The following enhancements and improvements are now available to Censys ASM and Search customers.

Censys ASM

• Use CVE (Common Vulnerability and Exposures) risks in Censys ASM to identify software vulnerabilities in your attack surface and understand how critical and exploitable they are, enabling you to respond to the most important risks in your attack surface first and avoid chasing low-risk issues.
  • This release adds over 5,000 CVE risks to the ASM risk library.
  • Each CVE risk includes Known Exploited Vulnerability (KEV) information, Common Vulnerability Scoring System (CVSS) scores, and attack vector indicators.
  • When a new CVE is cataloged by the National Vulnerability Database (NVD), it becomes discoverable in Censys ASM alongside its CVSS score within 24 hours.
  • You can adjust the criteria for surfacing CVE risks in your ASM workspace. By default, only CVEs that meet the following criteria are included:
    • CVSS score High to Critical
    • Present in KEV catalog
    • Network Attack Vector
  • CVE risks are available to all ASM customers.
  • Learn more about CVE risks in ASM in the following video.

     

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities:

• Advisory: VMware vCenter DCERPC Heap-Overflow RCE CVE-2024-38812]
  • To identify potentially vulnerable vCenter instances, the following Censys queries can be used:
    • Censys Search query: services.software: (vendor: VMware and product: vCenter)
    • Censys ASM query: host.services.software: (vendor: VMware and product: vCenter)
• Ivanti Cloud Services Appliance (CSA) Unauthenticated Remote Code Execution Vulnerability CVE-2024-8963 and CVE-2024-8190]
  • To identify exposed Ivanti Cloud Services Appliance instances, the following Censys queries can be used:
    • Censys Search query: services.http.response.html_title=`Ivanti(R) Cloud Services Appliance`
    • Censys ASM query: host.services.http.response.html_title=`Ivanti(R) Cloud Services Appliance` or web_entity.instances.http.response.html_title=`Ivanti(R) Cloud Services Appliance`

New Protocols

Added support for the following protocols:

• Expanded detection of Murmur/Mumble servers 
  • MURMUR Servers (new)
  • MURMUR Tunnels (existing)

New Fingerprints

Added the following fingerprints: