Researcher Drops More Zero-Day Exploits for N-Able Software - BankInfoSecurity

The researcher who sent managed security providers scrambling globally earlier this week by publishing an exploit chain for N-able software decided Wednesday to pile onto the turmoil by releasing two new exploit chains. Sean Bales, aka MSPNightmare, announced a follow-up to what he'd dubbed Able2Shell, in the form of 4EverAble2Shell and Agent2Shell, which also exploit N-able's N-central remote monitoring and management software.

New Exploit Details

Bales said in a LinkedIn post that 4EverAble2Shell "will one-shot a N-central server, and provides root, anonymously," using a remote code execution flaw that can be exploited without having to authenticate. Agent2Shell is a collection of more than 10 zero-day exploits designed "to interact with Windows agents connected to N-central," and which enables remote code execution on the Windows devices with system level permissions.

Vendor Response

In response, N-able at 07:00 UTC on Thursday said that it's investigating the "active incident," quickly took its hosted software online, triggering a "major outage." The company stated that its cloud-hosted versions do not appear to be at risk, and advised customers to disable the legacy API feature if it's enabled. "If legacy API is enabled: disable legacy API now. All other customers: confirm that legacy API is disabled," the company said.

Later on Thursday, N-able told customers: "We are restricting certain N-central features and integrations. These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the right action to protect our partners and their customers." The vendor added: "We have seen no signs of compromise. We are continuing to monitor closely and will provide updates as needed."

Exploitation Already Underway

Cybersecurity firm Huntress said that as of Thursday morning, it "has not observed exploitation of these issues in our partners' environments." But attackers are already experimenting with the flaws. Cybersecurity firm watchTowr on Thursday morning reported that it was "already seeing probes for '4EverAble2Shell.'"

Bales' Wednesday release of the two exploit chains followed his Monday drop of an "anonymous-to-root exploit chain" that he dubbed Able2Shell, comprised of over 30 vulnerabilities. In response, N-able on Monday rapidly took its hosted software offline and urged customers running N-central on their own servers to do the same. By Tuesday, N-able said its hosted servers were patched and once again online.

Disclosure Debate

N-able said in a statement Tuesday that Bales gave no prior warning of the flaws before he released them publicly. "The new vulnerabilities that the researcher published on Nov. 9 were not responsibly disclosed through our established reporting channels." Bales confirmed that he gave N-able no advance warning, stating his rationale was that N-able failed to fix remote code execution and privilege-escalation flaws in a different N-able product that he disclosed directly to the vendor over five months ago.

John Pagliuca, president and CEO of N-able, accused Bales of putting his firm's customers at risk. "Publishing exploit code before customers have had the chance to act doesn't make anyone safer. It hands attackers a head start. This is a moment for our industry to recommit to putting customers first and honoring that duty to protect: being diligent, being transparent and being measured in how we act," he said.