Sensor Intel Series: Top CVEs in June 2023

The Sensor Intel Series is created in partnership with Efflux , who maintains a globally distributed network of sensors from which we derive attack telemetry.

---------------------------------------------

This month’s story in vulnerability targeting trends is one of stability. Even though two of the top ten vulnerabilities changed in June compared with May, and a few vulnerabilities more than doubled in volume, all of the change was minor in the big picture. We did, however, identify a few vulnerabilities that were novel to us, and added four more signatures.

June Vulnerabilities by the Numbers

Figure 1 shows the top ten vulnerabilities by traffic for the month of June. Most of these are old friends by now: CVE-2020-8958 (GPON router), CVE-2017-9841 (PHPUnit), and several others are commonplace in the top ten. On the other hand, both CVE-2019-9082 (ThinkPHP) and CVE-2013-6397 (Apache Solr) more than doubled compared with May, putting them in the top ten for the first time in a while.

Table 1 displays the traffic volume for all of the vulnerabilities that showed up in our systems in either June or July. Note that we track 71 vulnerabilities and this list only shows 50—20 CVEs are present in our data at some point but didn’t show up for the last two months. As a reminder, last month we started including CVSS v3.x and Exploit Prediction Scoring System (EPSS) scores to cross-reference with our own observations. Since EPSS scores vary over time, these scores were collected on 1 July 2023, at the end of our period of observation.

Table 1. Traffic volumes, change from the previous month, CVSS and EPSS scores for all vulnerabilities that were targeted in either May or June 2023.

One of the more interesting things in Table 1 is the low EPSS score of CVE-2022-24847. This was the third-most targeted CVE in our data last month, but the EPSS likelihood of future exploitation is a mere 1%. There could be many explanations for this—the score was slightly higher, around 2.6%, shortly after the vulnerability was released in April 2022, but subsided around 1% or lower by the beginning of May 2022. While we will never know why this particular vulnerability seems so uninteresting to EPSS when it is clearly being exploited in the wild, this shouldn’t be taken as an indictment of the efficacy of EPSS, which has been proven at scale.¹ Perhaps our observations will help refine EPSS parameter weights in the future.

Targeting Trends

To better illustrate how June contrasts with previous months, Figure 2 shows how fourteen of the most heavily targeted vulnerabilities (the top five from each month of the past year) have ebbed and flowed in terms of attack volume and rank. Note that in this view two vulnerabilities stand out for their rapid growth: CVE-2019-9082 and CVE-2021-3129.

Figure 2. Evolution of vulnerability targeting trends over previous twelve months. This plot shows fourteen vulnerabilities which collectively represent the monthly top five for all twelve months. The rapid growth of CVE-2019-9082 and CVE-2021-3129 are visible in June.

Long Term Trends

Figure 3 shows traffic volume for the past year for all 70 of the tracked CVEs. Note the log10 scale on the y-axis. Other than some of the fluctuations we’ve discussed in above figures, not much changed last month.

Figure 3. Traffic volume by vulnerability. June 2023 did not see much significant change in traffic volume for any notable CVEs.

Conclusions

The comparative stability in attacker trends according to our data brings to mind an analysis we looked at earlier this year. In February 2023 we published a report in collaboration with the Cyentia Institute² examining the long-term history and evolution of the CVE Landscape. Figure 4, below, is an analysis from that report which plots the density with which CWEs were assigned to CVEs over time. In essence this figure shows the degree of dominance that any one type of vulnerability had over the landscape of new vulnerabilities at that time.

Figure 4. CWEs by percentage of CVEs published per quarter. Note the comparative diversity of CWEs in more recent CVEs as compared with the period 2005-2016.

The most glaring example of a predominant vulnerability type is visible in the top row, which is CWE-79: Improper Neutralization of Input During Web Page Generation, more commonly known as cross-site scripting (XSS). Cross-site scripting dominated the field of CVEs from 2011-2016, at times making up 60% of published vulns in a quarter. SQL injection was nearly as predominant from late 2007 to mid-2009.

In contrast to this, we currently abide in a period of expanding CWE diversity, with no one vulnerability type predominant. We haven’t yet had the time to explore the CWEs of the CVEs we track, but the trends in this latest traffic are also a reminder that old vulnerabilities never go away—witness the 10 year old Apache Solr CVE in our top ten this month. So while new vulnerabilities come from a much broader set of types, old favorites will most likely be one of these predominant types. We don’t have any answers on this line of inquiry at the moment, but we mention this CWE analysis just as another way to think about patterns and trends in terms of vulnerability management. And with that, we’ll see you in August, when the attackers will hopefully have done something more interesting.