Drupal RCE Flaw Exploited in Attacks Days After Patch

A vulnerability patched recently in the Drupal content management system (CMS) has been exploited in the wild to deliver cryptocurrency miners and other payloads. The attacks started just three days after a fix was released.

The flaw, tracked as CVE-2019-6340, is caused by the lack of proper data sanitization in some field types and it can allow an attacker to execute arbitrary PHP code. Exploitation is possible if the core RESTful Web Services module is enabled and it allows PATCH or POST requests. Attacks are also possible if another web services module is enabled, such as JSON:API in Drupal 8 or RESTful Web Services or Services in Drupal 7.

Drupal has released updates to address the vulnerability and told customers that they can mitigate it by disabling all web services modules, or configuring the server to not allow GET/PUT/PATCH/POST requests to web services resources.

The patches released on February 20 were quickly analyzed and technical details and proof-of-concept (PoC) code were released roughly two days later. Security firm Imperva revealed on Monday that it had started seeing attacks exploiting CVE-2019-6340 on February 23.

According to the company, it has observed hundreds of attack attempts aimed at dozens of its customers, including organizations in the government and financial services sectors. The malicious requests came from several threat groups and several countries.

Imperva says one of the most interesting payloads delivered in these attacks was a JavaScript-based cryptocurrency miner named CoinIMP. The tool is injected into the targeted website’s index.php file and it abuses the devices of the site’s visitors to mine Monero and other cryptocurrencies.

Attackers have also attempted to use the exploit to deliver a shell that allows them to upload arbitrary files to vulnerable Drupal sites.

Imperva also pointed out that attacks can be launched against websites whose administrators implemented the initial mitigations proposed by Drupal developers.

“[The exploit] continues to work even after following the Drupal team’s proposed remediation of disabling all web services modules and banning PUT/PATCH/POST requests to web services resources,” Imperva’s Edi Kogan explained. “Despite the fix, it is still possible to issue a GET request and therefore perform remote code execution as was the case with the other HTTP methods.”

Drupal developers have confirmed that the flaw has been exploited in the wild and made some clarifications regarding vulnerable components and mitigations.

Cybercriminals hacked many Drupal websites last year by exploiting two flaws dubbed Drupalgeddon2 and Drupalgeddon3. The attackers leveraged the vulnerabilities to deliver RATs, cryptocurrency miners and tech support scams.

Recent attacks also involved exploits that chained Drupalgeddon 2 with the DirtyCOW Linux kernel bug.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/gZs_oytaJBw/drupal-rce-flaw-exploited-attacks-days-after-patch

Hackers Can Plant Backdoors on Bare Metal Cloud Servers: Researchers

Malicious actors could plant firmware backdoors on bare metal cloud servers and use them to disrupt applications, steal data, and launch ransomware attacks, firmware security company Eclypsium warned on Tuesday.

Bare metal cloud services provide organizations the hardware needed to run their applications, without providing a hypervisor. Unlike in the case of other types of cloud services, where a server can have multiple tenants, bare metal services provide exclusive access to the entire physical server. Once a customer no longer needs the server, the hardware is reassigned to another customer.

Researchers at Eclypsium discovered that hackers could plant firmware backdoors on these servers that can later be leveraged against the device’s next customer. The attack method has been dubbed “Cloudborne.”

Eclypsium believes this problem affects many bare metal services providers, but it has conducted tests on IBM’s SoftLayer cloud services “because of its simplified logistics and access to hardware.”

Cloudborne attack targets bare metal cloud servers An analysis of these servers revealed that some of them use hardware provided by SuperMicro. Eclypsium had previously identified vulnerabilities in SuperMicro products, specifically ones related to the Baseboard Management Controller (BMC).

The BMC is a small computer present on a majority of server motherboards. Its Intelligent Platform Management Interface (IPMI) component allows administrators to remotely control and monitor a server without having to access the operating system or applications running on it. The BMC can be used to reboot a device, install an operating system, update the firmware, monitor system parameters, and analyze logs.

Eclypsium has demonstrated that attackers can load malicious code onto the BMC in an effort to gain persistent access and control over the system, and even to remotely brick a server.

The researchers started their analysis of IBM SoftLayer services by acquiring a server and making small and benign changes to its BMC firmware. Eclypsium noted that the modifications it had made – one character was changed in a configuration file (bitflip) and a new IPMI user with admin privileges was added – did not involve the exploitation of any vulnerabilities and instead were changes that any customer could make.

The experts then released the server back to IBM and used a different account to acquire the same device. They noticed that while the IPMI user had been removed as part of the vendor’s reclamation process, the firmware containing the flipped bit was unchanged. They also noticed that BMC logs were still there and the BMC root password was the same.

“The combination of using vulnerable hardware and not reflashing the firmware makes it possible for a malicious party to implant the server’s BMC code and inflict damage or steal data from IBM clients that use that server in the future,” Eclypsium researchers said.

“By not deleting the logs, a new customer could gain insight into the actions and behaviors of the previous owner of the device, while knowing the BMC root password could enable an attacker to more easily gain control over the machine in the future,” they added.

According to the security firm, an attacker could make BMC firmware changes that would cause a permanent denial-of-service (DoS) attack and brick the server. They could also plant a backdoor that would give them access to the data stored on the device by the next customer.

“Additionally attacks against the firmware on drives and network adapters themselves can provide attackers with another very low-level way of stealing or intercepting data. Likewise with low-level control over the server and network adapters, the attacker would have a variety of options for exfiltrating data out of the cloud environment,” Eclypsium explained.

The attack method can also be used to launch ransomware attacks, where the attacker threatens to disrupt applications and damage data.

Eclypsium notified IBM of its findings, but it initially appeared that the tech giant had ignored its messages. However, IBM has been working on addressing the issue in response to Eclypsium’s research, even if it has not provided any feedback to the security firm.

“We are not aware of any client or IBM data being put at risk because of this reported potential vulnerability and we have taken actions to eliminate the vulnerability. Given the remediation steps we have taken and the level of difficulty required to exploit this vulnerability, we believe the potential impact to clients is low,” an IBM spokesperson told SecurityWeek. “While the report focuses on IBM, this was actually a potential industry-wide vulnerability for all cloud service providers and we thank Eclypsium for bringing it to the attention of the industry.”

In an advisory published on Monday, IBM says it’s now forcing all BMCs to be reflashed with factory firmware before being passed on to other customers. The company says it will also delete all logs and regenerate all passwords for the BMC firmware.

However, Eclypsium claimed that the server targeted in their tests still contained the firmware modifications when checked on Monday. Moreover, the company does not agree with IBM’s assessment that this is a “low severity” issue, noting that its CVSS score is 9.3, which puts it in the “critical severity” category.

“While the hardware specifications of BMC hardware are low as compared with the host server, the capability for security-critical impact is high,” Eclypsium argued. “By design, the BMC is intended for managing the host system, and as such, it is more privileged than the host. The BMC has continual access to files, memory (using DMA), keyboard/video, and firmware of the host (which is required because it needs the ability to reinstall/reconfigure it). Furthermore, the BMC is able to send data to an external network, even potentially reconfiguring the host network interface. This provides an attacker with all the tools necessary for complete and stealthy control of a victim system.”

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/HrVViC8Uf70/hackers-can-plant-backdoors-bare-metal-cloud-servers-researchers

Bug Allows Bypass of WhatsApp Face ID, Touch ID Protection

The Face ID and Touch ID authentication feature introduced recently to WhatsApp for iOS can be easily bypassed, but a patch has been released.

An update rolled out in early February for the iOS version of WhatsApp introduced a new feature that allows users to lock the application on their iPhone using the smartphone’s Face ID and Touch ID facial recognition and fingerprint systems.

This additional level of security ensures that access to WhatsApp is protected if an unauthorized individual gains physical access to an unlocked device. The protection can be activated by going to Settings -> Account -> Privacy -> Screen Lock in WhatsApp. Users can select if they want to use Face ID or Touch ID and they can set how quickly they want the application to lock itself – immediately, after 1 minute, after 15 minutes, or after 1 hour.

A Reddit user noticed that unless this duration is set to “immediately,” the Face ID/Touch ID protection can be easily bypassed by using the Share Sheet in iOS, the system that allows users to share content with others via one of the applications installed on their device.

From the Share Sheet, users need to select WhatsApp and the application will become accessible without any Face ID or Touch ID prompt the next time it’s opened from the home screen.

The bypass method does not work if the duration is set to anything other than “immediately.”

WhatsApp, which is owned by Facebook, told SecurityWeek that “a fix has been rolled out to all users on the latest version of WhatsApp.”

Researchers from Israeli cybersecurity firm Check Point discovered recently that hackers could modify and send fake messages via WhatsApp, but the vendor has downplayed the impact.

WhatsApp announced last month that it only allows messages to be forwarded to a maximum of 5 people in an effort to block attempts to abuse the platform for spreading false information.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/vswRH1gfT-U/bug-allows-bypass-whatsapp-face-id-touch-id-protection

Researcher Earns $10,000 for Another XSS Flaw in Yahoo Mail

A researcher says he has discovered yet another critical cross-site scripting (XSS) vulnerability in Yahoo Mail. The recently patched flaw could have been exploited to steal the targeted user’s emails and attach malicious code to their outgoing messages.

Jouko Pynnönen of Finland-based software company Klikki Oy discovered the first stored XSS vulnerability in Yahoo Mail in December 2015. That flaw, which earned him $10,000, allowed an attacker to send out emails containing hidden JavaScript code that would get executed as soon as the message was read by the victim.

A malicious actor could have exploited the security hole to silently forward the victim’s emails to an external website, change the compromised Yahoo account’s settings, and create an email virus that would attach itself to the signature of all outgoing emails. The bug existed due to failure to properly filter potentially malicious code in HTML emails.

Roughly one year later, Pynnönen discovered a second stored XSS vulnerability in Yahoo Mail. This flaw had the same impact and it also earned him $10,000, but it involved code inserted into emails when certain type of content was attached.

Pynnönen told SecurityWeek on Thursday that he discovered yet another stored XSS flaw in Yahoo Mail in early December 2018. Oath, which owns Yahoo and other major media brands, addressed the issue in January and awarded the expert another $10,000 for his findings.

The researcher says the latest security hole, similar to the ones he previously reported, could have allowed an attacker to steal a user’s inbox or perform other actions in their email account simply by getting the target to open a specially crafted email.

Technical details of the vulnerability have not been disclosed as Oath has not allowed Pynnönen to make his findings public. However, he told SecurityWeek that the exploit involves basic HTML filtering – just like in the case of the first weakness he discovered – rather than attachments.

Oath reported in December that it had paid out $5 million through its HackerOne-powered bug bounty program in 2018. White hat hackers submitted 1,900 valid vulnerability reports, including for 300 flaws that had been classified as critical or high severity. The company awarded $400,000 during a one-day event in San Francisco, where 41 hackers from 11 countries disclosed their findings.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/vQjemfB-RTg/researcher-earns-10000-another-xss-flaw-yahoo-mail

Millions of websites threatened by highly critical code-execution bug in Drupal

Millions of sites that run the Drupal content management system run the risk of being hijacked until they’re patched against a vulnerability that allows hackers to remotely execute malicious code, managers of the open source project warned Wednesday.

CVE-2019-6340, as the flaw is tracked, stems from a failure to sufficiently validate user input, managers said in an advisory. Hackers who exploited the vulnerability could, in some cases, run code of their choice on vulnerable websites. The flaw is rated highly critical.

“Some field types do not properly sanitize data from non-form sources,” the advisory stated. “This can lead to arbitrary PHP code execution in some cases.”

For a site to be vulnerable, one of the following conditions must be met:

It has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests or
It has another Web-services module enabled, such as JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7

Project managers are urging administrators of vulnerable websites to update at once. For sites running version 8.6.x, this involves upgrading to 8.6.10 and sites running 8.5.x or earlier upgrading to 8.5.11. Sites must also install any available security updates for contributed projects after updating the Drupal core. No core update is required for Drupal 7, but several Drupal 7 contributed modules do require updates.

Popular hacking target

Drupal is the third most-widely used CMS behind WordPress and Joomla. With an estimated 3 percent to 4 percent of the world’s billion-plus websites, that means Drupal runs tens of millions of sites. Critical flaws in any CMS are popular with hackers, because the vulnerabilities can be unleashed against large numbers of sites with a single, often-easy-to-write script.

In 2014 and again last year, hackers wasted no time exploiting extremely critical code-execution vulnerabilities shortly after they were fixed by Drupal project leaders. Last year’s “Drupalgeddon2” vulnerability was still being exploited six weeks after it was patched, an indication that many sites that run on Drupal failed to heed the urgent advice to patch.

At the time this post was going live, there were no reports of the latest Drupal vulnerability being actively exploited in the wild. This is obviously subject to change. This post will be updated if new information becomes available.

https://arstechnica.com/?p=1462289

Cisco Patches High Severity Flaws in HyperFlex, Prime Infrastructure

Cisco this week released patches for more than a dozen vulnerabilities across its product portfolio, including high severity flaws in HyperFlex, Prime Infrastructure, and Prime Collaboration Assurance.

Two High risk security bugs were addressed in HyperFlex software, namely a command injection issue in the cluster service manager of the application, and an unauthenticated root access flaw in the hxterm service of the software.

Created by insufficient input validation and insufficient authentication controls, respectively, the vulnerabilities could allow an attacker to run commands as the root user or gain root access to all member nodes of the HyperFlex cluster.

Tracked as CVE-2018-15380 and CVE-2019-1664, both vulnerabilities were found to impact HyperFlex software releases prior to 3.5(2a).

Another High severity bug that Cisco addressed this week is a certificate validation bug in the Identity Services Engine (ISE) integration feature of Prime Infrastructure (PI). An unauthenticated, remote attacker could exploit the flaw to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI.

Tracked as CVE-2019-1659, the issue is created by improper validation of the server SSL certificate when establishing the SSL tunnel with ISE. The flaw impacts Prime Infrastructure Software releases 2.2 through 3.4.0 when the PI server is integrated with ISE, which is disabled by default.

Another High risk bug was found in the Quality of Voice Reporting (QOVR) service of Prime Collaboration Assurance (PCA) Software releases prior to 12.1 SP2. Tracked as CVE-2019-1662 and created due to insufficient authentication controls, the issue could allow an unauthenticated, remote attacker to access the system as a valid user.

The TFTP service of Cisco Network Convergence System 1000 Series software was found vulnerable to a High severity directory traversal vulnerability (CVE-2019-1681) that could allow an unauthenticated, remote attacker to retrieve arbitrary files from the targeted device. The bug impacts IOS XR Software releases prior to 6.5.2 for Network Convergence System 1000 Series when the TFTP service is enabled.

Cisco also released patches for 11 Medium severity vulnerabilities impacting Webex Meetings Online, Webex Teams, Internet of Things Field Network Director (IoT-FND) Software, HyperFlex, Firepower Threat Defense, Firepower 9000 Series Firepower 2-Port 100G Double-Width Network Module Queue Wedge, Unity Connection, IP Phone 7800 and 8800 Series, and SPA112, SPA525, and SPA5X5 Series IP Phones.

Additionally, Cisco revealed that, while investigation to determine which products are affected continues, the recently discovered container escape vulnerability (CVE-2019-5736) does impact Cisco Container Platform and Cisco Defense Orchestrator. Exploit code for the flaw was made public as well.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/-qYUWfIf3Ac/cisco-patches-high-severity-flaws-hyperflex-prime-infrastructure

Adobe Releases Second Patch for Data Leakage Flaw in Reader

Adobe on Thursday released a second fix for the Reader vulnerability tracked as CVE 2019-7089 after the researcher who discovered the flaw managed to bypass the first patch.

The security hole, identified by Alex Inführ from Cure53, allows a specially crafted PDF document to send SMB requests to the attacker’s server when the file is opened.

The vulnerability, similar to CVE-2018-4993, allows a remote attacker to steal a user’s NTLM hash included in an SMB request, and it can be leveraged to alert an attacker when their malicious PDF document has been opened by the targeted user.

Adobe released a fix for CVE 2019-7089 with its February 2019 Patch Tuesday updates, but Infuhr quickly discovered that it could be bypassed.

Adobe releases second patch for CVE 2019-7089

Adobe has now released another update for Reader in an effort to address the flaw, which it has described as a critical information disclosure issue. The company has assigned a new CVE identifier, CVE-2019-7815, to the vulnerability.

It’s worth noting that Infuhr had made his findings public more than two weeks before Adobe released the first patch. An unofficial fix was released by 0patch one day before Adobe’s official patch came out.

It’s also worth mentioning that CVE 2019-7089 was the second flaw patched by Adobe that was similar to CVE-2018-4993.

Despite details of the security hole being public for several weeks, Adobe says it’s not aware of any in-the-wild exploits. The company has assigned it a priority rating of 2, which indicates that exploitation should not be imminent.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/f-zy-T-lbNI/adobe-releases-second-patch-data-leakage-flaw-reader

Windows Servers Vulnerable to DoS Attacks, Microsoft Warns

Microsoft informed users on Wednesday that Windows servers running Internet Information Services (IIS) are vulnerable to denial-of-service (DoS) attacks that rely on malicious HTTP/2 requests.

According to the tech giant, sending specially crafted HTTP/2 requests can cause the machine’s CPU to temporarily spike to 100% until IIS kills the malicious connections.

“The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters. In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed,” Microsoft said in its advisory.

The vulnerability impacts Windows 10, Windows Server and Windows Server 2016. The February non-security updates released by Microsoft this week should address the issue by allowing IIS administrators to define thresholds on the number of HTTP/2 SETTINGS included in a request.

However, Microsoft noted that the updates it has released do not define any values by default and IIS administrators must do it themselves. The knowledge base article that should provide information on how to do this could not be accessed at the time of writing.

Microsoft has credited Gal Goldshtein of F5 Networks for reporting the vulnerability. It’s worth noting that a similar flaw, tracked as CVE-2018-16844, was discovered recently by Goldshtein in the nginx open source web server software.

“The flaw in Microsoft IIS could cause serious problems for organizations using IIS for their corporate website or applications. While Microsoft has developed a patch to fix this issue, it is still up to the IT team to properly configure IIS so the problem can’t be created. Microsoft specifically stated that they do not provide presets and as such fixing the problem is more than just applying the patch,” said Justin Jett, Director of Audit and Compliance at Plixer.

“IT teams should use network traffic analytics to look at connections going to their IIS servers to determine if they have connections going to their web servers that could be creating these problems. Often these connections are long-lived or the source connection continuously repeats to trigger a problem on the server. By looking at these metrics, IT teams can identify the source of the DDoS. These types of problems can be resolved with proper configuration. Network traffic analytics can help you understand where there may be configuration issues so the system can be updated before there are major problems like DDoS attacks,” Jett added.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/4vmwxbcsoqk/windows-servers-vulnerable-dos-attacks-microsoft-warns

WinRAR Vulnerability Exposes Millions of Users to Attacks

WinRAR, the popular data compression tool utilized by over 500 million users worldwide, is affected by a serious vulnerability that can allow arbitrary code execution through specially crafted ACE archives.

Tests conducted by researchers at Check Point Software Technologies using the WinAFL fuzzer led to the discovery of a security bug in the unacev2.dll library used by WinRAR for unpacking ACE archives.

The library is affected by a flaw (CVE-2018-20250) that can allow malicious actors to create an ACE archive that extracts files to an arbitrary folder on the system.

Check Point researchers have demonstrated that the security hole can be exploited to extract a harmless file to the destination folder selected by the user, while also extracting a malicious file to a location specified by the attacker. The attacker could, for example, extract a piece of malware to the Windows Startup folder and it would get executed the next time the operating system boots.

The cybersecurity firm reported its findings to WinRAR developer RARLab, which decided that the best way to protect users against potential attacks is to remove support for ACE archives. This decision has been implemented starting with the release of WinRAR 5.70 beta 1.

RARLab says unacev2.dll has not been updated since 2005 and the company no longer has access to its source code.

The following CVE identifiers have been assigned to other WinRAR vulnerabilities found by Check Point during its fuzzing project: CVE-2018-20251, CVE-2018-20252 and CVE-2018-20253. The company has published technical details and a video showing an exploit in action.

[embedded content]

The popularity of WinRAR can make it a tempting target for attackers. While no WinRAR vulnerabilities have been disclosed in the past three years, a flaw in the archiving tool was exploited in cyber espionage campaigns back in 2014.

WinRAR vulnerabilities are still valuable. Exploit acquisition firm Zerodium offers up to $80,000 for remote code execution flaws and at one point last year it offered as much as $100,000.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/rMaYhGg-DeA/winrar-vulnerability-exposes-millions-users-attacks

Critical Drupal Vulnerability Allows Remote Code Execution

Security updates released on Wednesday for the Drupal content management system (CMS) patch a “highly critical” vulnerability that can be exploited for remote code execution.

The security hole, tracked as CVE-2019-6340, is caused by the lack of proper data sanitization in some field types, which, in some cases, can allow an attacker to execute arbitrary PHP code, Drupal developers said. The issue was discovered by Samuel Mortenson of the Drupal Security Team.

Exploitation of CVE-2019-6340 is possible if the core RESTful Web Services module is enabled and it allows PATCH or POST requests. Exploitation is also possible if another web services module is enabled, such as JSON:API in Drupal 8 or RESTful Web Services or Services in Drupal 7.

Drupal 8.6.10 and 8.5.11 should address the vulnerability. Drupal 7 does not need to be updated, but there are some updates for Drupal 7 contributed modules that users have been advised to install.

“To immediately mitigate the vulnerability, you can disable all web services modules, or configure your web server(s) to not allow PUT/PATCH/POST requests to web services resources,” Drupal said in its advisory. “Note that web services resources may be available on multiple paths depending on the configuration of your server(s). For Drupal 7, resources are for example typically available via paths (clean URLs) and via arguments to the ‘q’ query argument. For Drupal 8, paths may still function when prefixed with index.php/.”

It’s important that users install the updates as soon as possible considering that it’s not uncommon for highly critical Drupal vulnerabilities to be exploited in the wild shortly after patches are released.

Last year, cybercriminals hacked a significant number of Drupal websites by exploiting two vulnerabilities dubbed Drupalgeddon2 and Drupalgeddon3. The attackers leveraged the flaws to deliver RATs, cryptocurrency miners and tech support scams.

Other recent attacks involved exploits that chained Drupalgeddon 2 with a Linux kernel vulnerability known as DirtyCOW.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/DF6HsLR5_cY/critical-drupal-vulnerability-allows-remote-code-execution