Log in Request a demo

Vulnerability Advisories Archive.

Entries 13Range June 2022 to July 2023

This page holds short security alerts about critical vulnerabilities in enterprise software, firmware and network products. It covers 13 items from June 2022 to July 2023. Each entry keeps its original title, publish date and text, newest first and grouped by quarter. Earlier addresses of these entries now lead to the matching entry here.

Jump to: 2023 Q3 | 2023 Q1 | 2022 Q4 | 2022 Q3 | 2022 Q2

All 13 entries

2023 Q3

Urgent Manual Fix Needed: Zimbra Collaboration Suite Under Attack Due To Actively Exploited Zero-Day Vulnerability

Published:

Zimbra, a widely adopted email and collaboration platform, urges administrators to manually address a zero-day vulnerability currently exploited in attacks targeting Zimbra Collaboration Suite (ZCS) email servers. The venue, employed by over 200,000 businesses in 140 countries, including over 1,000 government and financial organizations, is at high risk due to this security flaw.

According to a company advisory issued on Thursday, the security vulnerability in Zimbra Collaboration Suite Version 8.8.15 could impact the confidentiality and integrity of users’ data. The bug, a reflected Cross-Site Scripting (XSS) vulnerability, was discovered and reported by Clément Lecigne of Google’s Threat Analysis Group. As part of XSS attacks, threat actors could steal sensitive user information or execute malicious code on vulnerable systems.

.@_clem1 discovered this being used in-the-wild in a targeted attack. Thank you to @Zimbra for publishing this advisory and mitigation advice! If you run Zimbra Collaboration Suite, please go manually apply the fix! #itw0days https://t.co/lqwt0kOFWA

— Maddie Stone (@maddiestone) July 13, 2023

How Do You Do Manual Patch for Zimbra?

Zimbra has yet to provide official security patches for the actively exploited zero-day but has provided a manual fix that admins can apply to remove the potential attack vector.

  • Take a backup of the file located at /opt/zimbra/jetty/webapps/zimbra/m/momoveto.
  • Open the file for editing and navigate to line number 40.
  • Update the value of the parameter to <input name=”st” type=”hidden” value=”${fn:escapeXml(param.st)}”/>.
  • Prior to the update, the line appeared as <input name=”st” type=”hidden” value=”${param.st}”/>.
  • The addition of the escapeXml() function will now sanitize the user-inputted data by escaping special characters used in XML markup, thereby preventing cross-site scripting (XSS) vulnerabilities.

The implementation of the escapeXml() function will sanitize user-inputted data by escaping special characters used in XML markup, thus preventing XSS attacks.

Admins should prioritize this fix, given Zimbra’s history of being targeted.

Notably, in June 2022, Zimbra auths bypass, and remote code execution bugs were exploited to breach over 1,000 servers. Later, in September 2022, unpatched RCE vulnerabilities in Zimbra Collaboration Suite were abused, compromising nearly 900 servers within two months. Most recently, the Winter Vivern Russian hacking group exploited another XSS bug in February 2023 to breach NATO-aligned governments’ webmail portals and steal email mailboxes from officials, governments, military personnel, and diplomats.

2023 Q1

Apache Fineract Has Three Critical SQL Injection Vulnerabilities | CVE-2023-25196

Published:

Three critical vulnerabilities have been discovered in Apache Fineract, a platform designed to bring the world’s unbanked population into the modern financial ecosystem. These vulnerabilities, namely CVE-2023-25195, CVE-2023-25196, and CVE-2023-25197, could allow unauthorized users to access sensitive data or take control of the system.

The first vulnerability, CVE-2023-25197, is a SQL injection vulnerability that results from the failure to neutralize special characters used in SQL commands. This vulnerability could potentially have a limited impact on specific components within Apache Fineract and affects versions 1.4 through 1.8.2.

The Severity of CVE-2023-25196 is Important

CVE-2023-25196, also a SQL injection vulnerability, is more severe than the first, as authorized users could exploit it to modify or add data in specific Apache Fineract components. This vulnerability affects versions 1.4 through 1.8.2.

The third vulnerability, CVE-2023-25195, involves a server-side request forgery (SSRF) issue in Apache Fineract, which could enable authorized users to gain access to the server and use it for outbound traffic. This vulnerability affects versions 1.4 through 1.8.3.

What is Apache Fineract?

Apache Fineract is an open-source, community-driven financial services software platform providing financial services to underbanked and unbanked populations. It is a flexible and extensible platform that can be customized to meet the specific needs of financial institutions, microfinance institutions, and other organizations providing financial services.

It provides a range of features for managing financial products and services, including loans, savings, and insurance. It also includes tools for managing customer data, tracking transactions, and generating reports.

One of the critical goals of Apache Fineract is to promote financial inclusion by making financial services more accessible and affordable to underserved communities around the world. In addition, the platform is designed to be easily adapted to different financial regulations and to integrate with other financial systems, making it a valuable tool for organizations working in diverse geographic and economic contexts. It is essential in areas where traditional banking infrastructure may be inadequate or non-existent.

Financial inclusion is critical for economic growth and poverty reduction. Apache Fineract helps bridge the gap by providing the tools and resources for organizations to offer financial services to people who may not have had access to them. This, in turn, can help to promote entrepreneurship, create jobs, and increase financial stability in these communities.

Apache Fineract is maintained and developed by a community of volunteers from around the world, and it is released under the Apache License, Version 2.0. This license allows anyone to use, modify, and distribute the software freely, subject to certain conditions.

Apache Fineract Solved the Vulnerabilities and Released the New Versions

To mitigate these vulnerabilities, users are advised to take the following measures:

  • Upgrade to Apache Fineract 1.8.3 or higher, which includes fixes for all three vulnerabilities.
  • Apply the appropriate security patches to the system.
  • Enable input validation and SQL escaping to prevent SQL injection attacks.
  • Configure the system to restrict access to internal resources and disable SSRF.

Organizations must keep their software up-to-date and apply patches as soon as they become available. By staying vigilant and proactively addressing vulnerabilities, organizations can ensure the continued success of this innovative platform.

How Can Brandefense Help You Against Vulnerabilities?

Vulnerability intelligence gives information about known vulnerabilities targeting software and systems, including information about the risk level, affected products, and discussions on social media. Vulnerability patches or workarounds that are available can be found with official references. It is used to help organizations identify and prioritize destructive vulnerabilities in both internal and external systems to develop strategies for mitigating dangerous risks.

Brandefense is a proactive digital risk protection solution for organizations. Our AI-driven technology constantly scans the online world, including the dark, deep, and surface web, to discover unknown events, automatically prioritize risks, and deliver actionable intelligence you can use instantly to improve security. Our proactive approach enables you to identify and prioritize vulnerabilities in your systems and develop strategies for mitigating those risks.

Brandefense Vulnerability Intelligence Monitor the vulnerabilities, prioritize and take proactive actions Discover the Solution

Hackers Are Targeting Organizations With FortiOS Vulnerability Exploitation

Published:

FortiOS Vulnerability Allows Hackers to Take Down Firewall Devices

FortiOS Vulnerability Exploited by Hackers in Targeted Attacks Against Governments and Large Organizations

Hackers exploit a severe vulnerability, CVE-2022-41328, in FortiOS – an operating system widely used by governments and large organizations. This flaw enables them to execute arbitrary code and has already caused data loss and system corruption in targeted organizations. The vulnerability affects various versions of FortiOS, but the fix is available in the latest updates. Fortinet, the vendor, is closely monitoring the situation.

Understanding the seriousness of this FortiOS vulnerability is critical!

Hackers have already used it to breach government and large organizations’ systems. A recent report from Fortinet revealed that threat actors had hacked and taken down multiple FortiGate firewall devices belonging to one of its clients using CVE-2022-41328 exploits, even though the flaw’s advisory did not explicitly state that the vulnerability had been exploited before patches were available.

According to Bleepingcomputer, threat actors are using a critical FortiOS vulnerability to launch attacks against government agencies and large-scale organizations. These attacks are causing data loss, operating systems, and file corruption in the targeted organizations’ inventory.

“Don’t fall prey to cybercrime! The FortiOS vulnerability is no joke – hackers have already exploited it to breach top government and corporate systems. Stay informed and stay secure!”

It is crucial for organizations to update their FortiOS installations to the latest version as soon as possible to avoid falling victim to this vulnerability. Additionally, organizations should review their security policies and ensure that proper security measures, such as firewalls, intrusion detection and prevention systems, and network segmentation, are in place to mitigate the risk of cyber attacks.

Regular security assessments and vulnerability scans can help organizations identify and address potential security issues before malicious actors exploit them. In addition, organizations can consider engaging with third-party security experts to conduct penetration testing and other security assessments to identify any vulnerabilities in their systems. By taking these proactive steps, organizations can better protect themselves against the increasing threat of cyber-attacks and safeguard their sensitive data and systems from unauthorized access and data breaches.

The vulnerability can lead to arbitrary code execution in vulnerable systems

 CVE-2022-41328, is a path traversal vulnerability that vulnerability arises from an authentication error while processing a specific CLI command and affects the following FortiOS versions;

  • 6.0, 
  • 6.2, 
  • 6.4.0 – 6.4.11, 
  • 7.0.0 – 7.0.9, 
  • 7.2.0 – 7.2.3

The updates that address the vulnerability are available in versions;

  • 6.4.12
  • 7.0.10
  • 7.2.4

Threat Actors Manipulating Firmware to Gain Control of FortiGate Devices

The attacks targeting the organization’s inventory were initially detected when a customer’s multiple FortiGate devices suddenly stopped working and encountered a boot error. 

They found that the devices had stopped with the following error message: “System enters error mode due to FIPS error: Firmware Integrity self-test failed.” FIPS-enabled devices verify the integrity of system components. If a breach of integrity is detected, the device shuts down and rejects the boot to protect network integrity.

Don't Let Vulnerabilities Take Down Your Systems – Try Our Vulnerability Intelligence Solution Today! Click here

FORTINET investigations revealed that threat actors changed the /sbin/init component in the device’s firmware image and added a new file named /bin/fgfm as the first stage of the attack chain. This change allows /bin/fgfm to run before normal startup actions, providing an attacker with continued access and control. Further stages of the attack involved executing malicious code on the targeted systems.

Fortinet is continuing to monitor the threat actors associated with this attack. In this context, to avoid falling victim to similar attacks targeting organizations’ inventories, ensuring that the internal inventory is always in the latest updated version, where vulnerabilities are fixed, is recommended. In addition, regularly monitoring network traffic and logs can also help to detect malicious activity quickly.

To prevent further damage, users of FortiOS must update their systems immediately. Regular network traffic and logs monitoring can help identify any suspicious activities early. Taking these precautions will help protect against future attacks and safeguard the integrity of your systems.

It is essential to be aware of this critical FortiOS vulnerability as it has been used in attacks targeting government institutions and large-scale organizations, resulting in data loss and corruption. Organizations using FortiOS should update their systems to the latest available versions immediately to mitigate the risk of being affected by this vulnerability. Regular network traffic and logs monitoring can also help quickly detect malicious activity. These steps can help prevent attacks on internal inventory and protect network integrity.

Fortinet Releases Critical Updates For FortiOS, FortiNAC And More

Published:

Fortinet has released security updates to address 40 security vulnerabilities affecting its FortiWeb, FortiOS, FortiNAC, and FortiProxy solutions. Two of the 40 vulnerabilities identified are considered critical, and 15 have a high level of importance.

Two of Fortinet’s Vulnerabilities are 9.8/10 Score

The critical vulnerabilities include CVE-2022-39952, a remote code execution (RCE) vulnerability in FortiNAC’s keyUpload script that could allow unauthorized code or commands to be executed by unauthenticated threat actors through specially crafted HTTP requests. The affected versions include FortiNAC 9.4.0, FortiNAC 9.2.0 – 9.2.5, FortiNAC 9.1.0 – 9.1.7, FortiNAC 8.8 all versions, FortiNAC 8.7 all versions, FortiNAC 8.6 all versions, FortiNAC 8.5 all versions, and FortiNAC 8.3 all versions.

The second critical vulnerability, CVE-2021-42756, affects FortiWeb Proxy and is caused by a stack-based buffer overflow vulnerability. This vulnerability could allow an unauthenticated, remote threat actor to execute arbitrary code on vulnerable systems through specially crafted HTTP requests. The affected versions include FortiWeb 5. x all versions, FortiWeb 6.0.7 and below, FortiWeb 6.1.2 and below, FortiWeb 6.2.6 and below, FortiWeb 6.3.16 and below, and all versions of FortiWeb 6.4.

Fortinet has also released security updates for other vulnerabilities affecting FortiADC, FortiExtender, FortiOS, FortiProxy, FortiSwitchManager, FortiWAN, FortiAnalyzer, FortiAuthenticator, FortiPortal, and FortiSandbox. Users are advised to apply the updates promptly to avoid potential attacks exploiting these vulnerabilities.

Critical Vulnerabilities On Lenovo ThinkPad X13s BIOS

Published:

Security vulnerabilities have been identified that affect the BIOS software of Lenovo ThinkPad X13s model devices and may cause threat actors to execute code remotely on the affected system and access sensitive data of the local user. (Reference Link)

The details of the identified vulnerabilities are as follows;

The vulnerabilities tracked as CVE-2022-40516, CVE-2022-40517, and CVE-2022-40520, are stack-based buffer overflow security vulnerabilities that could allow a local threat actor with elevated privileges to cause memory corruption in the Qualcomm BIOS.

The vulnerabilities, tracked as CVE-2022-40518 and CVE-2022-40519 in the Qualcomm BIOS, allow a local threat actor with elevated privileges to access memory contents.

The vulnerabilities tracked as CVE-2022-4432, CVE-2022-4433, CVE-2022-4434, and CVE-2022-4435, which are in the ThinkPad X13s BIOS, allow a local threat actor with elevated privileges to access memory contents.

These vulnerabilities affect versions before ThinkPad X13s BIOS 1.47. To avoid being the target of attacks that can be carried out using vulnerabilities, it is recommended to upgrade to current versions that fix the vulnerability.

2022 Q4

Critical RCE Alarm In FortiOS Sslvpnd

Published:

A critical security vulnerability has been detected in FortiOS’s SSL-VPN (sslvpnd) that could allow threat actors to remote code execution (RCE) on affected installations.

The security vulnerability, tracked as CVE-2022-42475, is caused by a Heap-based Buffer Overflow affecting the sslvpnd daemon component. An unauthenticated, remote threat actor can manipulate the SSL-VPN component through specially crafted data, triggering a stack-based buffer overflow and executing arbitrary code on the targeted system. Fortinet states that this vulnerability is actively exploited and recommends that users check their systems for the following indicators of compromise.

If the following log string is observed more than once in user systems;

  • Logdesc=”Application Crashed” And Msg=”[…] Application:sslvpnd,[…], Signal 11 Received, Backtrace: […]

If the existence of the following structures is detected in the file system;

  • /Data/Lib/Libips.Bak
  • /Data/Lib/Libgif.So
  • /Data/Lib/Libiptcp.So
  • /Data/Lib/Libipudp.So
  • /Data/Lib/Libjepg.So
  • /Var/.Sslvpnconfigbk
  • /Data/Etc/Wxd.Conf
  • /Flash

If connections are made from FortiGate to the following suspicious IP addresses:

  • 34.130.40:444
  • 131.189.143:30080,30081,30443,20443
  • 36.119.61:8443,444
  • 247.168.153:8033

Threat actors actively exploit the vulnerability. In this context, in order not to be the target of attacks that can be carried out using vulnerabilities, it is recommended to immediately implement the published updates and prevent the specified consensus indicators (IoC) from the security solutions in use.

Multiple Vulnerabilities Detected In IT Management Solution GLPI

Published:

Multiple security vulnerabilities have been identified in GLPI, an open-source web application that helps institutions/organizations and companies manage their IT infrastructure and inventories. These vulnerabilities allow threat actors to execute SQL queries against the application database and to perform Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks.

The details of the detected security vulnerabilities are as follows;

  • The security vulnerability tracked as CVE-2022-39375 is due to insufficient cleaning of user-supplied entries in the RSS Feed function. A remote threat actor can execute arbitrary HTML code and script in the user’s browser in the context of the vulnerable website via a malicious link. Successful exploitation of this vulnerability allows remote threat actors to obtain sensitive information, alter the web page’s appearance, and carry out phishing attacks.
  • The security vulnerability tracked as CVE-2022-39234 is due to insufficient session expiry time. This vulnerability allows threat actors to access users’ accounts by reusing users’ old session credentials (Cookies) and thus may lead to the capture of users’ sensitive information.
  • The security vulnerability tracked as CVE-2022-39323 is due to insufficient sanitization of user-supplied data in the API REST user_token component. A remote threat actor can execute arbitrary SQL commands in the application database by sending a specially crafted request to the affected application.
  • The security vulnerability, tracked as CVE-2022-39276, is due to insufficient validation of user-supplied inputs in RSS feeds. A remote threat actor can direct the application to initiate requests to arbitrary systems (SSRF) via a specially crafted HTTP request.
  • The vulnerability security, tracked as CVE-2022-39277, is due to insufficient sanitization of user-supplied data on external connections. A remote threat actor can run arbitrary HTML code and script in the user’s browser in the context of the vulnerable website via a specially crafted link.

These vulnerabilities affect specific versions of GLPI, and security updates have been released that fix the vulnerabilities. In this context, it is recommended to immediately upgrade vulnerable installations to the current versions published in order not to be the target of attacks that can be carried out using vulnerabilities.

Critical RCE Vulnerabilities Affecting F5 Products Detected

Published:

Application service provider F5 has issued a security notice for two critical security vulnerabilities that allow an unauthenticated threat actor with network access to remote code execution in BIG-IP systems, a combination of software and hardware designed around access control, application availability, and security solutions.

In the statement made by F5, it was stated that the security vulnerabilities detected were found in the representative state transfer (REST) interface for the iControl framework used to communicate between F5 devices and users.

The identified security vulnerabilities are:

The vulnerability, code CVE-2022-41622, is caused by cross-site request forgery (CSRF) that affects BIG-IP and BIG-IQ products, allowing threat actors to gain root access to a device’s management interface.

The vulnerability code CVE-2022-41800 allows a threat actor with administrative privileges to execute code remotely on vulnerable systems via an RPM file.

BIG-IP product versions affected by these security vulnerabilities are as follows;

  • 1.0 – 16.1.2
  • 1.0 – 15.1.5
  • 1.0 – 14.1.4
  • 1.0 – 13.1.4
  • 1.0 – 12.1.6
  • 6.1 – 11.6.5

Stating that they will not release updates for 11. x (11.6.1 – 11.6.5) and 12. x (12.1.0 – 12.1.6) versions, F5 said that there is no information that security vulnerabilities have been exploited yet and that existing updates will be included in future versions as soon as possible and announced that it will. In order not to be the target of target-oriented attacks that can be carried out by using the vulnerability of the users, it is recommended that the published updates be implemented immediately.

Critical UEFI Firmware Vulnerabilities Detected In Specific Lenovo Notebook Models

Published:

Lenovo has released updates regarding vulnerabilities detected in the UEFI Firmware component affecting Yoga, IdeaPad, and ThinkBook devices. UEFI refers to software that acts as an interface between the operating system and the firmware embedded in the device’s hardware and is responsible for starting the operating system when a device is powered on. Therefore, UEFI offers a highly attractive attack surface for threat actors who want to release hard-to-detect and remove malware.

Here are the details of the vulnerabilities that could be used by threat actors to disable Secure Boot, a security mechanism designed to prevent malicious programs from loading during the boot process;

  • The vulnerability, tracked as CVE-2022-3430, affects the WMI Setup driver on certain Lenovo Notebook PC devices and allows a threat actor with elevated privileges to modify Secure Boot settings by modifying an NVRAM variable.
  • The vulnerability, tracked as CVE-2022-3431, affects a driver used in certain Lenovo Notebook PC devices that is not accidentally disabled during the manufacturing process and could allow a threat actor with elevated privileges to change the Secure Boot setting by changing an NVRAM variable.
  • The vulnerability, tracked as CVE-2022-3432, affects a driver used during the manufacturing process on the IdeaPad Y700-14ISK that was not accidentally disabled and could allow a threat actor with elevated privileges to alter the Secure Boot setting by changing an NVRAM variable.

After the vulnerabilities were detected by the Eset security researcher, Lenovo announced that they took action to fix the vulnerabilities. However, Lenovo has stated that they do not plan to release fixes for CVE-2022-3432 as the affected model has reached the end of life (EoL). In this context, it is recommended that users of other affected devices update their firmware to the latest version in order not to be the target of attacks that can be carried out using vulnerabilities.

Multiple Vulnerabilities Detected In Juniper Networks Junos OS

Published:

Multiple critical security vulnerabilities have been identified in Junos OS, a network operating system used in security and network devices developed by Juniper Networks. The vulnerabilities allow threat actors to perform unauthorized file access, cross-site scripting (XSS), and directory traversal attacks.

Some of the detected security vulnerabilities are as follows;

  • The security vulnerability, tracked as CVE-2022-22241, is due to incorrect login validation affecting the J-Web component of Juniper Networks Junos OS. As a result, an unauthenticated threat actor that successfully exploits the vulnerability can gain access to data through a specially crafted POST request without proper authorization.
  • The vulnerability, tracked as CVE-2022-22246, is a PHP Local File Inclusion (LFI) vulnerability that affects the J-Web component of Juniper Networks Junos OS and could allow a low-privileged authenticated threat actor to execute a malicious PHP file on the vulnerable system.
  • The vulnerability tracked as CVE-2022-22242 is a Cross-Site Scripting (XSS) vulnerability that affects the J-Web component of Juniper Networks Junos OS and could allow an unauthenticated threat actor to run malicious scripts in the user’s browser in the context of a J-Web session.
  • The vulnerability tracked as CVE-2022-22244 is an XPath Injection vulnerability that affects the J-Web component of Juniper Networks Junos OS. An unauthenticated threat actor can exploit the vulnerability through a specially crafted POST request.

These vulnerabilities, which affect all versions of the Junos operating system, are critically rated as high and have been fixed with the updates released by Juniper Networks. In this context, in order not to be the target of attacks that can be carried out using vulnerabilities, it is recommended that vulnerable Junos OS users upgrade immediately to released updates, while as a workaround, disable J-Web or restrict access to trusted hosts only.

2022 Q3

Critical 0-Day Alarm In Microsoft Exchange Server

Published:

Two new 0-day vulnerabilities have been identified affecting Microsoft Exchange Server 2013, 2016, and 2019 products.

The details of the identified vulnerabilities are as follows;

  • The first critical security vulnerability (SSRF), tracked as CVE-2022-41040, is due to insufficient validation of user-supplied input in the Exchange OWA interface. A remote threat actor can direct the application to initiate requests to arbitrary systems via a specially crafted HTTP request.
  • Another security vulnerability tracked as CVE-2022-41082 is due to incorrect login validation in the Exchange Server. A remote user with access to PowerShell Remoting on Exchange systems affected by security vulnerability can execute arbitrary code on the system.

It is observed that threat actors exploit these vulnerabilities in targeted attacks. The attacks detailed by Microsoft show that the two vulnerabilities are used together in an exploit chain, and the SSRF vulnerability allows an authenticated threat actor to execute arbitrary code. However, successfully exploiting the vulnerabilities requires authenticated access to vulnerable Exchange Servers.

Microsoft has announced that Exchange Online users are not affected by these vulnerabilities and has released a set of workarounds they should implement to mitigate potential threats to their affected customers. In order not to be the target of targeted attacks that can be carried out using vulnerabilities, it is recommended to immediately implement the following workaround suggestions published by Microsoft and to monitor the updates to be released regularly.

  • IIS Manager should open.
  • The Default Web Site bar should be expanded.
  • The Autodiscover tab should open.
  • The URL Rewrite feature within the IIS framework should be clicked.
  • In the Actions pane on the right, the Add Rule(s) option should open.
  • Select the Request Blocking option and click OK.
  • In the Add Request Rule window that opens, add the string “.*autodiscover\.json.*\@.*Powershell.*” to the URL Pattern section and click OK.
  • The added rule should be selected, and the Edit feature in the Conditions frame on the side tab should be opened.
  • Should change the condition entry from {URL} to {REQUEST_URI}.

Critical Vulnerabilities Affecting 1000+ Organizations Detected In FileWave MDM Solution

Published:

Critical security vulnerabilities affecting more than a thousand organizations have been identified in the MDM (Mobile Device Management) solution of FileWave, which provides device management solutions based in Switzerland. Considering the widespread use of IoT technologies, it is observed that the use of device management solutions provided by FileWave is increasing daily. The solutions make it easy for IT administrators to manage all of an organization’s devices effectively.

  • The security vulnerability, tracked as CVE-2022-34907, is due to an Authentication Bypass bug affecting FileWave MDM versions before 14.6.3 and 14.7.x, allowing threat actors to circumvent authentication mechanisms in the vulnerable system.
  • A second vulnerability, tracked as CVE-2022-34906, is due to the presence of the hard-coded encryption key found in FileWave MDM versions before 14.6.3 and 14.7.x.

By exploiting the vulnerabilities, threat actors can capture critical data in the affected installations and execute arbitrary code on the system. Additionally, threat actors can use CVE-2022-34907 not only to hijack all managed devices but also to leak sensitive data such as device serial numbers, user email addresses, geolocation coordinates, IP addresses, and device PINs, and more.

Vulnerable MDM installations are known to compromise the security of more than 1000 organizations. FileWave has fixed security vulnerabilities with a recent update (14.8). In this context, it is recommended that institutions/organizations or organizations using vulnerable MDM solutions immediately apply the security updates published in order not to be the target of attacks that can be carried out using vulnerabilities.

2022 Q2

[Exploit Details]: Critical RCE Vulnerability Found In ManageEngine ADAudit Plus

Published:

In March 2022, an unauthenticated remote code execution (RCE) vulnerability was identified affecting the Zoho ManageEngine ADAudit Plus solution, which organizations use to monitor changes in Active Directory. (Reference Link)

The security vulnerability tracked as CVE-2022-28219 is caused by a combination of Untrusted Java Deserialization, Path Traversal, and XEE (XML External Entity) issues. Apart from allowing remote code execution on affected systems, the vulnerability can be exploited in some cases to compromise domain administrator accounts.

Active Directory management-related products (ADManager Plus, ADSelfService Plus, ADAudit Plus) are widely used by institutions/organizations.

These applications create an attractive attack surface for threat actors because of their privileged access to Active Directory. Details of the PoC code and applications for exploiting the vulnerability affecting ADAudit Plus have been published by security researchers.

Applications such as ADAudit Plus that integrate with Active Directory must store credentials to connect to it. ADAudit Plus keeps these credentials encrypted in its database. It is possible to reverse the encryption for clear access to these credentials. If these credentials are compromised, it gives a lot of privilege to the threat actors. ADAudit Plus makes it easy for users to connect to AD with their domain administrator credentials, and users use this easy way instead of creating a special service account with limited privileges. By manipulating this feature, threat actors can completely compromise the AD domain through ADAudit Plus.

In order not to be the target of attacks that can be carried out by exploiting the vulnerability, institutions/organizations using ADAudit Plus are urgently recommended to upgrade to ADAudit Plus 7060 or a later version to fix the security vulnerability.

Know What Is Exposed. Before Attackers Do.

Book a demo of the platform.

  • 4.7Gartner Peer Insights
  • 24hEarly warning time
  • 190+Countries covered

What you see in the demo

  1. Your exposureAssets and services seen from the outside, starting from your own domain.
  2. Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
  3. From alert to actionHow findings reach your team and what to do next.