SysAid Zero-Day Exploited to Deploy Ransomware
Coalition Security Labs, our security research and innovation center, has been monitoring the events surrounding the latest zero-day critical vulnerability in SysAid. SysAid publicly disclosed the vulnerability on November 8, 2023, which is being widely compared to the high-profile compromise of MOVEit over the summer because threat actors have been observed deploying ransomware commonly associated with CL0p.
What happened?
SysAid is a popular IT service automation software that organizations use to manage services such as help desk requests, asset tracking, etc.
Microsoft Threat Intelligence discovered the vulnerability (CVE-2023-47246) and identified the threat actor as Lace Tempest, a threat actor known to deploy Cl0p ransomware. Microsoft notified SysAid about the vulnerability, and SysAid immediately issued a patch available in version 23.3.36.
Looking at our honeypot data, we saw light reconnaissance activity as far back as March 2023 and a second group of honeypot contacts near the end of June 2023. Upon closer inspection, the March traffic looks to have originated from a German company that performs attack surface monitoring. The company appears legitimate, but it raises questions about why they were searching for SysAid at that time.
The contact with our honeypots near the end of June has a more interesting origin: a mobile phone network in China. The origin of the IP addresses, combined with a unique user agent, suggests that the party performing reconnaissance was using a proxy network as a platform for scanning from China.
The unique user agent, however, allowed us to take a more in-depth look at the other items that the party was looking to exploit: mostly Java and PHP applications. The unique user agent pinged our honeypot for 28 minutes, logging 2,446 requests on 929 unique paths. From a frequency perspective, the search for SysAid was the 42nd most popular on the targeted honeypot.
Coalition Security Labs has not seen the unique user agent since June 2023. Given the wide array of technologies that were being targeted, SysAid was unlikely the primary target. When we observed targeting against MOVEit, it appeared to be much more precise and calculated than this scanning activity.
How does the vulnerability work?
According to SysAid, CVE-2023-47246 is a path traversal vulnerability that allows threat actors to access files on a web server, leading to unauthorized code execution. They also shared technical details about the vulnerability uncovered during an investigation by incident response firm Profero.
Threat actors uploaded a Web Application Resource (WAR) containing a WebShell, an interface that allows a web server to be remotely accessed, to the SysAid Tomcat web service. The WebShell gave threat actors control over affected systems, allowing them to deploy malware, and according to SysAid, the investigation observed threat actors deploying the GraceWire malware loader commonly associated with CL0p. After deploying malware, threat actors used a PowerShell script to remove evidence from compromised systems.
SysAid has released guidance for patching this vulnerability. The most important part of this guidance is as follows:
Update systems running SysAid to version 23.3.36, which includes the patches for the identified vulnerability.
Conduct a thorough compromise assessment of SysAid servers to look for any of the listed indicators of compromise (IOCs).
Review any credentials or other information that would have been available to someone with full access to SysAid servers and check any relevant activity logs for suspicious behavior.
How Coalition is responding
Whenever a new zero-day vulnerability is published, our first step is to use our existing honeypot and scan data to identify policyholders utilizing the vulnerable technology.
We notified affected policyholders on November 9, 2023. Because threat actors are deleting activity logs, Coalition Incident Response (CIR), an affiliate of Coalition, Inc., will also proactively contact policyholders running the impacted version of SysAid.
Coalition Security Labs will use the information around this vulnerability and our honeypot data to improve our ability to identify potential threats before they emerge.
Organizations should follow SysAid’s guidance for patching to the current version and reviewing their systems for IOCs. If any Coalition policyholders are running an unpatched version of SysAid, CIR will contact them to rule out a potential infection.
Impacted parties can learn about specific vulnerabilities impacting their digital infrastructure through Coalition Control™. Included in Control is Vendor and Third-Party Monitoring, a feature that allows organizations to keep a careful eye on the companies and suppliers they partner with, helping to mitigate the risk of supply chain disruptions. These insights can help security decision-makers understand the ramifications of third-party risk for their organizations and respond accordingly.
