Four CVEs Attackers Exploited in 2020 and How to Mitigate Them
Summary
The article reviews four vulnerabilities exploited in 2020 across Citrix ADC, Pulse Secure VPN, Fortinet SSL VPN, and Windows BITS, outlining their risks and recommended patches or credential changes.
Key points
- CVE-2019-19781 affected Citrix ADC and could enable remote code execution; the article recommends Citrix remediation steps and keeping systems patched.
- CVE-2019-11510 affected Pulse Secure VPN servers, allowing access to sensitive files and credentials; patching and changing credentials on compromised servers are advised.
- CVE-2018-13379 affected Fortinet SSL VPN and could expose clear-text usernames and passwords through path traversal; the article recommends patching and changing passwords.
- CVE-2020-0787 involved Windows BITS mishandling symbolic links, potentially enabling file overwriting and privilege escalation; a patch and least-privilege access are recommended.
Article Details
- Vulnerability Types
- Arbitrary code execution
- Arbitrary file reading
- Path traversal
- Elevation of privilege
- Severity
- Critical for CVE-2018-13379; severity for the other vulnerabilities is not specified.
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Apply available patches for CVE-2019-11510, CVE-2018-13379, and CVE-2020-0787.
- For CVE-2019-19781, follow Citrix's mitigation steps, which the article says involve running commands from the ADC command-line interface.
- Change passwords on compromised servers affected by CVE-2019-11510 or CVE-2018-13379.
- Grant users the lowest level of privileges possible to reduce the risk from privilege-escalation attacks.
MITRE ATT&CK
CVE
People
Vendors
CitrixCVE-2019-19781: Citrix | Arbitrary Code ExecutionFortinetCVE-2018-13379: Fortinet | Path TraversalMicrosoftCVE-2020-0787: Microsoft | Elevation of PrivilegePulse SecureWhat it is: This threat affects Pulse Secure Virtual Private Network (VPN) servers. Threat actors who exploit this vulnerability are able to grab all unencrypted and unauthorized credentials that live on a compromised
Products
Application Delivery Controller (ADC)What it is: This threat impacts Citrix’s Application Delivery Controller (ADC), which is a load balancing application that lives on servers that are used frequently throughout the United States. Because of theFortinet SSL VPNWhat it is: This critical vulnerability affects the Fortinet Secure Sockets Layer (SSL) VPN. It enables attackers to gain access to a sensitive file via path traversal. This effectively gives threat actors the abilityPulse Secure Virtual Private Network (VPN) serversWhat it is: This threat affects Pulse Secure Virtual Private Network (VPN) servers. Threat actors who exploit this vulnerability are able to grab all unencrypted and unauthorized credentials that live on a compromisedWindows Background Intelligent Transfer Service (BITS)What it is: This vulnerability takes advantage of situations when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, or files that point to other files, much like a shortcut.