Malicious hackers are increasingly using available proof-of-concept (PoC) exploits to launch attacks. New research from Cloudflare has shown that exploits can be exploited within just 22 minutes of being made public.
Cloudflare, which processes an average of 57 million HTTP requests per second, is seeing increased vulnerability and increased attempts to use available PoC exploits.
During the period under review (May 2023 – March 2024), the most targeted bugs were CVE-2023-50164 and CVE-2022-33891 in Apache products, CVE-2023-29298, CVE-2023-38203 and CVE-2023-26360 in Coldfusion, and CVE-2023-35082 in MobileIron.
See also: Escape Exploit for Chrome Sandbox sells for $1 million
A prime example of the use of PoC exploits right away is the use of CVE-2024-27198, an authentication bypass bug found in JetBrains TeamCity. Cloudflare observed a hacker deploying an exploit using a PoC just 22 minutes after it was published. This meant that system defenders had no time to react.
According to Cloudflare, the only way to combat this speed is to use AIto rapidly develop effective detection rules.
“The speed of exploitation of disclosed CVEs is often faster than the speed at which humans can create WAF rules or patches,” Cloudflare explains in the report. “This also applies to our own team of internal security who maintain the WAF Managed Ruleset, which has allowed us to combine human capabilities with an ML-based approach to achieve the best balance between low false positives and speed of response.”
See also: Fortra FileCatalyst Workflow: PoC exploit for SQLi vulnerability
Impacts of rapid use of PoC exploits
When PoC exploits are deployed so quickly, businesses face an increased risk of their systems being compromisedwithout having time to implement security patches or other defenses. This means organizations can find themselves exposed to attacks that could have been prevented.
The speed with which threat actors exploit PoC exploits can lead to loss of confidential data, financial losses, and damage to a company's reputation. These attacks can include data, ransomware, or even system destruction.
See also: Veeam: PoC exploit released for critical vulnerability in VBEM
The need to respond quickly to new threats increases the pressure on IT and enterprise security managers. They must constantly stay up to date on the latest vulnerabilities and be ready to implement fixes immediately, which can be extremely demanding and time-consuming.
Businesses need to invest more in automated threat detection and response systems, as well as in training their staff to deal with the increasing speed and complexity of attacks.
Source: www.bleepingcomputer.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
