Sensor Intel Series: Top CVEs in September 2022

Figure 3 shows one of our more successful attempts to visualize the traffic in a way that makes it possible to identify moments when a vulnerability hit the big time. The coloration of the curves represents the ratio of a CVE’s traffic in a given month to the previous month. Vulnerabilities that spike in traffic volume are shaded towards green and yellow and vulnerabilities that are static or diminish are shaded in purple.

There are a few dramatic points of growth in Figure 3: CVE-2017-18368 in February, CVE-2020-22947 in April, and the smaller but still noticeable surge in attention in CVE-2021-22986 and CVE-2022-1388.¹ Unfortunately we can’t account for the reasons behind these periods of growth, but at least it is clear which vulnerabilities defenders should be prioritizing.

Port Data

Most of our inquiry is focused on web traffic, but to get a sense of how traffic targeting ports 80 and 443 compares with other ports, Figure 4 shows the traffic volume and ranking for the top ten targeted ports from January to September of this year. Port 5900, which is usually used for Virtual Network Computing, has consistently been targeted more than any other port, but behind that in September were ports 23 (telnet) and 22 (SSH). As we've noted before, the top targeted ports tend to be those used mainly for remote access, followed by database and mail related ports.

Table 2 shows the volume of traffic targeting the top 10 ports in September. The best news here is the disappearance of port 445 (SMB) from the top 10, although it was still ranked 13^th with 0.29% of total traffic.
 

Conclusions

The main conclusion for this month is the same as for every month: we should all patch vulnerabilities as aggressively as possible within the overall risk appetite of our organizations. Seeing a vulnerability (or ports) in our data that applies to your organization should be taken as a signal that attackers have recently stepped up their attention to that vector.

Other than this, it is interesting to see a credential disclosure vulnerability in security infrastructure at the top of the list after months of focus on vulnerabilities of two categories: RCEs and IoT vulnerabilities. 30 months on from the beginning of the pandemic and the onset of the Great Remote Work Experiment, it can be easy to forget what a transformation in attack surface has occurred in the last few years. Because of this, the emergence of CVE-2018-13379 shouldn’t just provoke a review of owners of the Fortinet SSL VPNs, but should provoke a review by everyone into their VPNs and other remote access services.

Recommendations

Technical/Preventative:

• Scan your environment for vulnerabilities aggressively.
• Patch high-priority vulnerabilities (defined however suits you) as soon as feasible.
• Engage a DDoS mitigation service to prevent the impact of DDoS on your organization.

Technical/Detective:

• Use a WAF or similar tool to detect and stop web exploits.
• Monitor anomalous outbound traffic to detect devices in your environment that are participating in DDoS attacks.