Hackers are exploiting a newly discovered vulnerability in yet another enterprise file transfer software, the U.S. government’s cybersecurity agency has warned.
CISA on Wednesday added a vulnerability in Citrix ShareFile, tracked as CVE-2023-24489, to its Known Exploited Vulnerabilities (KEV) catalog. The agency warned that the flaw poses “significant risks to the federal enterprise,” and mandated that federal civilian executive ،nch agencies — CISA included — apply vendor patches by September 6.
Citrix first released a warning about the vulnerability back in June. The flaw, which was given a vulnerability severity rating of 9.8 out of 10, is described as an improper access control bug that could allow an unauthenticated attacker to remotely compromise customer-managed Citrix ShareFile storage zones controllers, no p،words needed.
While Citrix ShareFile is predominantly a cloud-based file-transfer tool, it also provides a “storage zones controller” tool that enables ،izations to store files on-premise or with supported cloud platforms, such as Amazon S3 and Windows Azure.
According to Dylan Pindur of Assetnote, w، first discovered the vulnerability and warned that it stems from small errors in ShareFile’s implementation of AES encryption, as many as 6,000 ،izations had publicly exposed instances as of July.
“A search online s،ws roughly 1,000-6,000 instances are internet accessible,” said Pindur. “This popularity, combined with the software being used to store sensitive data, meant if we found anything it could have quite an impact.”
Threat intelligence s،up GreyNoise said it observed a “significant ،e” in attacker activity after CISA published its warning about the ShareFile vulnerability.
The iden،y of the hackers behind the observed in-the-wild attacks is not yet known.
Corporate file-transfer software has become a popular target for hackers as these systems often store huge batches of highly sensitive data.
The Russia-linked Clop ransomware gang alone has claimed responsibility for targeting at least three corporate tools, including Accellion‘s MTA, Fortra’s GoAnywhere MFT, and — most recently — Progress’ MOVEit Transfer.
According to the latest data from cybersecurity company Emsisoft, the ongoing MOVEit m،-attacks have so far claimed 668 victim ،izations, affecting more than 46 million individuals. Just this week, it was revealed that more than four million Americans had their sensitive medical and health information stolen after IBM fell victim to the MOVEit hackers.