Date: 9/6/2023 | Prepared by: Jack Rutherford, Chief Technology Officer
The purpose of this alert is to bring attention to a critical security issue identified in Barracuda Networks Email Security Gateway (ESG) physical appliances1. This vulnerability is being tracked with the following Common Vulnerabilities and Exposures (CVE) identifier: CVE-2023-28682.
This vulnerability has been assigned a Common Vulnerability Scoring System (CVSS) score of 9.8 by NIST3.
On 18 May 2023, Barracuda became aware of suspicious network traffic transiting their ESG devices. Upon further investigation and after engaging Google-owned security firm Mandiant, Barracuda concluded that a critical remote command injection vulnerability existed in their ESG product. On 20 May, a patch was deployed to remediate the vulnerability and on 21 May, a script was deployed to try and contain exploitation of the devices.
Importantly, on 6 June 2023, Barracuda sent a notification to all customers to immediately decommission and replace all devices regardless of patch level. Even if the recent patches have been deployed, customers should immediately disconnect the devices.
The updated information from Barracuda informing customers that devices need to be replaced demonstrates that Threat Actors exploiting this vulnerability have been able to obtain persistence at a deep enough level such that wiping the device does not resolve the problem.
The vulnerability has been observed by cyber security firms to have been exploited in the wild since at least October 20224. In several cases, exploitation of this vulnerability has led to data loss and exfiltration, as well as the deployment of ransomware.
From a technical standpoint, the vulnerability exists in a module within the ESG product which screens the attachments of incoming emails. Barracuda have stated “The vulnerability stemmed from incomplete input validation of user supplied .tar files as it pertains to the names of the files contained within the archive. Consequently, a remote attacker could format file names in a particular manner that would result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product5.”
This allows Threat Actors to achieve remote command injection and subsequently execute code on ESG devices for unauthorised access. Utilising the remote command injection, Threat Actors are then deploying malware and persistent backdoors.
The malware observed has been classified by Mandiant as three variants:
A full listing of Indicators of Compromise are available in the Barracuda bulletin:
This vulnerability affects physical Barracuda Networks ESG appliances. All software versions and patch levels are affected.
Triskele Labs recommends immediately disconnecting and replacing physical Barracuda Network ESG appliances.
Unfortunately, this is the only course of action available to mitigate this vulnerability, as devices could already be compromised, even if they are no longer internet facing.
Barracuda have also recommended that users and clients rotate any credentials connected to the ESG appliance, including:
ESG users are also urged to hunt for IOCs provided by Barracuda to check for evidence of compromise.
The Triskele Labs DefenceShield Security Operations Centre (SOC) is monitoring for suspicious activity, for Managed Detection and Response (MDR) clients. IOCs provided by Barracuda have been ingested into Triskele Labs CTI feeds for alerting in SIEM platforms.
Triskele Labs is performing ongoing scanning for DefenceShield Assess clients to detect vulnerable devices in client networks.
For any questions, please reach out to the DefenceShield Security Operations Centre or contact Triskele Labs support.
1 https://www.barracuda.com/company/legal/esg-vulnerability
2 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2868
