Hackers Gone Wild: USAHERDS Flaw and APT41 Looming Large!

Hot Take:

Oh, Acclaim Systems! You had us at “USAHERDS” but lost us at “hard-coded credentials.” Who knew the wild west of cybersecurity would have more drama than a daytime soap opera? It’s a good thing CISA is here to play the role of the unyielding sheriff, rounding up vulnerabilities like they’re outlaws in a spaghetti western.

Key Points:

• CISA added a high-severity flaw in Acclaim Systems USAHERDS to its Known Exploited Vulnerabilities (KEV) catalog.
• The flaw, CVE-2021-44207, involves static credentials allowing potential remote code execution.
• Although no new attacks have been reported, the flaw was previously exploited by the APT41 group.
• Federal agencies must apply mitigations by January 13, 2025, to protect against threats.
• Adobe has also warned about a critical security issue in ColdFusion, urging users to update immediately.

Acclaim’s Hall of Shame

Acclaim Systems’ USAHERDS vulnerability, CVE-2021-44207, is like a bad penny that keeps showing up—except this penny is a digital nightmare with a CVSS score of 8.1. The flaw involves hard-coded credentials that could allow an attacker to execute arbitrary code on a vulnerable server. Think of it like giving a burglar your house keys and a map to your safe. Not ideal, right? This flaw has been patched, but CISA still felt the need to add it to their KEV catalog, hinting that it’s as reliable as a cat herding competition.

The Keys to the Kingdom

The real kicker in this vulnerability is the use of static ValidationKey and DecryptionKey values in versions 7.4.0.1 and prior. These keys are supposed to provide security for the application ViewState, but it turns out they’re about as secure as a chocolate teapot. If a threat actor gets their hands on these keys, they can pull off a neat trick: trick the application server into deserializing maliciously crafted ViewState data. This magical deserialization leads to the execution of code on the server, which is just a fancy way of saying “you’re hacked.”

Old News, New Concerns

While there haven’t been any fresh reports of CVE-2021-44207 being exploited in the wild, history tells a different tale. Back in 2021, the China-linked APT41 threat actor was already having a field day with this vulnerability. It was used as a zero-day in attacks targeting six U.S. state government networks. So, while the flaw may have been patched, its legacy lives on like a bad high school yearbook photo.

Federal Agencies Get a Deadline

The Federal Civilian Executive Branch (FCEB) agencies have been given a homework assignment: apply vendor-provided mitigations by January 13, 2025. Yes, 2025. It looks like they’re giving a generous timeline, perhaps because they know the bureaucratic wheels can turn slower than a snail on a lazy Sunday. Nevertheless, the message is clear: don’t hit the snooze button on this one, folks. This is your chance to safeguard networks against active threats that could otherwise make you the next episode in the cyber soap opera.

Adobe: Not to be Outdone

Meanwhile, Adobe is jumping on the vulnerability bandwagon with its own critical security flaw in ColdFusion (CVE-2024-53961). With a CVSS score of 7.8, it’s not quite as spicy as USAHERDS’ flaw, but it’s still a hot potato. This vulnerability already has a known proof-of-concept (PoC) exploit that could allow an arbitrary file system read. It’s like giving someone unrestricted access to your diary—only this diary is your entire file system. Adobe advises users to apply the new updates for ColdFusion 2021 and ColdFusion 2023 ASAP to avoid any awkward diary readings.