CVE-2023-7102: UNC4841 Targets Barracuda ESG

Background:

This vulnerability in a third-party library allowed for arbitrary code execution (ACE) within a third-party library, Spreadsheet::ParseExcel which is utilized by the ESG appliance’s Amavis virus scanning.

Investigations revealed that attackers, using specially crafted Excel files attached to emails, targeted a limited number of Barracuda ESG devices to deploy new variants of SeaSpy and SaltWater malware.

Once a target receives an email with the malicious Excel attachment from UNC4841, the email is scanned by the Barracuda ESG appliance, thereby executing the malicious code contained in the Excel file. This requires no interaction from an end-user, making it highly impactful and effective.

Working with Mandiant, Barracuda thinks that this conduct is a result of the China Nexus actor, tracked as UNC4841, continuing to operate. CVSSv2 gave the vulnerability a score of 7.5, and CVSS3 gave it an 8.8.

CVE-2023-7102:

The use of a third-party Perl module called “Spreadsheet ParseExcel” by the Barracuda Email Security Gateway (ESG) Appliances’ “Amavis” virus scanner to parse Microsoft Excel files is the source of CVE-2023-7102. Since “Spreadsheet ParseExcel” evaluates string types and accepts unvalidated input from files, it is susceptible to arbitrary code execution. Because of this, attackers can execute any commands on the system that the “Spreadsheet ParseExcel” module uses to parse the Excel file.

A Barracuda Email Security Gateway (ESG) Appliance that is susceptible to compromise can be compromised by a remote attacker who sends a malicious Excel file, giving the attacker the ability to execute arbitrary code on the ESG Appliance. The ESG Appliance’s “Amavis” virus scanner, which analyzes Excel files sent to emails using “Spreadsheet ParseExcel,” is what causes arbitrary code execution.

The original flaw in the Spreadsheet::ParseExcel Perl module (version 0.65) remains unpatched and has been assigned the CVE identifier CVE-2023-7101, necessitating that downstream users take appropriate remedial action.The Barracuda Email Security Gateway (ESG) Appliance’s use of this unmaintained third-party component (“Spreadsheet ParseExcel”) has the following CVE entry: CVE-2023-7102.

Recommendations:

All active Email Security Gateway (ESG) devices received a security update automatically from Barracuda; nonetheless, it is advisable to confirm that the version of the ESG software you are using is more recent than v9.2.1.001.

Barracuda Networks has revealed indications of compromise which are also listed below, thus you must use them to look for any evidence of exploitation, as threat actors are known to take advantage of this vulnerability.

IOCs:

Host IOCs

Network IOCs:

References:

https://www.barracuda.com/company/legal/esg-vulnerability.
https://nvd.nist.gov/vuln/detail/CVE-2023-7102https://thehackernews.com/2023/12/chinese-hackers-exploited-new-zero-day.html