Cyber Security Threat Summary:
CVE-2023-2868 is a critical command injection vulnerability in Barracuda Email Security Gateway (ESG), a platform used for email management and filtering malicious emails. Threat actors can exploit this vulnerability to compromise Barracuda ESG and access targets' email records and content. The vulnerability involves injecting a malicious reverse shell command via specially crafted TAR files sent via email. A wide range of Barracuda ESG versions, from 5.1.3.007 of 2014 to the present, are affected. The attacks, traced back to at least October 2022 and linked to the China-nexus UNC4841 group, targeted various entities globally, including U.S. government organizations, Chinese IT firms, research institutes in Taiwan, and Pakistani banks. To mitigate, Barracuda recommends patching affected ESG versions, replacing impacted ESGs, and using provided detection tools to identify exploitation attempts.

Security Officer Comments:
Attackers are drawn to email security gateways due to their pivotal role in safeguarding organizations from email-based threats. These gateways are targeted because they control the flow of emails, attachments, and user credentials. By infiltrating these gateways, attackers can manipulate security measures, allowing them to efficiently deliver malware, phishing attempts, and other harmful content through email. Successful breaches offer access to sensitive data, enable prolonged unauthorized presence, and provide a launching point for further attacks within an organization's network. This makes email security gateways an appealing target for cybercriminals aiming to compromise data, launch attacks, and exploit the trust associated with email communication.

Additionally, CISA has a released a MAR (Malware Analysis Report) that includes current Indicators of Compromise.

Suggested Correction(s):
In late May 2023, Barracuda took the initiative to deploy an automated security patch aimed at resolving the command injection issue. This vulnerability enables attackers to compromise the email system and gain unauthorized access to confidential emails. Exploiting this flaw involves manipulating the system using specific files. The article underscores the critical nature of addressing this issue promptly. It provides a detailed breakdown of how the vulnerability functions and offers actionable guidance for mitigation. The article serves as a valuable resource by offering clear instructions on steps to take. It advises users to update their systems and employ specialized tools to detect potential instances of exploitation. Additionally, the article outlines methods to determine if their system has been targeted. These tools offer users a proactive approach to enhancing their security posture.

Link(s):
https://teamt5.org/en/posts/cve-2023-2868-barracuda-email-security-gateway-vulnerability/