We are issuing an urgent security advisory regarding recently discovered vulnerabilities in the Perforce source-code management platform, widely used across various industries. Microsoft has identified four critical flaws in Perforce Helix Core Server, with the most severe allowing for remote code execution (RCE) and network takeover.
Key Vulnerabilities and Implications:
- Highly Privileged Access (CVE-2023-45849, CVSS 9.8): The most critical vulnerability enables unauthenticated attackers to execute code with LocalSystem privileges, potentially leading to complete system control, backdoor installation, sensitive data access, and system setting alterations.
- Denial-of-Service Risks (CVE-2023-35767, CVE-2023-45319, CVE-2023-5759, CVSS 7.5 each): These vulnerabilities allow unauthenticated attackers to induce DoS attacks via remote commands and exploitation through RPC headers.
- Impact on Software Development Life Cycle (SDLC): Given Perforce Server’s role in SDLC management, exploitation of these vulnerabilities could extend to connected information systems and the wider software supply chain.
Mitigation and Security Recommendations:
- Immediate Update Required: Organizations using Perforce Server should immediately update to the patched version (2023.1/2513900) released by Perforce Software.
- Enhanced Vigilance: Remain alert for any signs of exploitation and regularly monitor systems for unusual activities.
- Comprehensive Patching Strategy: Regularly update not just Perforce but all third-party software.
- Network Security Measures: Employ VPNs and/or IP allow-lists to restrict Perforce Server communication, issue TLS certificates to verified users, and implement TLS termination proxies.
- Robust Logging and Monitoring: Ensure all access to Perforce instances is logged, and configure alert systems for immediate notifications in case of process crashes or suspicious activities.
- Network Segmentation: Limit potential attack pivots within the network through effective segmentation.
OP Innovate’s Commitment:
We are closely monitoring this situation and are ready to assist you in implementing these security measures. Our team is dedicated to ensuring your organization’s cybersecurity resilience in the face of evolving threats.
Please reach out to us for any assistance or further information regarding this alert.
