Sensor Intel Series: Top CVEs in November 2023

Introduction

Welcome back to the Sensor Intelligence Series, our recurring monthly summary of vulnerability intelligence based on distributed passive sensor data. This time, we added a section that briefly discusses some of the most common scanning traffic that is not strictly vulnerability related, to continue to give more context overall.

This month, we found evidence of two more CVEs in our data, specifically CVE-2018-9995, an authentication bypass in TBK DVR devices, and CVE-202-11625, an information disclosure vulnerability in AvertX Night Vision cameras models HD383 and HD438. Neither of these was seen a great deal, however, so they don’t really come into play for the analysis that follows, except as a general note to say that attacker scans targeting IoT devices continues apace.

So, without any further ado, let’s dig into the changes we saw in November for the CVEs we track.

November Vulnerabilities by the Numbers

Figure 1 shows the traffic for the top 10 CVEs in November. CVE-2022-24847, an RCE in the open-source GeoServer software, and CVE-2022-22947, an RCE in the Spring Cloud Gateway product, rose to our top spots. These are nothing new, the latter having been seen in our data at moderately high levels over at least the last year, and the former having been active since February this year. CVE-2020-8958, a Guangzhou router command injection vulnerability, has thus continued to fall in position, as it did last month. Last month’s top seen vulnerability, CVE-2017-9841, an RCE in PHPUnit, now 5 years old, comes in at fourth position. Overall traffic in the CVEs we track dropped again as it did in October.

Table 1 shows traffic for November, change in traffic from October, CVSS v3.x score, and EPSS scores for 70 CVEs and other vulnerabilities. Our list of vulnerabilities with confirmed attack or scanning traffic currently stands at 84, but 11 vulnerabilities saw no traffic in either October or November and so don’t make this table.

Targeting Trends

To better assess rapid changes in attack traffic, Figure 2 shows a bump plot, which plots both traffic volume and changes in rank. The 12 CVEs (with one category combining two difficult to distinguish CVEs, CVE-2022-41040 and CVE-2021-34473) shown here represent the top five for each of the twelve months. Notable in this month’s plot, as previously mentioned, is the rise of both CVE-2022-24847 and CVE-2022-22947.

Overall Scanning Traffic Changes

As we started last month, we now look at the overall level of scan traffic we received, to place the above data in context. November saw a very slight decline in total traffic, a mere 0.2%, which can at least in part be attributed to the decrease in scanning for CVE-2020-8958.

The full details of the changes in scanning traffic over the last 12 months are shown in the following table.

Long Term Trends

Because Figure 2 only shows high-traffic CVEs, Figure 3 shows traffic for all 84 CVEs we have tracked. In this view, most of our tracked CVEs can be seen to be holding at a relatively steady rate. A few exhibited some more radical changes. CVE-2014-2321 fell to just two events this month, and 9 others (CVE-2018-20062, CVE-2020-25506, CVE-2021-33357, CVE-2020-17505, CVE-2021-20167, CVE-2021-3577, CVE-2020-7796, CVE-2021-21315 and CVE-2018-1000600) all went to zero this month, admittedly from already very low levels.

Common Non-CVE Traffic

It may be easy to conclude from the above figures that even though overall traffic has held steady, CVE exploitation attempts, at least for the CVEs and vulnerabilities we track, has decreased. That’s true, but there is a great deal of traffic that our sensor network sees that is not reflected in the above data. To give a more comprehensive picture, we can note that of the overall traffic in November 2023, approximately 35% of the total traffic was composed of scans attempting to find unsecured files that might contain credentials (such as “/.env” or “/.aws/credentials”), and approximately 9% of the total were scans for PHPMyAdmin web interfaces exposed to the internet, likely as a target for credential stuffing.

We hope to dig further into non-CVE traffic in the future, but until then, take this as a clear message from attackers – it’s not simply CVEs you need to be concerned with. It’s your entire attack surface, which includes files and services incorrectly exposed to the internet.

Conclusions

We again reiterate that our sensors are passive, and they do not respond to requests, nor do they pretend to be any specific platform or software stack. They are simply an open socket on port 80 and 443, with just enough of a webserver to be able to record the requests made to them and negotiate any required TLS connection. They do not have DNS names, although it’s certainly possible they may once have had them. Sometimes IP blocks are reassigned, and old DNS records remain that continue to point to them.

For those new to the Sensor Intelligence Series, we will conclude by repeating some old but valid observations. We see a continuing focus on IoT and router vulnerabilities, as well as easy, essentially one-request remote code execution vulnerabilities. These typically result in the installation of malware, crypto miners, and DDoS bots. Additionally, past CVEs, we see continuous scanning activity that might be most accurately described as reconnaissance; the identification of attack surface, exposed files, and other materials that attackers hope to leverage to enable further attacks. See you in January for our final Sensor Intel Series report covering 2023!