Vigilance is more than just practice in an ever-changing cybersecurity arena The cybersecurity community has recently been focusing on three important security vulnerabilities, known as CVE-2023-5043 and CVE-2023-5044, CVE-2022-4886 (the most critical) that are related to the NGINX ingress controller for Kubernetes. Such vulnerabilities are reasoned enough for vigorous vulnerability management as well as comprehensive application security procedures.
Data Visualization of and exploitation in various datasets and in the wild
To discover this and other vulnerabilities exploited in the wild and the data behind it explore
The Crux of the Vulnerabilities CVE-2023-5043 and CVE-2023-5044 and CVE-2022-4886
CVE-2023-5043 and CVE-2023-5044 carry CVSS scores of 7.6, reflecting their high-severity status in the realm of application security. These vulnerabilities are particularly concerning because they can be exploited to execute arbitrary commands and inject code, respectively. Such actions could lead to unauthorized access and potential exfiltration of sensitive data, striking at the heart of an organization’s application security posture (ASPM).
CVE-2022-4886, with a CVSS score of 8.8 (now 6.5) is also part of this triad of concerns, allowing ingress-nginx path sanitization to be bypassed. This could enable an attacker with ingress object access to extract Kubernetes API credentials from the ingress controller—a sobering thought for any application security professional.
“After exploiting the vulnerability, Lace Tempest issued commands via the SysAid software to deliver a malware loader for the Gracewire malware,” Microsoft.
Mitigation and Management for CVE-2023-5043 and CVE-2023-5044 and CVE-2022-4886
In response to these vulnerabilities, mitigation strategies have been swiftly disseminated. For CVE-2023-5043 and CVE-2023-5044, and CVE-2022-4886, the recommended course of action involves updating NGINX to version 1.19 and enabling the “–enable-annotation-validation” command-line configuration. This measure is aimed at fortifying the application security posture against such incursions.
Decoding VE-2023-5043 and CVE-2023-5044, and CVE-2022-4886 and its impact in the wild
Focusing on the most critical vulnerability, CVE-2022-4886
- CVSS (rescored) 8.8 -> 5.5 (addressed)
- CTI – 0 Very low (low use)
- EPSS – 0.00075 (very low)
- Exploit Available remote addressable.
The popularity of the vulnerability has decreased since the publication on the 11 and the initial advisory.
Few mention after the patch and release data
The Bigger Picture in Application Security
The discovery of CVE-2023-5043 and CVE-2023-5044 and CVE-2022-4886 is a stark reminder of the complexities surrounding application security in containerized environments like Kubernetes. As organizations increasingly adopt Kubernetes and NGINX for their operational flexibility and scalability, comprehensive ASPM solutions become paramount. These solutions must be capable of not only identifying and mitigating known vulnerabilities but also providing visibility and control over the entire application stack.
How Phoenix Security Can Help
Phoenix Security is a comprehensive security solutions like ASPM and vulnerability management that can cover vulnerabilities from code to the cloud are essential to accelerate vulnerability management and scaling. Phoenix Security is here to automatically ingest vulnerabilities from code to cloud and prioritize vulnerabilities at scale. Phoenix also communicates the timeframe for resolution for the government organizations that must comply with CISA and related regulations.
Phoenix Security serves as a beacon for security professionals aiming to pinpoint the CISA kev and ransomware-related exploits within their systems. It meticulously scans your product, identifying instances where the CISA kev vulnerability may be affected. By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains up to date and focuses on the key vulnerabilities.
Get a Free Assessment today
Previous Issues of Vulnerability Weekly
- Apache Active MQ
- Atlassian Critical Vulnerability Exploited by nation-state CVE-2023-22515
- Critical vulnerability F5
- How to update curl and libcurl without panic fixing
- Critical Vulnerabilities in Atlassian Confluence: Zero-Day
- Detect & Mitigate HTTP/2: Rapid Reset Vulnerabilities
- Understanding the libcue Vulnerability CVE-2023
- Understanding and fixing Curl and libcurl
- MOVEit Transfer breach, Zellis compromise CVE-2023-34362
Other Useful resources
Data Visualization of vulnerabilities in the wild
- CISA KEV: https://phoenix.security/what-is-cisa-kev-main/
- Exploit in the wild: https://phoenix.security/what-is-exploitability/
- OWASP/Appsec Vulnerability: https://phoenix.security/what-is-owasp-main/
- CWE/Appsec Vulnerabilities: https://phoenix.security/what-is-cwe-main/
