In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.

CVE-2022-2032 Stored Cross Site-Scripting in File Manager 14 Jun 2022 762 CVE-2022-2059 Stored Cross Site-Scripting in Agent Manager 14 Jun 2022 762 CVE-2022-1648 Relative Path Traversal to Remote Code Execution in File Manager 13 May 2022 761 CVE-2022-26310 Improper Authorization in User Management to Vertical Privilege Escalation 13 May 2022 761 CVE-2022-26309 Cross-Site Request en Bulk operation (User operation) 13 May 2022 761 CVE-2022-26308 Improper Access Control in Configuration (Credential store) 13 May 2022 761 CVE-2022-0507 Vulnerability: Authenticated SQL Injection in API 10 Feb 2022 760 CVE-2021-46681 Vulnerability XSS in module mass operation name field 15 Sept 2021 757 CVE-2021-46680 Vulnerability XSS in module form name field 15 Sept 2021 757 CVE-2021-46679 Vulnerability XSS in service elements 15 Sept 2021 757 CVE-2021-46678 Vulnerability XSS in service from name field 15 Sept 2021 757 CVE-2021-46677 Vulnerability XSS in Event filter name field 15 Sept 2021 757 CVE-2021-46676 Vulnerability XSS in Transaction Map name field 15 Sept 2021 757 CVE-2021-34075 In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access. 30 Jun 2021 756 CVE-2021-35501 Vulnerability XSS in in the name field of a visual console 25 Jun 2021 755 CVE-2021-32100 A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user. 29 Jan 2020 743 CVE-2021-32099 A SQL injection vulnerability in the pandora\_console component of Artica Pandora FMS 742 allows an nauthenticated attacker to upgrade his unprivileged session via the /include/chart\_generator.php session\_id parameter, leading to a login bypass. 29 Jan 2020 743 CVE-2021-32098 functions\_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf\_live\_view ip\_dst, dst\_port, or src\_port parameter, a different vulnerability than CVE-2019-20224. 29 Jan 2020 743 CVE-2020-8947 functions\_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf\_live\_view ip\_dst, dst\_port, or src\_port parameter, a different vulnerability than CVE-2019-20224. 18 Dec 2019 742 CVE-2020-8511 In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue than CVE-2020-7935 and CVE-2020-8500. 8 Jun 2021 93 CVE-2020-8500 \*\* DISPUTED \*\* In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality. 8 Jun 2021 93 CVE-2020-8497 In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. 8 Jun 2021 93 CVE-2020-7935 Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a (or use an existing) directory that is externally accessible to store PHP files. The filename and the exact path is known by the attacker, so it is possible to execute PHP code in the context of the application. The vulnerability is exploitable only with Administrator access. 8 Jun 2021 755 CVE-2020-5844 index.php?sec=godmode/extensions&sec2=extensions/files\_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742\_FIX\_PERL2020. 10 Feb 2021 752 CVE-2020-26518 Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora\_console/include/chart\_generator.php session\_id parameter. 2 Oct 2020 743 CVE-2020-13855 Pandora FMS 744 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature. 4 Jun 2020 745 CVE-2020-13854 Pandora FMS 744 allows privilege escalation. 4 Jun 2020 745 CVE-2020-13853 Pandora FMS 744 has persistent XSS in the Messages feature. 4 Jun 2020 745 CVE-2020-13852 Pandora FMS 744 allows arbitrary file upload (leading to remote command execution) via the File Manager feature. 4 Jun 2020 745 CVE-2020-13851 Pandora FMS 744 allows remote command execution via the events feature. 4 Jun 2020 745 CVE-2020-13850 Artica Pandora FMS 744 has inadequate access controls on a web folder. 4 Jun 2020 747 CVE-2020-11749 Pandora FMS 7.0 NG 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2. 14 Apr 2020 747 CVE-2020-8947 Allows remote attackers to execute arbitrary OS commands via shell metacharacters in the netflow report. It needs valid credentials to success. 12 Feb 2020 743 CVE-2020-8511 Pandora FMS through 7.42, admin users can execute arbitrary code by uploading a .php file via the File Repository component. 31 Jan 2020 N/A CVE-2020-8497 Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. 30 Jan 2020 746 CVE-2020-7935 Artica Pandora FMS through 742 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager by the admin user. The vulnerability is exploitable only with Administrator access. 23 Jan 2020 N/A CVE-2020-5844 Files\_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. 6 Jan 2020 743 CVE-2019-20224 Netflow stats in Pandora FMS NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip\_src parameter. 2 Jan 2020 742 CVE-2019-20050 Pandora FMS 742 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "tricky" name in the filemanager. The exploit works when the php-fileinfo extension is disabled on the host system. The attacker must include shell metacharacters in the content type. 27 Dec 2019 742 CCVE-2019-13035 Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\\PandoraFMS (the current directory) as NT AUTHORITY\\SYSTEM upon web requests to the portal. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\\SYSTEM. 29 Jun 2019 735 CVE-2018-11223 XSS in Artica Pandora FMS before 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter. 16 May 2018 723 CVE-2018-11222 Local File Inclusion (LFI) in Pandora FMS through version 723 allows an attacker to call any php file via the /pandora\_console/ajax.php ajax endpoint. 16 May 2018 723 CVE-2018-11221 Unauthenticated untrusted file upload in Pandora FMS through version 723 allows an attacker to upload an arbitrary plugin via include/ajax/update\_manager.ajax in the update system. 16 May 2018 723 CVE-2017-15937 Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX). 27 Oct 2017 714 CVE-2017-15936 Pandora FMS NG an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed. 27 Oct 2017 714 CVE-2017-15935 Pandora FMS 7.0 vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file. 27 Oct 2017 714 CVE-2017-15934 Pandora FMS 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter. 27 Oct 2017 714 CVE-2010-4283 PHP remote file inclusion vulnerability in extras/pandora\_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv\[1\] parameter. 17 Nov 2014 3.1.1 CVE-2010-4282 Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora\_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php. 17 Nov 2014 3.1.1 CVE-2010-4281 Incomplete blacklist vulnerability in the safe\_url\_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character. 17 Nov 2014 3.1.1 CVE-2010-4280 Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id\_group parameter in an operation/agentes/ver\_agente action to ajax.php or (2) the group\_id parameter in an operation/agentes/estado\_agente action to index.php, related to operation/agentes/estado\_agente.php. 17 Nov 2014 3.1.1 CVE-2010-4279 The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash\_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash\_user parameter, in conjunction with the md5 hash of "admin" in the loginhash\_data parameter. 17 Nov 2014 3.1.1 CVE-2010-4278 operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php. 17 Nov 2014 3.1.1 CVE-2014-8629 Cross-site scripting (XSS) vulnerability in the Page visualization agents in Pandora FMS 5.1 SP1 and earlier allows remote attackers to inject arbitrary web script or HTML via the refr parameter to index.php. 11 Nov 2014 5.1 SP2

CVE-2022-2059: Pandora FMS Common Vulnerabilities and Exposures

A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal.

This post is about CVE-2022–24992 which refers to vulnerability in QRCDR widely used QR-Code generator script.

****About QRCDR:****

> QRCDR is a popular PHP — JavaScript QR-Code Generator, which is widely used for creating customized QR-Code in easy steps.  
> also, it’s used by a few WordPress QR Code Generator Plugins and Mobile applications Which is not covered in this article.

Hello dear readers, it’s @n0lsec, Today I going to share with you details of the ZeroDay vulnerability which I was found in QRCDR (reported to the vendor and patched).

QRCDR— responsive QR Code generator

**Core finding**

*   QRCDR(5.2.7 and all prior versions are vulnerable ) to Directory Path Traversal Vulnerability.
*   POST parameters with _optionlogo=[payload]_ which is malicious payload sent to leads to path traversal
*   According to server security configurations, the attacker can read arbitrary sensitive server files, configurations, etc
*   An attacker can escalate path-traversal to RCE in some cases

**Mitigation**

*   Just update to the latest version, At the time i wrote this post it is Version 5.2.9

How find?  
Meanwhile working on a specific Bug Bounty program, which is called REDACTED.COM because of the information disclosure policy, I was found quite an interesting endpoint which leads customers to create customized QR-Code with extra options, I was opened browser inspector and watched to Request/Responses, so I realized part of script leads users to add a custom logo to our QR-Code which was so interesting to me,  
here I opened the browser inspector and look at what we had, there was the main file of script process.php which is in the path: /ajax/process.php intercept POST request and body parameters, optionlogo looks like below:

the script provided some predefined logos and we can select one of them and load it into our QR-Code, The key part of vulnerability is hear which maybe let us find some interesting things like Path Traversal — LFI or maybe SSRF so I decided to check.

After some work I tried Path-Traversal, I have tried the first payload without encoding or any bypass method, and I had received /etc/passwd file content with base64-encoded. So that’s it.

Because of the severity, I was sent a report immediately to the vendor and I got rewarded!

REDACTED.COM’s Base64-Decoded contents of /etc/passwd

**Report to Dev-Team**

After checking the code, found out that the script is part of the QRCDR script, so I found the Dev-Team email and sent the details of a vulnerability, they responded quickly and fixed the vulnerability after a few hours. Considering that the script is popular and widely used, I decided to write this post.

**what happened?**

I searched the internet for the QRCDR script and found the null version, so I checked the code and found that the script does not completely clear the POST value of the optionlogo parameter and uses the code directly in the QR-Code.

part of process.php file, look at line 17 which is no any kind of sanitization

as you see mergeImage() function just create image with our injected payload and when it comes to SVG format we have some Directory-Path-Traversal magic like this:

<image xlink:href=”/etc/passwd(base64-encode)” > which is brings content of any files to us! :)

**Mitigation**

The vulnerability now fixed but if you want to fix it manually should know to remove any malicious content which can help attacker to change directory in file name and directory name.

*   removing any special characters in file | directory name [. / \ ]
*   thinking about cross-platform directory traversal characters
*   after all maybe configuring server with chroot-jail, cloudflare like functionality to prevent escalation maybe good choices.even i think hackers always find their ways:)

Feel free to contact me on twitter , i would appreciate it if you send me any problem , feedback and opinion.

CVE-2022-24992: CVE-2022–24992: QRCDR ZeroDay Path Traversal Vulnerability

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

No match.

Moodle official production repository

RSS Atom

CVE-2022-35649: Official Moodle git projects - moodle.git/search

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

*   Unsafe Object recursive merge
    
*   Property definition by path
    

**Unsafe Object recursive merge**

The logic of a vulnerable recursive merge function follows the following high-level model:

    merge (target, source)
    
      foreach property of source
    if property exists and is an object on both the target and the source
    
      merge(target[property], source[property])
    
    else
    
      target[property] = source[property]
    
    

When the source object contains a property named _proto_ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

**Property definition by path**

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to _proto_.myValue. myValue is then assigned to the prototype of the class of the object.

CVE-2021-23397: Snyk Vulnerability Database | Snyk

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.

CVE-2021-23373: Snyk Vulnerability Database | Snyk

Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL.

CVE-2022-36450: Possible remote code execution through obsidian:// URI scheme

An issue was discovered in Atos Unify OpenScape SBC 9 and 10 before 10R2.2.1, Atos Unify OpenScape Branch 9 and 10 before version 10R2.1.1, and Atos Unify OpenScape BCF 10 before 10R9.12.1. A remote code execution vulnerability may allow an unauthenticated attacker (with network access to the admin interface) to disrupt system availability or potentially compromise the confidentiality and integrity of the system.

%PDF-1.4 %���� 3 0 obj <> /Annots \[ 9 0 R \] /Contents 4 0 R>> endobj 4 0 obj <> stream x��X�v�6��+f��&@��$nzڦ�g�tA��Ą"������e9�\[۔3s���ǡ��~.F�SN�z�0��v�Ь��9��5:���;A��3����s'���Y����sX:�\\��t��LDL�������:�� v��&�O��T-H�Wi(QȄ)�|z4K�^},����M'3��i�j~$� p��� ��dSe�Mқ�.�;��}8�~8�qO��ft\]>//FR0O�~�\_�� ��LNӑ%�J���$9-��cw���G<�qGϡ� \]��:�����}N�cx^����NhԂ~�C��{L���$�\]x ww�l�1�u��wrg��+r����Kxg�R� ���B����;�f���1��㿨5���vb�z���Ķr\\�>��,20�uMDl����Z�UC'?p�����#X�������T��Q���"����,�f�����\\C� �4eMm"��V�4�׊�g�?Vżu�!L�\[ݽ��\*.�%�E�����wO�=�@2 A�/���U\\+z7jL�S�@G\*�a�+G8B�h�@��p,ܣ�YL��##뷸n��:}���Kr������G;���8����f�����9�a�^0\_�Z�\_Pj,����k�V��,UE��3�R��\\�QU���FՍ^i�qC�|���~��z>ꀷ��ܟ��Ό&T��w2�3y�P���;�󼼅v��Yj%�⦉����۬YR��۲�Jq��������� ���

CVE-2022-36444

Hello everyone! Microsoft has been acting weird lately. I mean the recent publication of a propaganda report about evil Russians and how Microsoft is involved in the conflict between countries. It wouldn’t be unusual for a US government agency, NSA or CIA to publish such a report. But when a global IT vendor, which, in […]

Hello everyone! Microsoft has been acting weird lately. I mean the recent publication of a propaganda report about evil Russians and how Microsoft is involved in the conflict between countries. It wouldn’t be unusual for a US government agency, NSA or CIA to publish such a report. But when a global IT vendor, which, in theory, should be more or less neutral, does this… This is a clear signal. It’s not about business anymore.

I’ll take a closer look at this report in the next episode of the Vulnerability Management news, but for now let’s take a look at Microsoft July Patch Tuesday. Yes, the vendor is behaving strangely, but Microsoft products need to be patched. Right? At least for now. And tracking vulnerabilities is always a good thing. 🙂

On July Patch Tuesday, July 12, 84 vulnerabilities were released. Between June and July Patch Tuesdays, 15 vulnerabilities were released. This gives us 99 vulnerabilities in the report.

    $ cat comments_links.txt 
    Qualys|July 2022 Patch Tuesday. Microsoft Releases 84 Vulnerabilities with 4 Critical, plus 2 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 27 Vulnerabilities with 18 Critical.|https://blog.qualys.com/vulnerabilities-threat-research/2022/07/12/july-2022-patch-tuesday
    ZDI|The July 2022 Security Update Review|https://www.zerodayinitiative.com/blog/2022/7/12/the-july-2022-security-update-review
    
    $ python3.8 vulristics.py --report-type "ms_patch_tuesday_extended" --mspt-year 2022 --mspt-month "July" --mspt-comments-links-path "comments_links.txt"  --rewrite-flag "True"
    ...
    Creating Patch Tuesday profile...
    MS PT Year: 2022
    MS PT Month: July
    MS PT Date: 2022-07-12
    MS PT CVEs found: 84
    Ext MS PT Date from: 2022-06-15
    Ext MS PT Date to: 2022-07-11
    Ext MS PT CVEs found: 15
    ALL MS PT CVEs: 99
    ...

*   Urgent: 0
*   Critical: 1
*   High: 19
*   Medium: 78
*   Low: 1

Interestingly, in this Patch Tuesday, more than half of all vulnerabilities are EoP.

What can I say, prioritization in Vulristics works correctly. At the top of the July Patch Tuesday list is one critical and actively exploited **Elevation of Privilege** in Windows CSRSS (CVE-2022-22047). This vulnerability has been widely reported in the media.

Client Server Runtime Subsystem, or csrss.exe, is a component of the Windows NT family of operating systems that provides the user mode side of the Win32 subsystem and is included in Windows NT 3.1 and later. Because most of the Win32 subsystem operations have been moved to kernel mode drivers in Windows NT 4 and later, CSRSS is mainly responsible for Win32 console handling and GUI shutdown.

CSRSS runs as a user-mode system service. When a user-mode process calls a function involving console windows, process/thread creation, or side-by-side support, instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.

This Elevation of Privilege vulnerability in CSRSS allows an attacker to execute code as SYSTEM, provided they can execute other code on the target. Bugs of this type are typically paired with a code execution bug, usually a specially crafted Office or Adobe document, to take over a system. These attacks often rely on macros, which is why so many were disheartened to hear Microsoft’s delay in blocking all Office macros by default.

Microsoft says this vulnerability has been exploited in the wild, though no further details have been shared. There is no public exploit yet. Two similar vulnerabilities in CSRSS (CVE-2022-22049 and CVE-2022-22026) were also fixed, likely as a result of Microsoft’s investigation into the in-the-wild exploitation of CVE-2022-22047.

**RPC RCE**

**Remote Code Execution** in Remote Procedure Call Runtime (CVE-2022-22038). Here Microsoft has a POC exploit. This July Patch Tuesday bug could allow a remote, unauthenticated attacker to exploit code on an affected system. While not specified in the bulletin, the presumption is that the code execution would occur at elevated privileges. Combine these attributes and you end up with a potentially wormable bug. Microsoft states the attack complexity is high. Additional actions by an attacker are required in order to prepare a target for successful exploitation and an attacker would need to make “repeated exploitation attempts” to take advantage of this bug, but unless you are actively blocking RPC activity, you may not see these attempts.

**Microsoft Edge Memory Corruption**

Between June and July Patch Tuesday, **Memory Corruption** in Microsoft Edge (CVE-2022-2294) was released. Heap buffer overflow in WebRTC, to be precise. WebRTC (Web Real-Time Communication) is a free and open-source project providing web browsers and mobile applications with real-time communication (RTC) via application programming interfaces (APIs). It allows audio and video communication to work inside web pages by allowing direct peer-to-peer communication, eliminating the need to install plugins or download native apps. So, the vulnerability is in the Chromium Open Source Software (OSS) which is consumed by Microsoft Edge. Google is aware that an exploit for this vulnerability exists in the wild. If you’re using Microsoft Edge (Chromium-based), make sure it gets updated as soon as possible.

**Azure Site Recovery RCEs and EOPs**

There are also a lot of vulnerabilities in Azure Site Recovery in July Patch Tuesday. Both EoPs and RCEs, and quite a few with non-public exploits of the POC maturity level. According to the description “Site Recovery is a native disaster recovery as a service (DRaaS)”, it would seem that this should be patched by Microsoft themselves. But in fact, there is a Microsoft Azure Site Recovery suite installed on the hosts, and at least some of the vulnerabilities were found in it.

Let’s see, for example, **Elevation of Privilege** in Azure Site Recovery (CVE-2022-33675). The vulnerability was discovered and reported to Microsoft by Tenable researcher Jimi Sebree. The Microsoft Azure Site Recovery suite contains a DLL hijacking flaw that allows for privilege escalation from any low privileged user to SYSTEM. 

Incorrect permissions on the service’s executable directory (E:\\Program Files (x86)\\Microsoft Azure Site Recovery\\home\\svsystems\\transport\\) allow new files to be created by any user. The service launched from this directory runs automatically and with SYSTEM privileges and attempts to load several DLLs from this directory. This allows for a DLL hijacking/planting attack via several libraries that are attempted to be loaded from this location when the service is launched. Existing deployments should ensure that the Microsoft-supplied patches have been appropriately applied.

The full Vulristics report is available here: ms\_patch\_tuesday\_july2022\_report

Hi! My name is Alexander and I am an Information Security Automation specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.

Microsoft Patch Tuesday July 2022: propaganda report, CSRSS EoP, RPC RCE, Edge, Azure Site Recovery

Luna, Black Basta add to rapidly growing list of malware tools targeted at virtual machines deployed on VMware's bare-metal hypervisor technology.

The latest confirmations of the growing attacker interest in VMware ESXi environments are two ransomware variants that surfaced in recent weeks and have begun hitting targets worldwide.

One of the malware tools, dubbed Luna, is written in Rust and can encrypt data on ESXi virtual machines (VMs) in addition to data on Linux and Window systems. The other is Black Basta, a rapidly proliferating ransomware variant written in C++ that, like Luna, targets ESXi VMs and also works on Windows and Linux systems as well.

They add to a collection of ransomware variants aimed at ESXi, VMware's bare-metal hypervisor for running virtual machines. Numerous organizations use the technology to deploy multiple VMs on a single host system or across a cluster of host systems, making the environment an ideal target for attackers looking to cause widespread damage.

"Infrastructure services like networking equipment and hosting infrastructure like ESXi can't easily be patched on demand," says Tim McGuffin, director of adversarial engineering at Lares Consulting. "Attacking these services provides a one-stop shop for impact since a large number of servers can be encrypted or attacked at once."

Other recent examples of malware targeting ESXi environments include Cheerscrypt, LockBit, RansomEXX, and Hive.

**The Cross-Platform Ransomware Threat**

Researchers from Kaspersky first spotted Luna in the wild last month. Their analysis shows the malware to fall into the trend of several other recent variants that are written in platform-agnostic languages like Rust and Golang, so they can be easily ported across different operating systems. The researchers also found the malware to employ a somewhat rare combination of AES and x25519 cryptographic protocols to encrypt data on victim systems. The security vendor assessed the operator of the malware to be likely based in Russia.

Kaspersky's analysis of a recent version of Black Basta — a ransomware variant it has been tracking since February — shows the malware has been tweaked so it can now encrypt specific directories, or the entire “/vmfs/volumes” folder, on ESXi VMs. The malware uses the ChaCha20 256-bit cipher to encrypt files on victim systems. It also uses multithreading to speed up the encryption process by getting all processors on the infected systems to work at the same time on the task.

Since surfacing in February, the operators of Black Basta have managed to compromise at least 40 organizations worldwide. Victims include organizations in the manufacturing and electronics sectors in the US and multiple other countries. Available telemetry suggests the threat actor could soon chalk up other hits across Europe, United States, and Asia, according to Kaspersky.

**A Target for Inflicting Wide Damage**

The proliferation of ransomware targeting ESXi systems poses a major threat to organizations using the technology, security experts have noted. An attacker that gains access to an EXSi host system can infect all virtual machines running on it and the host itself. If the host is part of a larger cluster with shared storage volumes, an attacker can infect all VMs in the cluster as well, causing widespread damage.

"If a VMware guest server is encrypted at the operating system level, recovery from VMware backups or snapshots can be fairly easy," McGuffin says. '\[But\] if the VMware server itself is used to encrypt the guests, those backups and snapshots are likely encrypted as well." Recovering from such an attack would require first recovering the infrastructure and then the virtual machines. "Organizations should consider truly offline storage for backups where they will be unavailable for attackers to encrypt," McGuffin adds.

Vulnerabilities are another factor that is likely fueling attacker interest in ESXi. VMware has disclosed multiple vulnerabilities in recent months. In February, for instance, the company disclosed five flaws — including important and critical ones — that affected ESXi (CVE-2021-22040, CVE-2021-22041, CVE-2021-22042, CVE-2021-22043, and CVE-2021-22050). The same month, VMware announced a heap overflow vulnerability in the technology (CVE-2021-22045), and there have been multiple other moderate to low severity flaws the company has disclosed over the past year or so, including a critical remote code execution flaw.

"In recent months, VMware ESXi had several notable vulnerability disclosures and patches, which might be why attackers have an increased interest in targeting those environments," says Joseph Carson, chief security scientist and advisory CISO at Delinea. Most of these virtual environments tend to have a strong backup and snapshot strategy. However, attackers can cause a significant impact if they can also deploy ransomware on the backup systems as well, he says.

Carson advocates that organizations running VMware conduct risk assessments and consistently check for known vulnerabilities and misconfigurations to ensure they are patched and configured correctly. They also need to ensure that Internet-facing systems have strong access controls in place to ensure only authorized employees have access to those systems.

Matthew Warner, chief technology officer and co-founder at Blumira, points to the Log4j vulnerability as another likely reason for the mushrooming attacker interest in ESXi environments. "VMware has an incredibly wide range of solutions that utilized Log4i and were impacted by this vulnerability," he says. VMware itself acted quickly to provide mitigation guidance. But it's likely that many ignored the mitigation advice and are now targets of ransomware purveyors, he says.

"There is almost never a situation where VMware Horizon should be Internet-facing," Warner says. "It opens up untold amounts of risk to the infrastructure." Blumira has run into several instances where VMware Horizon servers were exposed due to access control issues on the firewalls, not to purposeful exposure. "This serves as a good reminder that your DMZ and Internet exposure must be monitored on an ongoing basis within your environment," he advocates.

Snowballing Ransomware Variants Highlight Growing Threat to VMware ESXi Environments

Open-Xchange App Suite versions 7.10.6 and below suffer from OS command injection and cross site scripting vulnerabilities. One particular cross site scripting issue only affects versions 7.10.5 and below.

Product: OX App Suite  
Vendor: OX Software GmbH

Internal reference: DOCS-4106  
Vulnerability type: OS Command Injection (CWE-78)  
Vulnerable version: 7.10.6 and earlier  
Vulnerable component: documentconverter  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 7.8.4-rev13, 7.10.3-rev6, 7.10.4-rev6, 7.10.5-rev5, 7.10.6-rev3  
Vendor notification: 2022-01-10  
Solution date: 2022-01-13  
Public disclosure: 2022-07-21  
CVE reference: CVE-2022-23100  
CVSS: 8.2 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L)

Vulnerability Details:  
OX Documentconverter has a Remote Code Execution flaw that allows authenticated OX App Suite users to run commands on the instance which runs OX Documentconverter if they have the ability to perform document conversions, for example of E-Mail attachments or OX Drive content.

Risk:  
Attackers can inject arbitrary operating-system level commands via OX App Suite API and/or OX Documentconverter API. Commands are executed on the instance running OX Documentconverter, based on "open-xchange" user privileges. This can be used to modify or exfiltrate configuration files as well as adversely affect the instances availability by excessive resource usage. By default the vulnerable Documentconverter API is not publicly accessible, however this might be worked around by abusing other weaknesses, configuration flaws or social engineering.

Steps to reproduce:  
1. Create a forged Documentconverter API call that embeds escape characters and a system command  
2. Inject the malicious API call via App Suite as a proxy or other means

Solution:  
We reduceed available API parameters to a limited set of enumerations, rather than accepting API input.

---

Internal reference: MWB-1350  
Vulnerability type: Cross-Site Scripting (CWE-80)  
Vulnerable version: 7.10.6 and earlier  
Vulnerable component: backend  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 7.8.4-rev78, 7.10.3-rev38, 7.10.4-rev31, 7.10.5-rev37, 7.10.6-rev9  
Vendor notification: 2021-11-30  
Solution date: 2022-02-15  
Public disclosure: 2022-07-21  
CVE reference: CVE-2022-23099  
CVSS: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Vulnerability Details:  
Existing sanitization and filtering mechanisms for HTML files can be bypassed by forcing block-wise read. Using this technique, the recognition procedure misses to detect tags and attributes that span multiple blocks.

Risk:  
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require the victim to follow a hyperlink.

Steps to reproduce:  
1. As attacker, create a HTML malicious code-snippet which masks tags (e.g. <script>) by block boundaries  
2. Upload the code snippet to drive and create a sharing link  
3. Sent that link to a victim and make it follow it

Solution:  
We now check for possible HTML content through overlapping reads from data streams.

---

Internal reference: MWB-1366  
Vulnerability type: n/a  
Vulnerable version: 7.10.6 and earlier  
Vulnerable component: middleware  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 7.8.4-rev78, 7.10.3-rev38, 7.10.4-rev31, 7.10.5-rev38, 7.10.6-rev9  
Vendor notification: 2021-12-10  
Solution date: 2022-02-15  
Public disclosure: 2022-07-21  
CVE reference: CVE-2021-42550  
CVSS: n/a

Vulnerability Details:  
In the wake of the CVE-2021-44228 (Log4Shell) issue, a similar potential vulnerability at the Logback library has been identified (LOGBACK-1591, CVE-2021-42550). At its default configuration, OX App Suite is not susceptible to this vulnerability and there are no scenarios that require to deploy a vulnerable configuration.

Risk:  
We provide this update strictly as a precaution to mitigate the possibility of a vulnerability. Exploiting CVE-2021-42550 at this point would require privileged access to alter system configuration.

Steps to reproduce:  
1. n/a

Solution:  
We provided a component update to Logback 1.2.8 and slf4j 1.7.32.

---

Internal reference: OXUIB-1172  
Vulnerability type: Cross-Site Scripting (CWE-80)  
Vulnerable version: 7.10.5 and earlier  
Vulnerable component: frontend  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 7.8.4-rev69, 7.10.3-rev31, 7.10.4-rev28, 7.10.5-rev30  
Vendor notification: 2021-11-30  
Solution date: 2022-02-15  
Public disclosure: 2022-07-21  
CVE reference: CVE-2022-23101  
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Vulnerability Details:  
Deep-links within E-Mail (e.g. links to Drive files) are not checked for malicious use of the appHandler function (see CVE-2021-38374) and may therefore be used to inject references to malicious code.

Risk:  
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (e.g. redirecting to a third-party site). To exploit this an attacker would require to forge App Suite specific mails and force the victim to follow a hyperlink.

Steps to reproduce:  
1. As an attacker, create a malicious E-Mail that uses App Suite "Deep-links" as mail header and embed a call to the AppLoader component  
2. Deliver the mail and make the victim open the link

Proof of concept:  
X-Open-Xchange-Share-URL: https://example.com/#!!&app=%2e./%2e./%2e./%2e./%2e./%2e./appsuite/drive/script.js?cut=&id=123

Solution:  
We now check for a enumeration of valid applications for deep-links as well.

---

Internal reference: DOCS-4161  
Vulnerability type: OS Command Injection (CWE-78)  
Vulnerable version: 7.10.6 and earlier  
Vulnerable component: documentconverter  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 7.8.4-rev14, 7.10.3-rev7, 7.10.4-rev7, 7.10.5-rev6, 7.10.6-rev3  
Vendor notification: 2022-01-24  
Solution date: 2022-02-15  
Public disclosure: 2022-07-21  
CVE reference: CVE-2022-24405  
CVSS: 7.3 (CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N)

Vulnerability Details:  
The compatibility layer of documentconverter API processes serialized Java classes when using remote cache calls. This can be exploited to inject malicious code that is being executed in the context of the documentconverter component.

Risk:  
Attackers can inject arbitrary operating-system level commands via the OX Documentconverter API. Commands are executed on the instance running OX Documentconverter, based on "open-xchange" user privileges. This can be used to modify or exfiltrate configuration files as well as adversely affect the instances availability by excessive resource usage. By default the vulnerable OX Documentconverter API is not publicly accessible and we are not aware that this could have been exploited without privileged network or system access.

Steps to reproduce:  
1. Create a malicious Java class and serialize it  
2. Use the OX Documentconverter API to inject this class as a reference/hash to remote caches

Solution:  
We now apply input sanitization to this API call and retrict it to strings. We also implemented a set of additional hardening procedures for other API calls which work in a similar way.

---

Internal reference: DOCS-4120  
Vulnerability type: Server-Side Request Forgery (CWE-918)  
Vulnerable version: 7.10.6 and earlier  
Vulnerable component: documentconverter-api  
Report confidence: Confirmed  
Solution status: Fixed by Vendor  
Fixed version: 7.8.4-rev10, 7.10.3-rev5, 7.10.4-rev6, 7.10.5-rev6, 7.10.6-rev3  
Vendor notification: 2022-01-10  
Solution date: 2022-02-15  
Public disclosure: 2022-07-21  
CVE reference: CVE-2022-24406  
CVSS: 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

Vulnerability Details:  
By creating colissions of HTTP multipart-formdata boundaries it is possible to alter the API request parameters between OX App Suite and OX Documentconverter. Legitimate multipart-formdata boundaries are created based on a timestamp with millisecond resolution. This allows attackers to predict the next boundary and attempt to overwrite its content. The most practical way to exploit this is sending a large number of formdata parts, each with a unique boundary based on a future point in time.

Risk:  
Attackers can modify parameters of internal API calls to OX Documentconverter and by that circumvent network trust boundaries. In effect, a server-side request forgery attack is possible, for example to exploit DOCS-4106 (CVE-2022-23100) with limited privileges using OX App Suite API as a "proxy".

Steps to reproduce:  
1. Create a HTTP request with multipart-formdata boundaries representing timestamps in the near future  
2. Add internal API parameters to those multipart-formdata sections and use them as requests to OX App Suite API

Solution:  
We modified the algorithm to create multipart-formdata boundaries in a way that they are no longer predictable. We also restricted the number of multipart-formdata parts to a sensible amount and issue an Exception if a client exceeds it.

Tag

#rce