CVE-2023-47246

CVE-2023-47246 is a critical zero-day vulnerability discovered in the SysAid IT support and management software solution. The flaw, identified as a path traversal vulnerability, has been exploited by Lace Tempest, a ransomware affiliate known for deploying Cl0p ransomware. This vulnerability allows threat actors to gain unauthorized access to affected systems and execute arbitrary code, thereby posing a significant risk to system security. The exploitation of CVE-2023-47246 by Lace Tempest was aimed at achieving code execution within on-premises versions of SysAid. Microsoft was the first to identify this issue and promptly notified SysAid about the potential risk. Upon receiving this information, SysAid immediately took action to rectify the problem, demonstrating their commitment to maintaining the integrity of their software solutions. SysAid has released a patch to address CVE-2023-47246, and organizations using their software are strongly advised to apply it without delay. In addition to patching, companies should proactively search for signs of exploitation prior to the patch application, as Lace Tempest is likely to use their access to exfiltrate data and deploy Clop ransomware. By taking these preventive measures, organizations can significantly reduce the risk of falling victim to this exploit.