DarkComet RAT: A Remote Access Tool for Full Windows Control by Attackers

25.10.2024

The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities Catalog, adding a new vulnerability based on evidence of active exploitation. The newly listed flaw, CVE-2024-38094, affects Microsoft SharePoint and has been classified as a deserialization vulnerability. Malicious cyber actors often target such vulnerabilities due to their potential to enable unauthorized remote code execution, posing serious threats to affected systems.

Initially disclosed on July 9, 2024, the CVE-2024-38094 vulnerability has been assigned a severity rating of “Important” by Microsoft, with a CVSS score of 7.2. The vulnerability is rooted in the deserialization of untrusted data, which is categorized under CWE-502. When exploited, this flaw allows attackers to execute arbitrary code, potentially compromising organizations that rely on SharePoint for collaboration and data management purposes.

CISA’s decision to include this vulnerability in its catalog underscores the threat it poses to federal networks. Under Binding Operational Directive (BOD) 22-01, federal agencies are mandated to address these identified vulnerabilities within specific deadlines to protect their infrastructures against active threats. The directive emphasizes the necessity of timely remediation as part of a broader vulnerability management strategy, reinforcing the importance of proactive measures in maintaining network security.

Although BOD 22-01 is primarily directed at Federal Civilian Executive Branch (FCEB) agencies, CISA strongly advises all organizations, regardless of sector, to prioritize the remediation of cataloged vulnerabilities. Taking proactive measures to address these security flaws is crucial for minimizing exposure to cyberattacks and safeguarding critical information assets.

CISA’s ongoing updates to the Known Exploited Vulnerabilities Catalog demonstrate its commitment to improving national cybersecurity resilience. By staying informed about emerging threats and swiftly addressing vulnerabilities like CVE-2024-38094, organizations can enhance their defensive capabilities and maintain the integrity and security of their digital environments.