Rapid7: Attackers exploiting vulnerabilities 'faster than ever'

Attackers continue to develop and deploy exploits at an alarming pace, emphasizing the need to instill and maintain strong vulnerability management programs, according to new research by Rapid7.

The security vendor on Tuesday published its 2022 Vulnerability Intelligence Report authored by Caitlin Condon, senior manager of security research; Ron Bowes, lead security researcher; and Erik Galinkin, principal AI researcher. The annual report analyzed 50 vulnerabilities that posed a significant risk to organizations of all sizes in last year, including 45 flaws that were exploited in the wild, 44% of which were zero-day vulnerabilities.

While the report, which focused on widespread threats, highlighted good and bad news for enterprises, Rapid7's research made it clear that security teams are facing daunting difficulties when it comes to staying ahead of attackers exploiting vulnerabilities.

One of the top takeaways centered on what Rapid7 tracks as "Time to Known Exploitation" (TTKE) -- the time frame between when a vulnerability is publicly disclosed and when reports of exploitation in the wild start.

While timely patching remains a problem due to lack of resources and a variety of other factors, the TTKE provides an urgency to potential threats. Last year, Rapid7 observed an increase in the TTKE, which grew to 24.5 days from just 12 days in 2021.

However, despite that improvement, the researchers warned that "averages are fickle creatures" and highlighted other alarming metrics. In 2021, for example, Rapid7 researchers found more than half of the vulnerabilities it tracked were exploited within seven days of public disclosure, and 58% within two weeks.

"Attackers are still developing and deploying exploits faster than ever," the authors wrote in the report. "56% of the vulnerabilities in this report were exploited within seven days of public disclosure --a 12% rise over 2021 and an 87% rise over 2020. If we look at the median value instead of taking the average, median time to exploitation in 2022 was one day across the vulnerabilities we've included in this report."

That small window was demonstrated earlier this month when threat actors attempted to exploit a Fortinet FortiNAC remote code execution flaw, tracked as CVE-2022-39962, five days after it was publicly disclosed.

Calculating the TTKE value can be difficult, the report noted, due to vendors having different definitions when it comes to "public" or "disclosed." For example, the researchers mentioned a remediated flaw in Spring Cloud Function, tracked as CVE-2022-22963, that was published to a public GitHub repository on March 24, 2022, without documenting a CVE or security issue.

Akamai reported exploitation in the wild beginning on March 27, two days before a patched version and official CVE were published.

"We chose to use '0' as our TTKE value for CVE-2022-22963, since it's unreasonable to expect the general public (including Spring Cloud customers) to examine individual GitHub commits for potential security implications," the report said.

The researchers also noted coordinated vulnerability disclosure is not always coordinated and highlighted concerns with silent patching. For example, there was a heap-based overflow vulnerability, tracked as CVE-2022-42475, in Fortinet's FortiOS SSL VPN. Fortinet privately informed customers on December 7 but did not publicly disclose it until December 12, two weeks after it was silently patched on Nov. 28.

TTKE calculations aside, Rapid7 researchers emphasized how silent patching like Fortinet's gives attackers a head start.

"When the advisory was published, it included a note that Fortinet was 'aware of an instance where this vulnerability was exploited in the wild,' but failed to specify whether the flaw had been exploited by threat actors before they released a fixed version -- which they evidently did silently on November 28, 2022, potentially giving adversaries time to reverse engineer the patch and develop exploits before customers knew there was even a remediation to implement," the authors wrote.