Versa Director Flaw Exposes Networks to API Exploits and Token Theft

• The CISA warned of a new Versa Director flaw, which appears in some cases with REST APIs with no authentication.
• Versa Director is used by ISPs and MSPs, and any exposed vulnerability could lead to a supply chain attack.
• The impacted versions include most of those released prior to this month.

A critical advisory on a newly discovered vulnerability in Versa Networks' Versa Director, identified as CVE-2024-45229, was issued by the Cybersecurity and Infrastructure Security Agency (CISA). 

The CVE-2024-45229 vulnerability has a 6.6 severity score and is primarily caused by improper input validation within certain REST APIs that do not require authentication by design. 

This flaw poses significant security risks due to its impact on network configurations managed by Versa’s SD-WAN software, widely deployed by internet service providers (ISPs) and managed service providers (MSPs).

This oversight potentially allows attackers to inject invalid arguments into GET requests, leading to the exposure of active users' authentication tokens. These exposed tokens can enable unauthorized access to additional APIs, jeopardizing sensitive data and the operational integrity of affected networks.

The vulnerability affects several versions of Versa Director, specifically those released prior to September 9, 2024. Impacted versions include: 22.1.4, 22.1.3, 22.1.2, all iterations of 22.1.1, 21.2.3, and 21.2.2.

Organizations utilizing susceptible versions of Versa Director are urged to upgrade to the latest version containing a hotfix released on September 12, 2024. In addition to upgrading, deploying a web application firewall (WAF) or an API gateway is recommended to restrict access to vulnerable APIs, particularly those on ports 9182, 9183, and 443.

This alert follows last month’s high-severity vulnerability (CVE-2024-39717), which facilitated attacks on downstream customers in a supply chain breach. Currently, Cyble found 73 internet-exposed instances of Versa Director, though the presence of the latest vulnerability in these instances remains undetermined.

Related

Patched FortiClient EMS Vulnerability Exploited in the Wild Worldwide

Rapido Ride-Hailing Platform Leaks User and Driver Data via Website Flaw

GPS Tracker Company ‘Hapn’ Exposes Thousands of Customers' Identities Due to Website Flaw

Clipper DEX Exploit Targets Withdrawal Functionality, Resulting in $450K Loss

Critical ICS Flaws Seen in Schneider Electric, mySCADA, and Automated Logic Products  

Zyxel Firewalls Vulnerability Targeted by Helldown Ransomware

Most Popular

Does Sonic 3 have a Post-Credits Scene?

What we know so far About Virgin River Season 7

Colleen Hoover’s Verity Movie Adaptation adds two more Hollywood Stars to its cast

Stranger Things Season 5 Release date: One good news and one bad news for fans

Masters of the Universe Movie: Jared Leto joins the cast as a Diabolical Character

LockBit Ransomware Group Returns, Launching 4.0 in February