Radar · 2024-01
January 2024
Ivanti Connect Secure and Policy Secure are under active exploitation for an authentication bypass and a command injection, a runc escape reaches the host filesystem, a Jenkins CLI file read opens a path to remote code execution, Confluence template injection gives unauthenticated RCE, and ASD publishes guidance on engaging with AI.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- notable NIST
NIST publishes the final adversarial machine learning taxonomy — nist.gov
Released 4 January 2024, NIST.AI.100-2e2023 supersedes the 8 March 2023 draft and defines four attack classes: evasion (manipulating inputs after deployment), poisoning (corrupting training data), privacy (extracting training data or model detail) and abuse (planting false information in sources the model ingests). A co-author says most are fairly easy to mount with minimal knowledge of the target system.
Adopt the four categories in AI threat modelling and in tender security questions, so vendor answers are comparable to each other.
Update, March 2025: NIST published a new edition, AI 100-2 E2025, on 24 March 2025. Use the current edition in threat models and tender questions.
- fyi Anthropic
Backdoored models survive safety training — anthropic.com
Anthropic's Sleeper Agents research, published in January 2024, trained models with a temporal backdoor — write secure code when the prompt says 2023, insert exploitable code when it says 2024 — then applied supervised fine-tuning, reinforcement learning and adversarial training. The deceptive behaviour persisted, most strongly in the largest models. Adversarial training taught models to recognise their triggers and conceal the behaviour better rather than removing it.
Treat model weights as a supply-chain artefact: ask vendors for provenance and training-data attestation, and stop reading "safety trained" as evidence that a backdoor is absent.
- fyi NCSC
NCSC judges AI will raise attack volume but not create new attack classes by 2025 — ncsc.gov.uk
Published 24 January 2024, the UK NCSC's threat assessment judges that AI will almost certainly increase the volume and heighten the impact of cyber attacks over two years, but that near-term uplift is evolutionary — better reconnaissance and social engineering — rather than novel attack classes. Advanced offensive AI capability was judged to remain with well-resourced actors through 2025, while the barrier for unskilled actors falls.
Use it as the citable basis for AI threat statements in risk registers, where vendor marketing claims are inadmissible, and revisit assumptions behind phishing controls and staff awareness training.
Security and edge
Sections- critical Ivanti
Chained Ivanti gateway zero-days exploited since December 2023 — cyber.gov.au
ASD's ACSC advisory of 11 January 2024 covers CVE-2023-46805, an authentication bypass in the web component of Ivanti Connect Secure 9.x and 22.x and Ivanti Policy Secure, and CVE-2024-21887, a command injection allowing an authenticated administrator to run arbitrary commands. Chained, they give unauthenticated remote code execution on the appliance. Ivanti shipped an XML mitigation before patches were available, with patches staggered from the week of 22 January. Volexity, which found the chain, traced the first suspicious activity to early December 2023.
Confirm any Ivanti estate was mitigated, integrity-checked and then patched, and treat appliances exposed during January as suspect pending forensic review — the mitigation did not remove implants that were already present.
- critical Chrome
Chrome patches an in-the-wild V8 exploit (CVE-2024-0519) — chromereleases.googleblog.com
Chrome stable 120.0.6099.234 for Mac, 120.0.6099.224 for Linux and 120.0.6099.224/225 for Windows, released 16 January 2024, fixed three V8 flaws: CVE-2024-0517 out-of-bounds write, CVE-2024-0518 type confusion, and CVE-2024-0519 out-of-bounds memory access. Google said it was aware of reports that an exploit for CVE-2024-0519 exists in the wild.
Verify managed browser fleets reached 120.0.6099.224 or later on Windows and Linux and 120.0.6099.234 or later on Mac, and check Edge and any Electron-based desktop applications for the corresponding Chromium bump — they inherit the flaw and rarely update on the same cadence.
- critical Confluence
Confluence template injection gives unauthenticated RCE (CVE-2023-22527) — nvd.nist.gov
Published 16 January 2024 and scored CVSS 9.8 by NIST's NVD, CVE-2023-22527 is a template injection in out-of-date Confluence Data Center and Server 8.0.x through 8.5.3 allowing unauthenticated remote code execution. Atlassian names 8.5.4 (LTS) as a fixed build and says most recent supported versions were mitigated during regular updates. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 24 January 2024.
Confirm all Confluence Data Center and Server instances are on 8.5.4 or later, and audit any instance that was internet-reachable before that patch for web shells and unexpected administrator accounts.
Standards and compliance
Sections- notable ASD
ASD publishes guidance on engaging with artificial intelligence — cyber.gov.au
First published 24 January 2024, ASD's ACSC guidance on using AI systems securely was developed with international partners including CISA, the FBI, NSA and NCSC-UK. It asks organisations to apply the cyber frameworks relevant in their jurisdiction, including the Essential Eight, and to consider privacy and data-protection obligations, whether a system is secure-by-design, the system's limits and constraints, training staff to use it securely, and whether suitably qualified staff can set it up and run it.
Map any planned or in-flight AI deployment against the guidance and record the assessment.
- notable CA/Browser Forum
Code-signing baseline requirements clarified for signing services — cabforum.org
Ballot CSC-21's IPR review period opened on 17 January 2024, after the ballot had already passed. It amends the Baseline Requirements for publicly trusted code signing certificates from version 3.4 to version 3.6, clarifying language on signing services and signing requests. Voting recorded six certificate issuers in favour, and the IPR review was set to run to 18 February 2024.
If you use a hosted or managed signing service for installers or build artefacts, check with your certificate authority whether the 3.6 clarifications change your key-custody obligations.
Update, February 2024: The IPR review closed with no exclusion notices and version 3.6 of the code signing Baseline Requirements took effect on 28 February 2024.
- fyi AI policy
Government publishes its interim response on safe and responsible AI — industry.gov.au
On 17 January 2024 the Department of Industry, Science and Resources published the Government's interim response to the safe and responsible AI consultation. The department says current frameworks do not fully address AI risks, and that the government will use testing, transparency and accountability measures in high-risk settings while leaving low-risk use largely unimpeded. The minister's release says the government is considering mandatory guardrails for high-risk settings, will work with industry on a voluntary AI Safety Standard and is establishing an expert advisory group. It is a policy direction, not a regulation.
Read it as the baseline for AI governance planning through 2024, and expect high-risk classification questions to start appearing in procurement and assurance processes.
CMS and platforms
Sections- critical WordPress
Balada Injector compromises more than 7,100 sites through a Popup Builder flaw — thehackernews.com
Reported on 15 January 2024, a Balada Injector campaign that Sucuri counted at more than 7,100 infected sites from activity it first detected on 13 December 2023 exploited CVE-2023-6000 (CVSS 8.8) in the Popup Builder plugin, which has more than 200,000 active installs and was patched in version 4.2.3. WPScan publicly disclosed the flaw the day before Sucuri's 13 December detection. Attackers used the flaw to perform any action available to a logged-in administrator.
Inventory Popup Builder installs and confirm 4.2.3 or later. On any site that ran an older version during January, audit administrator accounts, scheduled tasks and injected scripts rather than simply updating.
- notable Drupal
Drupal core patches a Comment module denial of service (SA-CORE-2024-001) — drupal.org
Published 17 January 2024 and rated moderately critical (11/25), SA-CORE-2024-001 covers crafted comment reply requests that can trigger a denial of service. It affects Drupal 8.0 and later through 10.1.7, plus 10.2.0 and 10.2.1, and was fixed in 10.2.2 and 10.1.8 — both security-only releases containing no other changes. Drupal 7 is unaffected, and so is any site without the Comment module enabled.
Update to Drupal 10.2.2 or 10.1.8. If you cannot, check whether the Comment module is enabled — many government sites have it on without exposing comments to the public, and disabling it removes the exposure entirely.
- notable WordPress
WordPress 6.4.3 closes a POP chain and a file upload bypass, backported to 4.1 — wordpress.org
Released 30 January 2024, WordPress 6.4.3 fixed a PHP file upload bypass in the Plugin Installer requiring administrator privileges, and a remote code execution POP chain. Both fixes were backported to every branch from WordPress 4.1 onward, alongside five core and sixteen block editor bug fixes.
Update to 6.4.3, or confirm your host actually applied the backport if you pin an older branch. The POP-chain fix matters most: WordPress lists it as remote code execution, while the upload bypass needs administrator privileges.
Supply chain, CI/CD and IaC
Sections- critical PyPI
PyPI makes two-factor authentication mandatory for every user — blog.pypi.org
From 1 January 2024, two-factor authentication is required for all PyPI accounts. Accounts without it enrolled cannot perform management actions or upload files.
Confirm organisational and bot publishing accounts moved to Trusted Publishing or API tokens with 2FA on the owning account — a shared-password publishing account stopped working on 1 January.
- notable runc
runc container escape reaches the host filesystem (CVE-2024-21626) — github.com
Disclosed 31 January 2024 at CVSS 8.6, CVE-2024-21626 leaves an internal file descriptor referencing the host filesystem open before pivot_root. Setting process.cwd to /proc/self/fd/N in a container config, or arriving via a crafted image, escapes to the host filesystem including overwriting host binaries. Affects runc 1.0.0-rc93 through 1.1.11, fixed in 1.1.12. BuildKit published its own build-time advisories the same day, including CVE-2024-23651.
Patch runc to 1.1.12 or later across CI runners, container hosts and managed node images, and update Docker and BuildKit with it. Treat any pipeline that built untrusted Dockerfiles before patching as a review candidate.
Update, February 2024: Moby published a related advisory, CVE-2024-24557, on 1 February 2024.
- notable Jenkins
Jenkins CLI file read gives a path to remote code execution (CVE-2024-23897) — jenkins.io
The Jenkins security advisory of 24 January 2024 covers CVE-2024-23897, rated Critical: the CLI command parser replaces an argument prefixed with @ with the contents of the named file, enabled by default, giving arbitrary file read and documented routes to code execution. The same advisory covers CVE-2024-23898, cross-site WebSocket hijacking in the CLI with no origin validation. Affects weekly releases up to 2.441 and LTS up to 2.426.2, fixed in weekly 2.442 and LTS 2.426.3 and 2.440.1.
Upgrade to LTS 2.426.3 or 2.440.1. If a controller was exposed before patching, rotate credentials it held and audit build history — the advisory says file read can recover cryptographic keys used to decrypt stored secrets, so patching alone does not undo the exposure.
Languages, runtimes and frameworks
Sections- notable glibc
Two heap overflows and an integer overflow in the glibc syslog path — sourceware.org
On 30 January 2024 the GNU C Library announced three defects in __vsyslog_internal: CVE-2023-6246, a heap buffer overflow when printing a header containing a long program name without recalculating the buffer size; CVE-2023-6779, a second overflow from mishandling failed snprintf return values; and CVE-2023-6780, an integer overflow when computing a buffer size without an overflow check. Fixed in glibc 2.39, released the following day.
Apply your distribution's glibc update rather than waiting for 2.39 itself, and restart affected long-running services — a library patch without a restart leaves the old code mapped.
Static site and web tooling
Sections- notable Vite
Vite dev server file-deny list bypassed on case-insensitive filesystems — github.com
CVE-2024-23331, disclosed 19 January 2024 and rated CVSS 7.5, lets an attacker bypass Vite's
server.fs.denylist on case-insensitive filesystems by varying the case of a requested path, exposing files the policy was meant to block. Servers hosted on Windows are notably affected. Affected ranges are 2.7.0 to 2.9.16, 3.0.0 to 3.2.7, 4.0.0 to 4.5.1 and 5.0.0 to 5.0.11, fixed in 2.9.17, 3.2.8, 4.5.2 and 5.0.12.Bump Vite including the transitive copies pulled in by Astro, Nuxt and SvelteKit, and stop binding dev servers to non-loopback interfaces on shared networks and CI runners.
- fyi Astro
Astro 4.2 adds experimental Speculation Rules prerendering — astro.build
Released 18 January 2024, Astro 4.2 added experimental support for the Speculation Rules API for client-side prerendering of onward navigations in Chromium browsers, experimental global route priority so injected routes sort by the same rules as filesystem routes, a redirectToDefaultLocale option for i18n, and remark-plugin control over image optimisation in Markdown. Astro described it as the first release built almost entirely from community-contributed features.
Evaluate Speculation Rules behind the experimental flag before relying on it, and check the i18n redirect change if you run multilingual sites.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more