CVE-2024-9537
📋 TL;DR
This CVE describes a critical vulnerability in ScienceLogic SL1's third-party component that allows remote code execution. The vulnerability affects all SL1 versions before 12.1.3, 12.2.3, and 12.3, with patches available for versions back to 10.1.x. Organizations using vulnerable SL1 installations are at risk of complete system compromise.
💻 Affected Systems
- ScienceLogic SL1 (formerly EM7)
📦 What is this software?
Sl1 by Sciencelogic
Sl1 by Sciencelogic
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover, data exfiltration, lateral movement within network, and persistent backdoor installation leading to business disruption and data breach.
Likely Case
Unauthorized access to SL1 system, credential theft, configuration manipulation, and potential ransomware deployment.
If Mitigated
Limited impact due to network segmentation, strict access controls, and monitoring preventing lateral movement.
🎯 Exploit Status
Actively exploited as zero-day before patches were available. Exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.3+, 12.2.3+, 12.3+ (patches also available for 10.1.x, 10.2.x, 11.1.x, 11.2.x, 11.3.x)
Vendor Advisory: https://support.sciencelogic.com/s/article/15465
Restart Required: Yes
Instructions:
1. Review ScienceLogic advisory KB15465. 2. Download appropriate patch for your SL1 version. 3. Apply patch following ScienceLogic documentation. 4. Restart SL1 services. 5. Verify patch application.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to SL1 instances to minimize attack surface
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_IP_RANGE" port port="443" protocol="tcp" accept'
firewall-cmd --reload
Access Control Hardening
allImplement strict authentication and authorization controls
🧯 If You Can't Patch
- Immediately isolate SL1 systems from internet and restrict internal network access
- Implement enhanced monitoring and alerting for suspicious activity on SL1 systems
🔍 How to Verify
Check if Vulnerable:
Check SL1 version via SL1 web interface (Admin > System > About) or command line. Compare against patched versions.Check Version:
Check SL1 web interface at Admin > System > About or consult SL1 documentation for CLI version checkVerify Fix Applied:
Verify version is 12.1.3+, 12.2.3+, or 12.3+ after patch application. Check patch status in SL1 interface.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Unexpected process execution
- Suspicious network connections from SL1 system
- Configuration changes not initiated by administrators
Network Indicators:
- Unusual outbound connections from SL1 system
- Traffic to known malicious IPs
- Unexpected port scanning from SL1 host
SIEM Query:
source="sciencelogic" AND (event_type="authentication_failure" OR process="unusual_executable" OR dest_ip IN (malicious_ip_list))🔗 References
- https://arcticwolf.com/resources/blog/rackspace-breach-linked-to-zero-day-vulnerability-sciencelogic-sl1s-third-party-utility/
- https://community.sciencelogic.com/blog/latest-kb-articles-and-known-issues-blog-board/week-of-september-30-2024---latest-kb-articles-and-known-issues-part-1-of-2/1690
- https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6
- https://support.sciencelogic.com/s/article/15465
- https://support.sciencelogic.com/s/article/15527
- https://twitter.com/ynezzor/status/1839931641172467907
- https://www.bleepingcomputer.com/news/security/rackspace-monitoring-data-stolen-in-sciencelogic-zero-day-attack/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9537
- https://www.theregister.com/2024/09/30/rackspace_zero_day_attack/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9537
