Log in Request a demo

Weekly Security News Archive, Q3 2022.

This page holds the weekly security news issues and newsletters that Brandefense published. It covers the 13 items from July 2022 to September 2022 (2022 Q3). Each entry keeps its original title, publish date and text, newest first. Earlier addresses of these entries now lead to the matching entry here. The overview page lists all periods.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

All 13 Entries On This Page

September 2022

Security News – Week 39

Published:

Critical RCE Alarm in Sophos Firewall Solutions

A critical 0-day security vulnerability that affects Sophos Firewall solutions has been identified and is known to be actively exploited by threat actors.

The RCE vulnerability, tracked as CVE-2022-3236, exists due to incorrect login validation in the User Portal and WebAdmin interfaces of Sophos Firewall solutions. As a result, an unauthenticated, remote threat actor can execute arbitrary code on the target system via a specially crafted request.

The vulnerability affects all versions of Sophos Firewall 17.0.0 (inclusive) to 19.0.1. Sophos has released updates that fix the vulnerability. To avoid being affected by attacks that can be carried out using the vulnerability, it is recommended that users minimize the internet exposure of the User Portal and Webadmin interface and apply the published updates immediately.

Tarfile: The 15 Years Old Critical Python Vulnerability Affects More Than 350,000 Projects

A critical security vulnerability has been identified in Python that has not been updated for 15 years, leaving more than 350,000 open source projects vulnerable to attacks.

The vulnerability tracked as CVE-2007-4559 exists in the “Tarfile” module of Python, which is widely used in frameworks created by Netflix, AWS, Intel, Facebook, Google, and applications used for machine learning, automation, and docker containerization available via file. The tarfile module makes it possible to read and write tar archives, including gzip, bz2 and lzma compressed files. A successful exploit allows threat actors to execute arbitrary code on the vulnerable system or take control of a target system.

There is no update or mitigation suggestion to fix the said vulnerability. Therefore, thousands of Python projects are still vulnerable to vulnerability. In this context, it is recommended that the updates that are likely to be published regarding the vulnerability should be followed regularly and implemented immediately if published.

AffectMe: The Critical Vulnerability in Oracle Cloud Infrastructure

A critical security vulnerability has been identified in the Oracle Cloud infrastructure,called AttachMe, that threat actors can exploit to access the virtual disks of Oracle customers.

The vulnerability, AttachMe, compromises the security of cloud isolation by allowing threat actors to access other users’ OCI storage volumes without permission, capture and modify sensitive data stored on the volume, and execute code on affected systems. Successfully exploiting the vulnerability requires threat actors to capture the Oracle Cloud Identifier provided to an Oracle Cloud Infrastructure user and insert it into their Oracle Cloud virtual machine. Oracle Cloud infrastructure does not have a security mechanism that checks who owns this identifier. Therefore, threat actors can easily add the identifier to their virtual machines and gain access to the storage units of the Cloud customer that owns the identifier.

Upon its disclosure, the vulnerability was fixed by Oracle within a few hours. This critical vulnerability highlights the vital importance of overall monitoring security vulnerabilities in cloud environments.

Security News – Week 38

Published:

American Airlines Suffered From A Data Breach

American Airlines suffered a security breach that compromised the security of customer and employee data. The security breach, detected by American Airlines on July 5, 2022, occurred when threat actors compromised the e-mail accounts of a certain number of employees.

There is no clear information about the data captured by the threat actors yet in this breach. However, it is considered that the said data may contain personal information such as name, surname, date of birth, e-mail address, telephone number, and driver’s license/passport number owned by employees and customers. In their statements, American Airlines officials stated that the data obtained through phishing attacks were not very large and a detailed investigation was launched into the breach, and no finding/evidence has yet been identified for the abuse of the seized data.

Additionally, American Airlines announced that it would provide customers affected by the breach with a 2-year subscription to Experian IdentityWorks, an anti-phishing solution. In this context, it is recommended that users who are at risk of being affected by the said security breach update the login information they use in their accounts by applying strong password policies, regularly reviewing their account activities, and being careful against target-oriented phishing / social engineering attacks.

Uber Suffered Extensive Security Breach, Resulting in Hijacking of Internal Systems

Uber suffered a wide-ranging security breach that compromised its internal systems and data by threat actors. Threat actors targeting Uber’s corporate infrastructure have posted images of evidence of the security breach. When the published screenshots are examined, it has been observed that the security of the following inventories used in Uber’s internal environment has been violated.

  • Slack Server,
  • Google Workspace Admin,
  • AWS Accounts,
  • HackerOne Admin,
  • SentinelOne EDR,
  • vSphere,
  • Financial Dashboards

The attack vector starts with targeting MFA (Multi-factor Authentication) codes provided by Duo Security belonging to UBER employees. Although MFA authentication mechanisms can protect against a threat actor with the credentials of the targets, they are often vulnerable to MiTM attacks. Therefore, threat actors take advantage of this vulnerability to create phishing pages where they can capture the targets’ login credentials and MFA codes. These phishing pages are created using hacking tools such as Evilginx and mimic Uber’s login pages. With this method, threat actors seize the employee’s existing VPN access and use it to access the internal network. Threat actors gaining access to the internal network discovered an internal network share containing scripts with privileged credentials, allowing access to critical systems. Threat actors claim that they breached the security of Uber’s Duo, OneLogin, AWS, and GSuite environments with this attack chain.

In a screenshot released by the threat actors, it is observed that a SentinelOne EDR account belonging to Uber’s IR (Incident Response) personnel was also compromised. EDR solutions allow IR teams to access and control working machines, thus allowing threat actors to inject Backdoor-like malware into other internal systems, expanding the attack surface area in case of a security breach.

Uber stated on their social media accounts that they responded to the security breach in question, that they are in contact with law enforcement and will inform in case of any development. In this context, taking the following precautions into consideration is recommended to avoid being exposed to security breaches that can be carried out with similar techniques.

  • Institution/organization personnel should be made aware of advanced target-oriented social engineering/phishing attacks that can be carried out.
  • Critical data, such as login information, should not be used on unsafe platforms.
  • It should be ensured that inventories such as the system, software/program, and application are used in the most up-to-date versions.

0-Day Vulnerability Detected in WPGateway Plugin

A critical 0-day vulnerability actively exploited by threat actors has been identified in the WPGateway plugin, which provides cloud service to WordPress users with installation, backup, and cloning capabilities.

The vulnerability, identified by WordFence security researchers and tracked with code CVE-2022-3180, allows an unauthenticated threat actor to add an administrator account to websites running WPGateway. As a result, threat actors with administrator privileges take full control of the site.

Using the vulnerability, more than 4.6 million attack attempts targeting more than 280,000 WordPress sites were detected and successfully blocked in the last month. The WordFence team has reported the vulnerability to WPGateway developers and has published a firewall rule for Wordfence Care/Wordfence Response customers. The most common observed security breach indicator for exploiting the vulnerability is the administrator account created with the “rangex” username. It was observed that the WPGateway plugin, last reviewed on September 9, is still vulnerable to vulnerability.

There is no update yet that fixes the vulnerability. In this context, in order not to be the target of attacks that can be carried out using vulnerabilities, it is recommended to follow the updates to be published regularly and to apply them immediately if they are published, to remove the installed WPGateway plugins until the update is released, and to check whether there are suspicious administrator users in the WordPress control panel.

Threat actors exploit these vulnerabilities to breach the security of devices and then use these devices as bots in various attacks, such as distributed denial of service (DDoS) targeting different systems.

D-Link has released security updates regarding the specified security vulnerabilities, but still, many users are known to be running un-updated older versions or vulnerable devices. Therefore, in order not to be the target of similar malware attacks that may be carried out, users using vulnerable D-Link versions are recommended to apply updates that fix the vulnerabilities immediately. In addition, it is important to prevent the IOC findings related to the campaign in question from the security solutions in use.

Security News – Week 37

Published:

Critical Zero-Day Alarm on Trend Micro Apex One

Security solutions provider Trend Micro has released security updates regarding a zero-day vulnerability identified in Apex One and Apex One SaaS endpoint security solutions that is known to be actively exploited by threat actors.

The security vulnerability with code CVE-2022-40139 is caused by incorrect input validation in the application’s Rollback function. An authenticated remote user with access to the Admin console could exploit the security vulnerability to force Agents to download unverified malicious Rollback components.

In addition to the CVE-2022-40139 vulnerability, Trend Micro has also fixed several medium-risk security issues (CVE-2022-40141, CVE-2022-40144). The first vulnerability (CVE-2022-40141) allows threat actors to access sensitive data. The second (CVE-2022-40144) allows remote threat actors to bypass authentication checks and gain unauthorized access to the application.

Users using Trend Micro Apex One and Apex One SaaS 2019 versions are recommended to immediately apply the published updates in order not to be the target of attacks that can be carried out using these vulnerabilities.

RedLine Stealer Malware Was Distributed Through the Corporate Social Media Accounts

Avast security researchers have identified multiple business accounts on social media that distribute the Redline Stealer malware, which is responsible for capturing users’ login credentials from infected systems.

The malware distribution campaign was identified through a sponsored post on Facebook promoting free Adobe Acrobat Reader software. The post in question was shared via the Facebook business account of an internet service provider in Brazil. The post contains a link redirecting destinations to the “Mediafire.com” platform instead of “Adobe.com.” By clicking the link in the post, the files on the storage and sharing platforms are requested to be downloaded to the systems. Readline Stealer injection requires visitors to download the file, extract the content from the archive, and run it.

The provider warns users who visit their homepage that their Facebook account has been hacked. In addition to the provider’s Facebook account, several hacked Facebook business accounts have been found to post the same malicious content.

In this context, it is recommended to consider the following security warnings to avoid being the target of malware campaigns that can be carried out with similar methods.

Mirai Variant MooBot Botnet Targets Vulnerable D-Link Devices

Security researchers at Palo Alto Networks Unit42 have detected that vulnerable D-Link devices are targeted in MooBot Botnet campaigns, which are known to be the Mirai Botnet variant.

In observed exploit attempts, threat actors exploit the following security vulnerabilities to propagate MooBot to network devices running Linux and with internet exposure;

  • CVE-2015-2051: D-Link HNAP SOAPAction Header Command Execution Vulnerability (Version 2.0)
  • CVE-2018-6530: D-Link SOAP Interface Remote Code Execution Vulnerability (Version 3.0)
  • CVE-2022-26258: D-Link Remote Command Execution Vulnerability (Version 3.0)
  • CVE-2022-28958: D-Link Remote Command Execution Vulnerability (Version 3.0) (this CVE ID was later withdrawn)

Threat actors exploit these vulnerabilities to breach the security of devices and then use these devices as bots in various attacks, such as distributed denial of service (DDoS) targeting different systems.

D-Link has released security updates regarding the specified security vulnerabilities, but still, many users are known to be running un-updated older versions or vulnerable devices. Therefore, in order not to be the target of similar malware attacks that may be carried out, users using vulnerable D-Link versions are recommended to apply updates that fix the vulnerabilities immediately. In addition, it is important to prevent the IOC findings related to the campaign in question from the security solutions in use.

Security News – Week 36

Published:

TikTok Suffered A Data Breach Resulting In The Leak Of 2 Billion User Data

It has been detected that the source codes of the popular social media application TikTok and the sharing claiming that 2 Billion user data have been seized. The said data breach was claimed to be performed by the threat actor group known as AgainstTheWest, and screenshots of the allegedly seized data were shared on their social media accounts. It was stated in the post that the data breach occurred due to the use of weak passwords on the servers.

Beehive Cybersecurity security researchers have verified the belonging of TikTok users by analyzing some of the available data. In order not to be the target of similar security breaches that may be carried out in this context, It is recommended to replace the passwords used in the accounts with passwords created using strong policies to enable MFA/2FA authentication features on all possible platforms and to be careful against advanced phishing/social engineering attacks that can be carried out using data leaked to the internet.

RedLine Stealer Malware Was Distributed Through the Corporate Social Media Accounts

Avast security researchers have identified multiple business accounts on social media that distribute the Redline Stealer malware, which is responsible for capturing users’ login credentials from infected systems.

The malware distribution campaign was identified through a sponsored post on Facebook promoting free Adobe Acrobat Reader software. The post in question was shared via the Facebook business account of an internet service provider in Brazil. The post contains a link redirecting destinations to the “Mediafire.com” platform instead of “Adobe.com.” By clicking the link in the post, the files on the storage and sharing platforms are requested to be downloaded to the systems. Readline Stealer injection requires visitors to download the file, extract the content from the archive, and run it.

The provider warns users who visit their homepage that their Facebook account has been hacked. In addition to the provider’s Facebook account, several hacked Facebook business accounts have been found to post the same malicious content.

In this context, it is recommended to consider the following security warnings to avoid being the target of malware campaigns that can be carried out with similar methods.

MuddyWater APT Group Targeted the SysAid Servers

It has been determined that threat actors supported by Iran are carrying out attacks targeting vulnerable systems against the Log4j 2 vulnerability in Israeli institutions and organizations. The offensive campaign has been attributed to the MuddyWater (Cobalt Ulster, Mercury, Static Kitten) APT group known to be affiliated with the Iranian Ministry of Intelligence and Security (MOIS).

The attack vector begins with MuddyWater threat actors gaining initial access to systems by exploiting security vulnerabilities in SysAid servers. Based on observations from past campaigns by these threat actors and vulnerabilities found in target environments, the Microsoft security team has observed that the exploits are related to Log4j 2. In other attack campaigns observed in 2022, MuddyWater threat actors took advantage of Log4Shell vulnerabilities detected on VMware servers to gain initial access to systems. However, this campaign targeted SysAid servers, which are attractive to threat actors due to their widespread use in the targeted country and provide IT management tools for users.

After gaining full access to target systems, threat actors capture critical and sensitive data from systems through Windows Management Instrumentation (WMI) and hacking tools. In addition, it has been observed that threat actors benefit from WebShell malware for activities such as persistence in the targeted system, obtaining identity information, and lateral movement. Finally, a remote management tool called eHours is used for command and control (C&C) communication, which allows threat actors to monitor and manage targeted systems remotely.

Since it was announced, the Log4Shell vulnerability has been used in critical attacks targeting institutions/organizations. In this context, it is recommended to consider the following security practices to avoid the target of critical attacks that can be carried out using the said vulnerability.

August 2022

Security News – Week 35

Published:

LastPass Suffers A Security Breach

Password management application LastPass suffered a data breach that resulted in the capture of some of the application’s source code and technical information by threat actors. Used by over 33 million people and 100,000 businesses, LastPass is a popular password management app.

It has been detected that threat actors gain access to the application development environment by obtaining the account credentials of the LastPass developer. After gaining access to the application development environment, threat actors gained access to application source codes and some of the technical data.

In the statement made by LastPass officials, it was stated that LastPass users were not affected by the breach and that threat actors did not gain access to their user accounts and passwords. To prevent users from being affected by similar security breaches, it is recommended that the information used in the accounts be created by applying strong policies and that MFA/2FA security mechanisms are enabled on all possible platforms.

Phishing Attacks Targeting Python Package Repository (PyPI) Users Detected

In PyPI, a software repository for the Python programming language, it has been detected that phishing attacks targeting project developers have been carried out by threat actors injecting malicious code into Python packages. These phishing attacks aim to capture software developers’ identity information.

Phishing Attacks Targeting Python Package Repository (PyPI) Users Detected

The attack vector begins when threat actors send phishing e-mails to developers expressing security-related urgency. Then, by clicking on the URL link in the e-mail text, the developers are directed to a phishing page created by imitating the user login page of the PyPI platform.

Phishing Attacks Targeting Python Package Repository (PyPI) Users Detected

When the members log in by providing their information, this login information is captured by the threat actors. Then, the threat actors log into the PyPI platform with the login information of the developers and inject malicious code into the Python packages included in it. It has been observed that malicious software created for users to download to their systems is larger in size due to its detection evasion features and a valid signature.

Phishing Attacks Targeting Python Package Repository (PyPI) Users Detected

It has been announced that the affected accounts on the PyPI platform are temporarily frozen, and the affected “Exotel” and “Spam” packages have been removed. Attack campaigns that manipulate open-source platforms and target software developers are increasing day by day.

In order not to be the target of similar attacks that may be carried out in this context, it is recommended that the security steps given below be implemented.

  • Developers at risk of being hacked should reset their passwords and 2FA recovery codes.
  • E-mails, attachments, or links from suspicious and unknown parties should not be opened.
  • Beware of unreliable content.
  • Comprehensive security solutions should be used.
  • Detected IoC findings related to the attack campaign should be blocked by the security solutions.
Phishing Attacks Targeting Python Package Repository (PyPI) Users Detected

In addition, it is recommended to verify that the URL in the address bar is http://pypi.org and that the TLS certificate of the site is http://pypi.org to verify that you are not using your credentials on the phishing page.

DirtyCred – A Critical Linux Kernel Security Vulnerability

A new Linux Kernel vulnerability called “DirtyCred” was disclosed at the Black Hat security conference on August 10, 2022. The vulnerability, which is similar to the notorious DirtyPipe vulnerability and is tracked as CVE-2022-0847, was discovered by Ph.D. student Zhenpeng Lin and his team.

DirtyCred is a kernel exploit that replaces non-privileged kernel credentials with privileged ones to escalate privileges on vulnerable systems. Instead of overwriting any critical data area in the kernel stack, DirtyCred abuses the stack memory reuse mechanism to gain privileges. It can overwrite all files with reading permission that affects kernel version 5.8 or higher. The vulnerability allows a local threat actor to crash the system or execute arbitrary code on the vulnerable system.

Github Link is here.

A Critical Linux Kernel Security Vulnerability Has Been Detected

Security researchers have posted a demo on their social media accounts showing how the DirtyCred vulnerability can be used to elevate the privileges of a low-privileged user on two different systems, such as Centos 8 and Ubuntu, using the same Exploit code with the DirtyPipe vulnerability.

This Thursday @BlackHatEvents , I will be presenting our research on a kernel exploitation method named #DirtyCred. With DirtyCred, you could write an #DirtyPipe liked exploit that works on different kernels and ARCHs without code changes. Check it out https://t.co/Qip23PSHl7 pic.twitter.com/jdopannoBO

— Zhenpeng Lin (@Markak_) August 7, 2022

There are currently no mitigations or updates to the DirtyCred exploit. Security researchers recommend separating privileged credentials from non-privileged ones using virtual memory to prevent potential Cross-Cache attacks using the vulnerability.

Security News – Week 34

Published:

DirtyCred – A Critical Linux Kernel Security Vulnerability

A new Linux Kernel vulnerability called “DirtyCred” was disclosed at the Black Hat security conference on August 10, 2022. The vulnerability, which is similar to the notorious DirtyPipe vulnerability and is tracked as CVE-2022-0847, was discovered by Ph.D. and detected by student Zhenpeng Lin and his team.

DirtyCred is a kernel exploit that replaces non-privileged kernel credentials with privileged ones to escalate privileges on vulnerable systems. Instead of overwriting any critical data area in the kernel stack, DirtyCred abuses the stack memory reuse mechanism to gain privileges. It can overwrite all files with reading permission that affects kernel version 5.8 or higher. The vulnerability allows a local threat actor to crash the system or execute arbitrary code on the vulnerable system.

Github Link is here.

Security researchers have posted a demo on their social media accounts showing how the DirtyCred vulnerability can be used to elevate the privileges of a low-privileged user on two different systems, such as Centos 8 and Ubuntu, using the same Exploit code with the DirtyPipe vulnerability.

This Thursday @BlackHatEvents , I will be presenting our research on a kernel exploitation method named #DirtyCred. With DirtyCred, you could write an #DirtyPipe liked exploit that works on different kernels and ARCHs without code changes. Check it out https://t.co/Qip23PSHl7 pic.twitter.com/jdopannoBO

— Zhenpeng Lin (@Markak_) August 7, 2022

There are currently no mitigations or updates to the DirtyCred exploit. Security researchers recommend separating privileged credentials from non-privileged ones using virtual memory to prevent potential Cross-Cache attacks using the vulnerability.

A Phishing Campaign Targeting Hotels and Travel Companies Detected

A phishing campaign targeting multiple hotels and travel companies has been detected running by the TA558 group. In the campaign, it was observed that RAT malware was exploited, allowing threat actors to access targeted systems, monitor the system regularly, capture critical data and carry out fraudulent activities with the captured data. In addition, it is seen that RAR and ISO file attachments have started to be used in this campaign instead of macro-content documents sent by phishing e-mails.

The chain of infection starts with the sending of phishing e-mails with message text in English, Spanish and Portuguese to the associated destinations. The main topic covered in the e-mails is to make a reservation at the targeted establishment. Such e-mails are sent purporting to come from key sources such as conference organizers and tourist office agents that are hard for recipients to ignore.

An ISO file from a remote source is uploaded to the target system when targets click on the URL claimed to be the reservation link in the message body. The ISO file contains a BAT file (batch file) that will run a PowerShell script when executed. In order to ensure permanence, the script creates a scheduled task to hold the RAT load on the target computer as long as the script is running. By executing the BAT file and then the PowerShell script, target systems are injected with malware such as AsyncRAT (mostly), Loda, Revenge RAT, XtremeRAT, CaptureTela, and BluStealer. RAT malware endangers hotel systems and causes the identity information of customers, bank, and credit card data being stored to be captured by threat actors.

TA558 has been an active threat actor targeting the hospitality, travel, and related industries since 2018. The activities carried out by this actor lead to the capture of corporate and customer data and possible financial losses. For example, in July 2022, the Booking.com account of The Marino Boutique Hotel in Lisbon, Portugal, was targeted by this hacking campaign. It is known that threat actors caused a financial loss of € 500,000 through a compromised hotel account in just four days. In this context, it is recommended to consider the following security practices to avoid being the target of similar attack campaigns.

Zoom Releases Updates Fixing A Critical Vulnerability Affecting macOS

Zoom has released security updates that fix a vulnerability in the macOS operating system that could allow a threat actor to take control of a user’s system. (Reference Link)

The security vulnerability with code CVE-2022-28756 affects the automatic update feature of the application. A low-privileged threat actor can exploit the vulnerability to gain root privileges on the vulnerable operating system during the automatic update process of versions 5.7.3 to 5.11.3. The vulnerability was identified by Patrick Wardle, founder of the Objective-See Foundation, and presented at the annual world-known Def Con Hack conference.

The vulnerability has been fixed in version 5.11.5 of the currently available Zoom app for macOS.

It is recommended that users using vulnerable versions of the Zoom App for macOS immediately apply the updates that fix the vulnerability so that they are not the target of attacks that can be carried out using the vulnerability.

Security News – Week 33

Published:

Welcome to our 33rd Weekly Security News. We’ve gathered the most speculative cyber security news for you. To learn details about this week’s security news, and protect yourself proactively, keep reading.

See you next week!

Thousands of VNC Servers Open to the Internet Detected

Cyble security researchers have observed an increase in attacks targeting open VNC sessions. VNC graphical desktop sharing system is a program developed to provide users with the convenience of remote control of a computer or system.

Recent studies have found that over 8,000 unauthenticated VNC installations are accessible over the Internet. The number of VNC servers left open to the Internet is mostly concentrated in China, Sweden, and the United States.

It has been noticed that there is a significant increase in attacks on port 5900, the default port of VNC servers accessible over the Internet.

Most of these attacks are carried out in the Netherlands, Russia, and Ukraine. In addition, some VNC servers vulnerable to attacks are owned by organizations serving critical infrastructure industries, including water treatment plants, manufacturers, and research facilities. Therefore, this situation puts critical infrastructure systems such as HMI, SCADA/ICS, and workstations connected via VNC and accessible over the Internet at risk.

Threat actors targeting the security of such systems can interfere with predefined configurations, take industrial control systems (ICS) out of service, disrupt the supply chain and processes in the affected industries, or gain access to sensitive data that can be used to compromise ICS systems. In addition, it has been observed that threat actors use these VNC accesses in their trading activities on platforms on the Deep Web.

Leaving VNCs open to the Internet without authentication makes it very easy for threat actors to break into the vulnerable network and wreak havoc. In this context, it is recommended to consider the following security practices to prevent institutions/organizations using VNC and similar solutions from being the target of possible attacks.

  • Ensure that critical systems in the IT environment are behind firewalls,
  • Internet exposure of VNCs should be minimized.
  • SCADA/ICS systems should be used in the latest versions published by the official vendor,
  • Strong password policies should be enforced within the organization,
  • Access controls within the organization should be configured correctly,
  • Network traffic should be constantly monitored for the security of the institution/organization inventory,
  • All necessary security measures for VNC must be enabled,
  • Cyber security awareness should be raised for those working in the SCADA/ICS environment.

Zoom Releases Updates Fixing A Critical Vulnerability Affecting macOS

Zoom has released security updates that fix a vulnerability in the macOS operating system that could allow a threat actor to take control of a user’s system. (Reference Link)

The security vulnerability with code CVE-2022-28756 affects the automatic update feature of the application. A low-privileged threat actor can exploit the vulnerability to gain root privileges on the vulnerable operating system during the automatic update process of versions 5.7.3 to 5.11.3. The vulnerability was identified by Patrick Wardle, founder of the Objective-See Foundation, and presented at the annual world-known Def Con Hack conference.

The vulnerability has been fixed in version 5.11.5 of the currently available Zoom app for macOS.

It is recommended that users using vulnerable versions of the Zoom App for macOS immediately apply the updates that fix the vulnerability so that they are not the target of attacks that can be carried out using the vulnerability.

A Critical Security Vulnerability Detected Affecting Cisco ASA and Firepower Solutions

A critical security vulnerability has been detected in the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that could allow an unauthenticated threat actor to gain access to the RSA Private Key. ASA software is the core operating system of Cisco’s ASA security appliances that protect data centers and corporate networks, while FTD software provides next-generation firewall (NGFW) service.

The vulnerability with code CVE-2022-20866 is caused by a logic error caused by storing the RSA key in memory on a hardware platform that performs hardware-based encryption. A remote threat actor can exploit the vulnerability to execute a Lenstra Side-Channel attack and gain access to the RSA key. A compromised RSA Private Key can be used to impersonate a device running Cisco ASA Software or Cisco FTD Software or to decrypt device traffic.

Cisco stated that the vulnerability only affects Cisco ASA Software 9.16.1 and later versions, Cisco FTD Software 7.0.0 and later versions, and has released security updates that fix the vulnerability. In this context, it is recommended that users using vulnerable Cisco ASA and FTD software versions immediately apply the published updates so that they are not the target of attacks that can be carried out using the vulnerability.

A New Attack Campaign Targeted Public Institutions and Industrial Organizations

A new attack campaign targeting defense industry organizations and public institutions in various countries have been detected by Kaspersky ICS CERT researchers. Due to the overlap of techniques, tactics, and procedures (TTPs) used, the attack attributed to the TA428 APT group targets industrial facilities, design bureaus, research institutes, government agencies, and ministries in various Eastern European countries (Belarus, Russia, and Ukraine) as well as Afghanistan.

The attack starts with the distribution of phishing emails created by threat actors using internal data of the targeted organization to the targets. Microsoft Word documents attached to phishing emails contain malicious code that exploits the CVE-2017-11882 vulnerability.

The vulnerability allows threat actors to execute arbitrary code on the vulnerable system through the PortDoor Backdoor malware without user interaction. A new variant of PortDoor Backdoor was detected in this campaign. The latest version PortDoor collects data from the infected system and sends it to command and control (CnC) servers controlled by threat actors. In addition, it was observed that backdoor malware such as nccTrojan, Logtu, Cotx, and DNSep was also used in the attack.

Threat actors, who first gain access to the targeted system, try to distribute malware to other computers in the corporate network in later stages. For this purpose, Ladon malware, which Chinese-origin threat actors frequently use, helps TA428 threat actors to carry out Lateral Movement activities in the target network. The final stage of the attack includes capturing the target organization’s domain controller by threat actors and acquiring critical documents and files from all workstations and servers of the organization.

This attack campaign demonstrates that spear phishing attacks remain one of the critical threats to industrial businesses and public institutions. Therefore, industrial organizations and public institutions must take a proactive cybersecurity stance to prevent such attacks successfully. In this context, it is recommended to consider the following security practices to avoid being the target of this and similar phishing or malware campaigns.

  • Emails, attachments, and links from unknown, suspicious parties should not be respected.
  • File/program or application downloads should be from legitimate and reliable sources.
  • The installed system, program, or applications should be used in the current versions where the vulnerabilities are fixed.
  • Comprehensive Anti-Virus/Anti-Malware security solutions should be used.
  • Institution/organization personnel should be aware of potential phishing/social engineering attacks.
  • IOC findings related to the campaign should be blocked from security solutions.

Security News – Week 32

Published:

A Critical Data Disclosure Vulnerability Has Been Detected in Slack

Slack, an internal messaging and communication application for organizations/businesses, is vulnerable to a security vulnerability that exposes user credentials.

The vulnerability was detected in Slack’s “Shared Invite Link” component. The “Shared Invite Link” functionality allows workspace administrators to create links to include other participants in the workspace. With this feature, the personnel of the institution/organization are invited to become workspace members via e-mail. The detected security vulnerability causes the hash values of Slack passwords to be transmitted to other workspace members when a user creates an invitation link. These password hashes do not appear in any Slack client. Accessing password hashes requires active monitoring of encrypted network traffic from Slack’s servers.

The vulnerability affects all users who created or canceled an invite link between April 17, 2017, and July 17, 2022. Slack officials have announced that as a precaution against the potential risk of a data breach, affected users have reset their Slack passwords. Slack users must set a new Slack password to log in again.

In this context, it is recommended to create new passwords by applying strong and unique policies, to enable MFA/2FA authentication controls on all possible platforms as a precaution against similar security vulnerabilities that may cause data breaches, and to ensure that the applications/programs and systems being used are always up to date.

A New AiTM Phishing Campaign Targeting Institution/Organization Personnel Has Been Detected

A large-scale phishing campaign using advanced AiTM (Adversary in the Middle) techniques has been detected by ThreatLabz researchers. AiTM attacks are newer and more advanced phishing attacks in which user login and session cookies are compromised, and MFA/2FA authentication processes are circumvented. The detected new campaign targets end users in organizations using Microsoft’s e-mail services.

A phishing campaign begins with the delivery of e-mails containing a malicious link to targets. Threat actors create newly registered phishing domains to target users of Microsoft mail services. An HTML page is opened in the user’s browser when users open the malicious phishing URL in the phishing e-mail, which allegedly contains details about an incoming invoice. The HTML page uses the window.location.replace() function to redirect visitors to phishing pages controlled by threat actors. Using multiple URL redirection methods helps avoid the campaign’s detection by corporate e-mail URL analysis solutions.

On phishing pages that appear as a Microsoft Office login page, the visitors’ MFA/2FA authentication processes are bypassed with advanced AiTM techniques, and user credentials are captured. There are three main open source AiTM phishing kits used in such attacks;

  • Evilginx2
  • Muraena
  • Modlishka

In addition, abuse of legitimate online code editing services such as CodeSandbox and Glitch has also been observed to ensure the longevity of the campaign process. The campaign targets the FinTech, Finance, Insurance, Accounting, and Energy sectors, which generally provide services in the USA, England, New Zealand, and Australia. In addition, it has been observed that threat actors register domain names impersonating Federal Credit Unions outside of Microsoft.

Business e-mail security (BEC) remains an ever-present threat to organizations. The campaign underlines the importance of the need to protect against similar attacks, which are increasing day by day. In order not to be the target of similar advanced phishing attacks that may be carried out in this context, it is recommended to implement the following security measures.

  • E-mails, attachments, and links from unknown and suspicious parties should not be respected,
  • Sensitive information should not be used on platforms that are not sure of its reliability,
  • Comprehensive Anti-Virus / Anti-Malware security solutions should be used,
  • Institution/organization personnel should be made aware of potential phishing/social engineering attacks,
  • Detected IOC findings related to the campaign should be blocked from security solutions.

Download IoC

Critical Vulnerabilities Affecting 1000+ Organizations Detected in FileWave MDM Solution

Critical security vulnerabilities affecting more than a thousand organizations have been identified in the MDM (Mobile Device Management) solution of FileWave, which provides device management solutions based in Switzerland. Considering the widespread use of IoT technologies, it is observed that the use of device management solutions provided by FileWave is increasing day by day. The solutions make it easy for IT administrators to manage all of an organization’s devices effectively.

  • The security vulnerability, tracked as CVE-2022-34907, is due to an Authentication Bypass bug affecting FileWave MDM versions before 14.6.3 and 14.7.x, allowing threat actors to circumvent authentication mechanisms in the vulnerable system.
  • A second vulnerability, tracked as CVE-2022-34906, is due to the presence of the hard-coded encryption key found in FileWave MDM versions before 14.6.3 and 14.7.x.

By exploiting the vulnerabilities, threat actors can capture critical data in the affected installations and execute arbitrary code on the system. Additionally, threat actors can use CVE-2022-34907 not only to hijack all managed devices but also to leak sensitive data such as device serial numbers, user email addresses, geolocation coordinates, IP addresses, device PINs, and more.

Vulnerable MDM installations are known to compromise the security of more than 1000 organizations. FileWave has fixed security vulnerabilities with a recent update (14.8). In this context, it is recommended that institutions/organizations or organizations using vulnerable MDM solutions immediately apply the security updates published in order not to be the target of attacks that can be carried out using vulnerabilities.

Security News – Week 31

Published:

Critical Vulnerabilities Affecting 1000+ Organizations Detected in FileWave MDM Solution

Critical security vulnerabilities affecting more than a thousand organizations have been identified in the MDM (Mobile Device Management) solution of FileWave, which provides device management solutions based in Switzerland. Considering the widespread use of IoT technologies, it is observed that the use of device management solutions provided by FileWave is increasing day by day. The solutions make it easy for IT administrators to manage all of an organization’s devices effectively.

  • The security vulnerability, tracked as CVE-2022-34907, is due to an Authentication Bypass bug affecting FileWave MDM versions before 14.6.3 and 14.7.x, allowing threat actors to circumvent authentication mechanisms in the vulnerable system.
  • A second vulnerability, tracked as CVE-2022-34906, is due to the presence of the hard-coded encryption key found in FileWave MDM versions before 14.6.3 and 14.7.x.

By exploiting the vulnerabilities, threat actors can capture critical data in the affected installations and execute arbitrary code on the system. Additionally, threat actors can use CVE-2022-34907 not only to hijack all managed devices but also to leak sensitive data such as device serial numbers, user email addresses, geolocation coordinates, IP addresses, device PINs, and more.

Vulnerable MDM installations are known to compromise the security of more than 1000 organizations. FileWave has fixed security vulnerabilities with a recent update (14.8). In this context, it is recommended that institutions/organizations or organizations using vulnerable MDM solutions immediately apply the security updates published in order not to be the target of attacks that can be carried out using vulnerabilities.

Critical Vulnerabilities Detected in Moxa NPort Series Devices

Two critical security vulnerabilities have been detected in the widely used NPort industrial connectivity appliance, manufactured by Taiwan-based industrial network and automation solutions provider Moxa, that could allow threat actors to disrupt systems.

0-day vulnerabilities tracked as CVE-2022-2043 and CVE-2022-2044 affect NPort 5110 device servers designed to connect devices to Ethernet networks. Remote threat actors can exploit security vulnerabilities to trigger a Denial of Service (DoS) condition on targeted devices. Exploiting both vulnerabilities requires network connectivity to the targeted device. Moxa has stated that the vulnerabilities only affect Firmware 2.10.

Affected NPort devices are widely used in many industries worldwide, including critical infrastructure sectors such as energy, manufacturing, and transportation systems. There are also allegations and reports that the devices in question were manipulated in 2015 attack campaigns targeting Ukraine’s electricity grid, which resulted in significant power outages. In this context, in order not to be the target of potential attacks that can be carried out by targeting critical infrastructure, it is recommended to consider the following practices:

  • Network exposure for all control system devices or systems should be minimized and ensured that they are not accessed over the Internet.
  • When remote access is required, secure methods such as a Virtual Private Network (VPN) should be used;
  • Control systems should be isolated from other networks against external attacks,
  • Comprehensive network and security solutions should be deployed,
  • It should be ensured that the systems being used are using the most current version available.

0-Day Vulnerabilities in PrestaShop Makes E-Commerce Sites Vulnerable

Multiple critical 0-day security vulnerabilities which threat actors use to inject malicious code into e-commerce sites have been detected in the PrestaShop E-Commerce platform. The combined use of security vulnerabilities causes threat actors to remote code execution (RCE) on affected web servers and capture their customers’ payment information.

The attack requires the platform to be vulnerable to SQL injection exploits. In the analysis performed, the attack starts with the threat actors sending malicious GET and POST requests to the endpoint open to SQL injection. Then, threat actors gain full control via the PHP file created at the platform’s root directory and inject a fake payment form on the prepayment page. In this way, the credit card information entered in the fake form by the store customers is captured. Additionally, PrestaShop officials stated that threat actors might be using MySQL Smarty cache storage features as part of the attack vector. Therefore, it is recommended to disable this feature as a mitigation measure.

SQL injection vulnerabilities affect PrestaShop versions 1.6.0.10 or higher. 1.7.8.2 and higher versions are not affected by the security vulnerability in default configurations. PrestaShop 1.7.8.7 was released to harden MySQL Smarty cache storage against code injection attacks. Web application administrators using vulnerable PrestaShop versions must immediately apply the updates that fix the vulnerabilities.

July 2022

Security News – Week 30

Published:

0-Day Vulnerabilities in PrestaShop Makes E-Commerce Sites Vulnerable

Multiple critical 0-day security vulnerabilities which threat actors use to inject malicious code into e-commerce sites have been detected in the PrestaShop E-Commerce platform. The combined use of security vulnerabilities causes threat actors to remote code execution (RCE) on affected web servers and capture their customers’ payment information.

The attack requires the platform to be vulnerable to SQL injection exploits. In the analysis performed, the attack starts with the threat actors sending malicious GET and POST requests to the endpoint open to SQL injection. Then, threat actors gain full control via the PHP file created at the platform’s root directory and inject a fake payment form on the prepayment page. In this way, the credit card information entered in the fake form by the store customers is captured. Additionally, PrestaShop officials stated that threat actors might be using MySQL Smarty cache storage features as part of the attack vector. Therefore, it is recommended to disable this feature as a mitigation measure.

SQL injection vulnerabilities affect PrestaShop versions 1.6.0.10 or higher. 1.7.8.2 and higher versions are not affected by the security vulnerability in default configurations. PrestaShop 1.7.8.7 was released to harden MySQL Smarty cache storage against code injection attacks. Web application administrators using vulnerable PrestaShop versions must immediately apply the updates that fix the vulnerabilities.

“Sality”: The Malware Distributed to Industrial Systems via Password Recovery Tools

Dragos security researchers identified a malware distribution campaign to industrial control systems (ICS) through password recovery tools developed for programmable logic controllers (PLC). Password recovery tools that are advertised on various social media platforms promise to recover passwords of systems used in industrial control environments such as Automation Direct, Omron, Siemens, Fuji Electric, Mitsubishi, LG, Vigor, Pro-Face, Allen Bradley, Weintek, PLC, ABB, Panasonic, and HMI.

These password recovery tools use known security vulnerabilities in devices to reveal system passwords. However, these tools inject a trojan software called Sality into vulnerable systems in the background. Sality has advanced features such as terminating trojan-injected system processes, connecting to remote servers, downloading additional payloads, or leaking data from the host.

Also, thanks to the Sality trojan’s ability to communicate over a peer-to-peer (P2P) network, infected systems can become part of a botnet network controlled by threat actors. The Sality sample analyzed by Dragos researchers has been observed to be infected to carry out activities focused on cryptocurrency hijacking from vulnerable systems.

In this context, it is important to apply the following security measures in order not to be the target of similar malware campaigns targeting critical/sensitive systems;

Multiple Critical Vulnerabilities Detected in Drupal CMS

Multiple security vulnerabilities, including critical ones, detected in the Drupal open source content management system (CMS) have been fixed with updates released by Drupal officials.

The “critical” security vulnerability as tracked CVE-2022-25277 affects Drupal CMS 9.3 and 9.4. The vulnerability found in Drupal Core can cause arbitrary PHP code execution on Apache web servers by loading specially crafted files. However, Drupal officials stated that this vulnerability only affects Apache web servers in specific configurations. Three other security vulnerabilities, considered less critical, allow performed cross-site scripting (XSS) attacks, disclosure of information, or bypassing access restrictions.

These security vulnerabilities were fixed with Drupal CMS versions 9.4.3, 9.3.19, and 7.91. In order not to be the target of attacks using vulnerabilities, Drupal CMS users are advised to consider the recommendations published by CISA and immediately apply the published updates to the vulnerable versions.

Security News – Week 29

Published:

WPBakery Page Builder Plugin’s Vulnerability Affects 1.6 Million WordPress Sites

The WordPress plugin, which allows editing and customizing WordPress pages without writing any code, is vulnerable to a vulnerability that could allow file uploads without authentication. Threat actors are hacking campaigns targeting approximately 1.6 million WordPress sites through this vulnerable plugin.

The critical vulnerability, tracked as CVE-2021-24284, allows an unauthenticated threat actor to inject malicious Javascript code into sites using any version of the plugin, resulting in a complete site takeover. Additionally, a trojan malware called NDSW is deployed that will redirect visitors to phishing and harmful advertising pages by injecting malicious code into legitimate Javascript files.

Due to the low probability of getting an update, it is recommended that the plugin be removed from use immediately, and alternatives should be found.

In addition, even if the plugin is not used, it is recommended that the IP addresses detected in the attack campaign be blocked from the security devices in use.

NFT Platform Security Breach Caused 314 NFTs Hijacking

It has been detected that an NFT minting platform, which NFT artists and collectors widely use, was compromised by threat actors on July 17, 2022, and 314 NFTs were hijacked.

According to the statement made by blockchain security firm CertiK, the breach was committed by threat actors by injecting malicious JavaScript code into the platform’s web application. This malicious Javascript code enables visitors and collectors to approve the “setApprovalForAll” function in connecting their crypto wallets (MetaMask, Coinbase, WalletConnect) to the compromised website. The “setApprovalForAll” function requests the ability to access and modify user funds by showing the token’s contract address. If the user approves, threat actors can access the crypto assets of the targets.

Six accounts were directly affected by the said attack, and 275 ETH cryptocurrencies worth approximately $375,000 were seized. Here are some security steps to consider in order not to be affected by similar security breaches;

  • The login information used in crypto wallets should be created using unique and strong policies.
  • Direct NFT trading should not be performed with wallets containing crypto assets. In this process, assets should be distributed using different wallets.
  • Cryptocurrency wallets should not be connected to platforms unsure of their reliability.
  • Finally, care should be taken not to have any other browser add-ons in browsers with crypto wallets used as browser add-ons, such as Metamask.

MageCart E-Skimmer Attacks Targeted 311 Restaurants in the USA

With the MageCart e-skimmer campaigns targeting three online ordering platforms, small online ordering platforms, bank card information of 50,000 customers of 311 restaurants serving in the USA was seized. Online ordering platforms for restaurants allow customers to order food online and outsource the burden for restaurants to develop an ordering system. Due to its widespread use, online ordering platforms have become a high-value target for threat actors carrying out Magecart e-skimmer attacks. Magecart malware is JavaScript code that collects credit card data and other identifying information when online shoppers enter the payment page.

The campaign started on January 18, 2022, targeting 80 restaurants using the first platform and 74 restaurants using the second platform. The third platform, on the other hand, was targeted by another MageCart campaign on November 12, 2021, which resulted in e-skimmer infections in 157 restaurants using the platform. It was observed that 50,000 bank card information seized in the campaign, which affected 311 restaurants in total, was put up for sale on Dark Web platforms.

Advanced digital security technologies must be used to prevent Magecart attacks. Data Breach Monitoring services are a preferable solution to protect e-commerce sites against potential breaches. Additionally, for e-commerce providers, It is recommended to ensure that the software, hardware, and tools being used are up-to-date, request third-party service providers to have their code checked, and apply HTTP Content-Security-Policy principles which provide an additional layer of protection against potential attacks. The precautions that customers using e-commerce services should take in order not to be affected by similar security breaches are as follows;

  • Personal information should not be entered on unreliable/suspicious websites,
  • Virtual cards created for e-commerce transactions should be used,
  • Make sure that the visited page is not a fake domain with a similar name created by threat actors,

IOC findings such as IP addresses and domains known to be used by threat actors in these campaigns should be blocked from security solutions in use.

Security News – Week 28

Published:

RedAlert: The New Ransomware Targeting VMware ESXi Servers

A new Ransomware called RedAlert (N13V) has been detected targeting VMware ESXi servers installed on both Windows and Linux systems in attacks on corporate networks.

The Linux encryptor is designed to focus on VMware ESXi servers and has command line parameters that allow threat actors to shut down running virtual machines before encrypting the file. The malware, which has been observed to use the NTRUEncrypt algorithm for encryption operations, only targets files associated with VMware ESXi servers, such as log files (.log), swap files (.vswp), virtual disks (.vmdk), and memory files (.vmem).

In the sample analyzed by security researchers, it was observed that the Ransomware software added the “.crypt658” extension to the filenames of encrypted files. A ransom note named HOW_TO_RESTORE, which is observed to be added to each folder by the ransomware, contains a description of the data compromised and a Tor link that directs victims to the ransom payment site. The payment page on the Tor network is similar to other Ransomware operation pages where a ransom demand is shown, and options are offered to negotiate with threat actors. RedAlert/N13V threat actors only accept Monero cryptocurrency for ransom payment.

A leak site called “Board of Shame” has been created by RedAlert threat actors to leak data of compromised institutions/organizations and to announce breaches. The last post shared by the threat actors on the leak site stated that a corporate firm providing cloud computing services was targeted. In the alleged breach, it was announced that more than 300 GB of data, including social security numbers, driver’s licenses, financial documents, payrolls, and bank statements of the company personnel, was seized.

In order not to be the target of similar ransomware attacks that may be carried out in this context, it is recommended to take the following actions;

Marriott International Suffered from Security Breach Leading to 20GB of Data Hijacking

Hotel chain Marriott International has confirmed that it has suffered a new data breach that resulted in the hijacking of 20GB of internal data by threat actors. In this breach, threat actors compromised the BWI Airport Marriott Maryland (BWIA) network.

About a month ago, threat actors gaining unauthorized access to the BWI Airport Marriott network seized 20GB of data allegedly containing credit card, reservation, flight information, and internal confidential business documents belonging to Marriott customers. After the breach, threat actors informed many company employees about the breach. As a result, it is known that Marriott International officials refused the ransom payment demanded by the threat actors and launched a joint investigation with law enforcement officials for the unauthorized access, which was brought under control within about six hours. Images of some documents that are stated to have been seized by the threat actors in the breach are given below:

Although Marriott International, known to have been exposed to similar data breaches before, defines the seized data as non-sensitive internal business files, it has announced that approximately 400 people thought to be affected by the breach will be informed of the breach.

Therefore, in order not to be the target of similar security breaches that may be carried out in this context, it is recommended to consider the following practices and precautions:

  • The system/program or software being used should always be kept up to date,
  • Updates and fixes that eliminate vulnerabilities should be applied immediately,
  • Institution/organization personnel should be made aware of possible social engineering/phishing attacks,
  • Critical system/data should be backed up regularly,
  • Comprehensive security solutions should be used,
  • Passwords used in accounts should be created using strong policies,
  • MFA/2FA authentication features should be enabled on all possible platforms,
  • Attack surface analysis tests should be performed regularly in the institution/organization network.

In order not to be the target of similar ransomware attacks that may be carried out in this context, it is recommended to take the following actions;

GitLab Releases Security Updates Fixing Critical Vulnerabilities

GitLab has released fixes and updates that fix critical vulnerabilities as part of the June security updates.

Some of the security vulnerabilities that have been fixed with the released updates and rated as critical, high, and medium are as follows;

  • Vulnerability tracked as CVE-2022-2185 (critical) exists due to incorrect input validation in Project Imports. As a result, a remote privileged user can import a maliciously crafted project, causing remote code execution on the vulnerable system.
  • The XSS vulnerability tracked as CVE-2022-2235 (high) is due to insufficient sanitization of user-supplied data in ZenTao integration. As a result, a remote threat actor can direct targets to open a specially crafted link and run arbitrary HTML and script code in the user’s browser in the context of the vulnerable website.
  • The security vulnerability tracked as CVE-2022-2229 (high) is caused by incorrect authorization. A remote threat actor can extract the value of an unprotected variable whose name it knows in public or private projects of which it is a member.

These vulnerabilities affected all GitLab CE/EE versions between 13.7.0 and 15.1.0 (inclusive) and were fixed in the released versions 15.1.1, 15.0.4, and 14.10.5. Users using vulnerable GitLab versions are advised to apply the released updates immediately.

Security News – Week 27

Published:

Multiple Critical Vulnerabilities Detected in Jenkins

Multiple vulnerabilities have been detected in Jenkins – an open-source software developed with Java to automate the Continuous Integration process – allowing threat actors to perform XSS and CSRF attacks. Jenkins continually develops and tests software projects, making it easy for developers to integrate changes into the project.

Details of the vulnerabilities rated as critical are given below;

  • The vulnerability, tracked as CVE-2022-34784, is a cross-site scripting (XSS) vulnerability that affects the build-metrics plugin used by Jenkins and can be exploited by threat actors with build/update permissions.
  • CVE-2022-34787 is a cross-site scripting (XSS) vulnerability found in the Project Inheritance plugin used by Jenkins.
  • CVE-2022-34788 is a cross-site scripting (XSS) execution vulnerability found in the Matrix Reloaded plugin used by Jenkins.
  • CVE-2022-34790 is a cross-site scripting (XSS) vulnerability found in the eXtreme Feedback Panel plugin used by Jenkins.
  • The vulnerability tracked as CVE-2022-34792 is found in the Recipe plugin used by Jenkins and allows threat actors to perform cross-site request forgery (CSRF) and XXE (XML External Entity) injection attacks on the affected system.
  • The vulnerability tracked as CVE-2022-34791 resides in the Email Parameter plugin used by Jenkins and allows threat actors to perform cross-site scripting (XSS) attacks on affected installations.
  • CVE-2022-34783 is a cross-site scripting (XSS) vulnerability found in the Plot plugin used by Jenkins.
  • CVE-2022-34777 is a stored cross-site scripting (XSS) vulnerability found in the GitLab plugin used by Jenkins.
  • CVE-2022-34786 is a cross-site scripting (XSS) vulnerability found in the Rich Text Publisher plugin used by Jenkins.
  • CVE-2022-34778 is a cross-site scripting (XSS) vulnerability found in the TestNG Results plugin used by Jenkins.
  • CVE-2022-34795 is a stored cross-site scripting (XSS) vulnerability found in the Deployment Dashboard plugin used by Jenkins.

An update that fixes the security vulnerabilities detected in these Jenkins plugins has not been released yet. Successful exploitation of vulnerabilities can allow remote threat actors to obtain sensitive information, change the web page’s appearance, and carry out phishing attacks. In this context, it is recommended to follow the updates that fix the vulnerabilities and apply them immediately if they are published.

[Exploit Details]: Critical RCE Vulnerability Found in ManageEngine ADAudit Plus

In March 2022, an unauthenticated remote code execution (RCE) vulnerability was identified affecting the Zoho ManageEngine ADAudit Plus solution, which organizations use to monitor changes in Active Directory. (Reference Link)

The security vulnerability tracked as CVE-2022-28219 is caused by a combination of Untrusted Java Deserialization, Path Traversal, and XEE (XML External Entity) issues. Apart from allowing remote code execution on affected systems, the vulnerability can be exploited in some cases to compromise domain administrator accounts.

Active Directory management-related products (ADManager Plus, ADSelfService Plus, ADAudit Plus) are widely used by institutions/organizations.

These applications create an attractive attack surface for threat actors because of their privileged access to Active Directory. Details of the PoC code and applications for exploiting the vulnerability affecting ADAudit Plus have been published by security researchers.

Applications such as ADAudit Plus that integrate with Active Directory must store credentials to connect to it. ADAudit Plus keeps these credentials encrypted in its database. It is possible to reverse the encryption for clear access to these credentials. If these credentials are compromised, it gives a lot of privilege to the threat actors. ADAudit Plus makes it easy for users to connect to AD with their domain administrator credentials, and users use this easy way instead of creating a special service account with limited privileges. By manipulating this feature, threat actors can completely compromise the AD domain through ADAudit Plus.

In order not to be the target of attacks that can be carried out by exploiting the vulnerability, institutions/organizations using ADAudit Plus are urgently recommended to upgrade to ADAudit Plus 7060 or a later version to fix the security vulnerability.

GitLab Releases Security Updates Fixing Critical Vulnerabilities

GitLab has released fixes and updates that fix critical vulnerabilities as part of the June security updates.

Some of the security vulnerabilities that have been fixed with the released updates and rated as critical, high, and medium are as follows;

  • Vulnerability tracked as CVE-2022-2185 (critical) exists due to incorrect input validation in Project Imports. As a result, a remote privileged user can import a maliciously crafted project, causing remote code execution on the vulnerable system.
  • The XSS vulnerability tracked as CVE-2022-2235 (high) is due to insufficient sanitization of user-supplied data in ZenTao integration. As a result, a remote threat actor can direct targets to open a specially crafted link and run arbitrary HTML and script code in the user’s browser in the context of the vulnerable website.
  • The security vulnerability tracked as CVE-2022-2229 (high) is caused by incorrect authorization. A remote threat actor can extract the value of an unprotected variable whose name it knows in public or private projects of which it is a member.

These vulnerabilities affected all GitLab CE/EE versions between 13.7.0 and 15.1.0 (inclusive) and were fixed in the released versions 15.1.1, 15.0.4, and 14.10.5. Users using vulnerable GitLab versions are advised to apply the released updates immediately.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

Know What Is Exposed. Before Attackers Do.

Book a demo of the platform.

  • 4.7Gartner Peer Insights
  • 24hEarly warning time
  • 190+Countries covered

What you see in the demo

  1. Your exposureAssets and services seen from the outside, starting from your own domain.
  2. Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
  3. From alert to actionHow findings reach your team and what to do next.