracuda:email_security_gateway_800:-:*:*:*:*:*:*:*
• cpe: cpe:2.3:o:barracuda:email_security_gateway_900_firmware:*:*:*:*:*:*:*:*
• cpe: cpe:2.3:h:barracuda:email_security_gateway_900:-:*:*:*:*:*:*:*
• link: https://status.barracuda.com/incidents/34kx82j5n4q9
• link: https://www.barracuda.com/company/legal/esg-vulnerability
• weakness: CWE-77
• text: Improper Neutralization of Special Elements used in a Command ('Command Injection')
• text: Draft
• text: Class
• text: 76
• text: Manipulating Web Input to File System Calls
• text: An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
• text: Program must allow for user controlled variables to be applied directly to the filesystem
• text: Design: Enforce principle of least privilege. Design: Ensure all input is validated, and does not contain file system commands Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Design: For interactive user applications, consider if direct file system interface is necessary, instead consider having the application proxy communication. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.
• weakness: CWE-15
• weakness: CWE-22
• weakness: CWE-23
• weakness: CWE-264
• weakness: CWE-272
• weakness: CWE-285
• weakness: CWE-346
• weakness: CWE-348
• weakness: CWE-59
• weakness: CWE-715
• weakness: CWE-73
• weakness: CWE-74
• weakness: CWE-77
• text: 248
• text: Command Injection
• text: An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.
• text: The target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concatenated to a constant string defined by the application to form the full command to be executed.
• text: All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary. Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter. Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself.
• weakness: CWE-77
• text: 40
• text: Manipulating Writeable Terminal Devices
• text: This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.
• text: User terminals must have a permissive access control such as world writeable that allows normal users to control data on other user's terminals.
• text: Design: Ensure that terminals are only writeable by named owner user and/or administrator Design: Enforce principle of least privilege
• weakness: CWE-77
• text: 43
• text: Exploiting Multiple Input Interpretation Layers
• text: An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
• text: User input is used to construct a command to be executed on the target system or as part of the file name. Multiple parser passes are performed on the data supplied by the user.
• text: An iterative approach to input validation may be required to ensure that no dangerous characters are present. It may be necessary to implement redundant checking across different input validation layers. Ensure that invalid data is rejected as soon as possible and do not continue to work with it. Make sure to perform input validation on canonicalized data (i.e. data that is data in its most standard form). This will help avoid tricky encodings getting past the filters. Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist would not be permitted to enter into the system.
• weakness: CWE-171
• weakness: CWE-179
• weakness: CWE-181
• weakness: CWE-183
• weakness: CWE-184
• weakness: CWE-20
• weakness: CWE-697
• weakness: CWE-707
• weakness: CWE-74
• weakness: CWE-77
• weakness: CWE-78
• text: 136
• text: LDAP Injection
• text: An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.
• text: The target application must accept a string as user input, fail to sanitize characters that have a special meaning in LDAP queries in the user input, and insert the user-supplied string in an LDAP query which is then processed.
• text: Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as LDAP content. Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about an error without disclosing information about the LDAP or application.
• weakness: CWE-20
• weakness: CWE-77
• weakness: CWE-90
• text: 15
• text: Command Delimiters
• text: An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
• text: Software's input validation or filtering must not detect and block presence of additional malicious command.
• text: Design: Perform allowlist validation against a positive specification for command length, type, and parameters. Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged account Implementation: Perform input validation for all remote content. Implementation: Use type conversions such as JDBC prepared statements.
• weakness: CWE-138
• weakness: CWE-140
• weakness: CWE-146
• weakness: CWE-154
• weakness: CWE-157
• weakness: CWE-184
• weakness: CWE-185
• weakness: CWE-697
• weakness: CWE-713
• weakness: CWE-77
• weakness: CWE-78
• weakness: CWE-93
• text: 183
• text: IMAP/SMTP Command Injection
• text: An attacker exploits weaknesses in input validation on IMAP/SMTP servers to execute commands on the server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands.
• text: The target environment must consist of a web-mail server that the attacker can query and a back-end mail server. The back-end mail server need not be directly accessible to the attacker. The web-mail server must fail to adequately sanitize fields received from users and passed on to the back-end mail server. The back-end mail server must not be adequately secured against receiving malicious commands from the web-mail server.
• weakness: CWE-77
• text: 75
• text: Manipulating Writeable Configuration Files
• text: Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
• text: Configuration files must be modifiable by the attacker
• text: Design: Enforce principle of least privilege Design: Backup copies of all configuration files Implementation: Integrity monitoring for configuration files Implementation: Enforce audit logging on code and configuration promotion procedures. Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD
• weakness: CWE-346
• weakness: CWE-349
• weakness: CWE-353
• weakness: CWE-354
• weakness: CWE-713
• weakness: CWE-77
• weakness: CWE-99
• link: https://www.mandiant.com/resources/blog/unc4841-post-barracuda-zero-day-remediation
• text: Blog