National Cyber Warfare Foundation (NCWF) Forums


Vesra File Type Upload Vulnerability Lets Attackers Gain Sys-Admin Access from MSP


0 user ratings
2024-08-27 07:34:26
milo
Red Team (CNA)

A critical vulnerability has been identified in Versa Director, a vital component of the company’s SD-WAN solution. The vulnerability, officially designated as CVE-2024-39717, allows attackers to upload potentially malicious files, granting them system administrator access. This issue explicitly affects users with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges. Exploitation and Impact An Advanced Persistent Threat (APT) actor has […]


The post Vesra File Type Upload Vulnerability Lets Attackers Gain Sys-Admin Access from MSP appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.



A critical vulnerability has been identified in Versa Director, a vital component of the company’s SD-WAN solution.





The vulnerability, officially designated as CVE-2024-39717, allows attackers to upload potentially malicious files, granting them system administrator access.





This issue explicitly affects users with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges.





Exploitation and Impact





An Advanced Persistent Threat (APT) actor has exploited the vulnerability in at least one known instance.





Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial





Despite being difficult to manipulate, the vulnerability is rated “High.” It poses a significant risk to all Versa SD-WAN customers using Versa Director who have not adhered to the recommended system hardening and firewall guidelines.





The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-39717 to its “Known Exploited Vulnerabilities” list, underscoring the seriousness of the threat.





Affected Systems and Versions





The following versions of Versa Director are affected:





VersionStatus
21.2.3Vulnerable
22.1.2Vulnerable
22.1.3Vulnerable




The root cause of the vulnerability lies in the failure of impacted customers to implement Versa’s established system hardening and firewall guidelines.





These guidelines, published in 2015 and 2017, respectively, are crucial for securing management ports and preventing unauthorized access.





Versa Networks has released a patch to address this vulnerability and is actively working with customers to ensure the patch is applied, and that system hardening guidelines are followed.





Recommended Actions for Versa Customers






  1. Apply Hardening Best Practices: Customers should review and implement Versa’s security hardening guidelines, which include detailed instructions on firewall requirements and system hardening.




  2. Upgrade Versa Director: It is essential to upgrade to one of the remediated software versions to mitigate the vulnerability.




  3. Check for Exploitation: Customers should inspect the /var/versa/vnms/web/custom_logo/ directory for any suspicious file uploads. Running the command file -b –mime-type <.png file> should confirm the file type as “image/png”.





Customers needing patching, system hardening, or remediation are encouraged to contact Versa Technical Support for guidance.





Versa Networks remains committed to its customers’ security and urges all users to take immediate action to protect their systems from potential exploitation.





Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial


The post Vesra File Type Upload Vulnerability Lets Attackers Gain Sys-Admin Access from MSP appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.



Source: gbHackers
Source Link: https://gbhackers.com/vesra-file-type-upload-vulnerability/


Comments
new comment
Nobody has commented yet. Will you be the first?
 
Forum
Red Team (CNA)



Copyright 2012 through 2024 - National Cyber Warfare Foundation - All rights reserved worldwide.