Over a Dozen Exploitable Vulnerabilities Found in AI/ML Tools

Since August 2023, members of the Huntr bug bounty platform for artificial intelligence (AI) and machine learning (ML) have uncovered over a dozen vulnerabilities exposing AI/ML models to system takeover and sensitive information theft.

Identified in tools with hundreds of thousands or millions of downloads per month, such as H2O-3, MLflow, and Ray, these issues potentially impact the entire AI/ML supply chain, says Protect AI, which manages Huntr.

A low-code machine learning platform, H2O-3 supports the creation and deployment of ML models via a web interface, by just importing data. It allows users to upload Java objects remotely via API calls.

By default, the installation is exposed to the network and does not require authentication, thus allowing attackers to supply malicious Java objects that H2O-3 would execute, allowing them to access the operating system.

Tracked as CVE-2023-6016 (CVSS score of 10), the remote code execution (RCE) vulnerability could allow attackers to completely take over the server and steal models, credentials, and other data.

The bug hunters uncovered two other critical issues in the low-code service, namely a local file include flaw (CVE-2023-6038) and a cross-site scripting (XSS) bug (CVE-2023-6013), along with a high-severity S3 bucket takeover vulnerability (CVE-2023-6017).

MLflow, an open-source platform for the management of the end-to-end ML lifecycle, also lacks authentication by default, and the researchers identified four critical vulnerabilities in it.

The most severe of these are arbitrary file write and patch traversal bugs (CVE-2023-6018 and CVE-2023-6015, CVSS score of 10) that can allow an unauthenticated attacker to overwrite arbitrary files on the operating system and achieve RCE.

Advertisement. Scroll to continue reading.

The tool was also found vulnerable to critical-severity arbitrary file inclusion (CVE-2023-1177) and authentication bypass (CVE-2023-6014) vulnerabilities.

The Ray project, an open-source framework for the distributed training of ML models, also lacks default authentication.

A critical code injection flaw in Ray’s cpu_profile format parameter (CVE-2023-6019, CVSS score of 10) could lead to full system compromise. The parameter was not validated before being inserted in a system command that was executed in a shell.

The bug hunters also identified two critical local file include issues that could allow remote attackers to read any files on the Ray system. The security defects are tracked as CVE-2023-6020 and CVE-2023-6021.

All vulnerabilities were reported to vendors at least 45 days prior to public disclosure. Users are advised to update their installations to the latest non-vulnerable versions and restrict access to the applications where patches are not available.

https://www.securityweek.com/over-a-dozen-exploitable-vulnerabilities-found-in-ai-ml-tools/

Microsoft Patches Sensitive Information Disclosure Vulnerability in Azure CLI

Microsoft on Tuesday released patches and guidance for addressing a high-severity vulnerability in Azure Command-Line Interface (CLI) that could result in the exposure of sensitive information, such as credentials, through GitHub Actions logs.

Tracked as CVE-2023-36052 (CVSS score of 8.6) and addressed with the release of Azure CLI 2.54 as part of the November 2023 Patch Tuesday, the bug existed because certain Azure CLI functions would inadvertently expose secrets through CI/CD logs.

While there are many functions that echo environment variables to the log, including credentials, and the action is performed as intended, this led to the sensitive information being exposed to everyone, for public repositories, and allowed attackers with ‘Read’ permissions on private repositories to retrieve it.

“An attacker that successfully exploited this vulnerability could recover plaintext passwords and usernames from log files created by the affected CLI commands and published by Azure DevOps and/or GitHub Actions,” Microsoft notes in its advisory.

Palo Alto Networks security researcher Aviad Hahami, who reported the bug to Microsoft, analyzed various usage patterns related to Azure CLI in GitHub Actions and identified three main variations in the wild.

Some developers, Hahami notes, did not know about the issue and put no mitigation in place, exposing themselves to attackers, others assumed Azure CLI would leak sensitive information and masked it themselves, while others attempted to mask the secrets but ended up leaking them by setting up separate pipelines for ‘create’ and ‘delete’ (or equivalent) actions.

In guidance on addressing CVE-2023-36052, Microsoft explains that changes were made to several Azure CLI commands and that additional changes will be made to harden Azure CLI against secrets exposure.

The tech giant changed multiple products, including Azure Pipelines, GitHub Actions, and Azure CLI, to improve secret redaction, including by adding a new default setting that prevents secrets leaking in the output of update commands for services in the App Service family.

Advertisement. Scroll to continue reading.

“Note that this change might adversely impact some automation workflows since certain users might expect secret values in the Azure CLI response to then be used in subsequent parts of the workflow. However, there are safer authoring patterns for automation that we encourage customers to consider,” Microsoft notes.

The company also expanded credential redaction capabilities in GitHub Actions and Azure Pipelines to identify more key patterns in logs and mask them.

“This redaction is designed to target a specific set of keys for accuracy and performance reasons and is intended to catch any Microsoft-issued keys that may have inadvertently found their way into public-facing logs,” the tech giant says.

Microsoft recommends that all customers follow security best practices for cloud workload development and protection, including by keeping Azure CLI updated, not exposing Azure CLI output in logs and publicly accessible locations, rotating keys and secrets regularly, keeping repositories private, and reviewing available guidance on secrets management and the security of GitHub Actions and Azure Pipelines.

https://www.securityweek.com/microsoft-patches-sensitive-information-disclosure-vulnerability-in-azure-cli/

Microsoft Warns of Critical Bugs Being Exploited in the Wild

The world’s largest software maker Microsoft on Tuesday released patches with cover for at least 59 documented security vulnerabilities, including a pair of critical-severity zero-days already being exploited in the wild.

Redmond’s security response team documented a wide range of security defects in a range of Windows OS and components and called special attention to two vulnerabilities — CVE-2023-36033 and CVE-2023-36036 being exploited in active attacks.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft said two separate advisories that credit security researcher Quan Jin, DBAPPSecurity WeBin Lab and its own threat-intel teams for discovering the two zero-days.

As is customary, Microsoft’s barebones bulletins did not contain any details on the live attacks or indicators of compromise to help defenders hunt for signs of infections.

The Patch Tuesday rollout also fixes the known — and already exploited — WepP flaw affecting its Microsoft Edge (Chromium-based browser) and remote code execution issues in the Windows cURL Implementation.

Microsoft also pushed out another patch to address feature bypass issues that continue to haunt its Windows SmartScreen tool and major updates to fix remote code execution and privilege escalation issues in Windows Pragmatic General Multicast (PGM) and Windows HMAC Key Derivation components.

The PGM flaw (CVE-2023-36397) carries a CVSS severity score of 9.8 out of 10 and should be considered a patch for high-priority deployment.

Microsoft’s patches follow Adobe’s rollout of a massive batch of security fixes to cover critical-severity flaws in its Acrobat and Reader, ColdFusion, inDesign, inCopy and Audition products.

Advertisement. Scroll to continue reading.

Adobe documented 72 distinct security bugs and called special attention to code-execution defects in the widely deployed Adobe Acrobat and Reader software.

In a critical-severity bulletin, Adobe documented at least 17 Acrobat and Reader bugs that expose unpatched Windows and macOS systems to arbitrary code execution and memory leak issues.

Adobe also issued patches for at least six distinct ColdFusion flaws that could lead to arbitrary code execution and security feature bypass. The ColdFusion issues are flagged as critical and affects versions 2023 and 2021. 

https://www.securityweek.com/microsoft-warns-of-critical-bugs-being-exploited-in-the-wild/

Adobe Patch Tuesday: Critical Bugs in Acrobat, Reader, ColdFusion

Software maker Adobe on Tuesday rolled out a massive batch of security fixes to cover critical-severity flaws in its Acrobat and Reader, ColdFusion, inDesign, inCopy and Audition products.

As part of its scheduled Patch Tuesday updates, Adobe documented 72 distinct security bugs and called special attention to code-execution defects in the widely deployed Adobe Acrobat and Reader software.

In a critical-severity bulletin, Adobe documented at least 17 Acrobat and Reader bugs that expose unpatched Windows and macOS systems to arbitrary code execution and memory leak issues.

The mega-patch bundle also includes cover for five vulnerabilities in RoboHelp Server (arbitrary code execution and memory leak in the context of the current user); six documented Photoshop bugs (arbitrary code execution and memory leak); seven denial-of-service and memory leak issues in InDesign; and three documented bugs exposing Adobe Bridge users to memory leakage.

The San Jose, Calif. vendor also covered code execution issues in the Adobe FrameMaker Publishing Server and the Adobe Media Encoder and Adobe Premiere Pro.

Adobe said it was not aware of in-the-wild exploits for any of the documented vulnerabilities.

Advertisement. Scroll to continue reading.

https://www.securityweek.com/adobe-patch-tuesday-critical-bugs-in-acrobat-reader-coldfusion/

Protected Virtual Machines Exposed to New ‘CacheWarp’ AMD CPU Attack

A team of researchers has disclosed the details of a new attack method affecting a security feature present in AMD processors, demonstrating the risk it can pose to protected virtual machines (VMs).

The attack method, named CacheWarp, was discovered by researchers from the CISPA Helmholtz Center for Information Security in Germany, the Graz University of Technology in Austria, and independent researcher Youheng Lu.

CacheWarp affects AMD Secure Encrypted Virtualization (SEV), a CPU extension designed for isolating VMs from the underlying hypervisor at the hardware level, enabling developers to securely deploy VMs even if the hypervisor is untrusted. AMD SEV provides protection by encrypting VM data, including memory and register state.

The feature, particularly the new SEV-SNP (Secure Nested Paging), is highly useful for protecting sensitive data in cloud environments, securing VMs even against compromised or untrusted cloud providers.

According to the researchers who discovered the attack method, CacheWarp can allow malicious hackers to hijack control flow, break into an encrypted VM, and escalate privileges.

“For a simple example,” the researchers explained, “assume you have a variable determining whether a user is successfully authenticated. By exploiting CacheWarp, an attacker can revert the variable to a previous state and thus take over an old (already authenticated) session. Furthermore, an attacker can manipulate the return address stored on the stack and, by that, change the control flow of a victim program.”

In a CacheWarp attack scenario, the attacker (a malicious hypervisor) has elevated privileges, but has no control over the data or code inside the targeted VM.

CacheWarp has been described as a software-based fault injection attack that is possible due to a hardware issue in AMD CPUs. The researchers pointed out that the root cause is an architectural bug, and CacheWarp is not a transient-execution or side-channel attack, like many other CPU attack methods disclosed in recent years.

CacheWarp can impact any system powered by an AMD CPU that supports SEV, but only users who deploy secure virtual machines using SEV are at risk of attacks.

Advertisement. Scroll to continue reading.

The underlying vulnerability is tracked as CVE-2023-20592. AMD, which learned about the issue in April 2023, has published its own security advisory, providing information on impacted products and patches.

The researchers have made available a paper detailing their findings and they have launched a dedicated website that provides a high-level summary of the CacheWarp attack.

They have also published a couple of videos showing how the vulnerability can be exploited to bypass OpenSSH authentication and escalate privileges to root via Sudo.

https://www.securityweek.com/protected-virtual-machines-exposed-to-new-cachewarp-amd-cpu-attack/

SysAid Zero-Day Vulnerability Exploited by Ransomware Group

Organizations using SysAid IT service management software have been warned about a zero-day vulnerability that has been exploited by affiliates of a notorious ransomware operation.

Exploitation of the zero-day, tracked as CVE-2023-47246, was apparently first observed by Microsoft’s threat intelligence team, which rushed to notify SysAid about the vulnerability and the attacks.

The vendor has determined that its SysAid on-premises software is impacted by the flaw, which has been described as a path traversal issue leading to arbitrary code execution.

SysAid learned about the zero-day on November 2, and it announced the release of version 23.3.36, which should patch the vulnerability, on November 8.

In addition to patches, the vendor has shared technical information on the observed attacks, including indicators of compromise (IoCs), as well as recommendations on the steps that potentially impacted customers should take.

According to Microsoft, CVE-2023-47246 has been exploited by a threat actor it tracks as Lace Tempest, which is also known as DEV-0950 and whose activities overlap with the groups named FIN11 and TA505. They are all known for deploying Cl0p ransomware.

Microsoft previously linked Lace Tempest to the massive MOVEit Transfer zero-day exploitation, which to date has impacted — both directly and indirectly — more than 2,500 organizations. In those attacks, the cybercriminals exploited a MOVEit managed file transfer software flaw to gain access to the information exchanged by organizations through the product. They then used the stolen files to extort money from victims.

In the SysAid zero-day attacks, the hackers leveraged the IT support software to deliver the MeshAgent remote administration tool and the GraceWire malware.

Advertisement. Scroll to continue reading.

“This is typically followed by human-operated activity, including lateral movement, data theft, and ransomware deployment,” Microsoft said.

According to SysAid, the cybercriminals also deployed a PowerShell script to cover their tracks by erasing evidence from targeted servers.

https://www.securityweek.com/sysaid-zero-day-vulnerability-exploited-by-ransomware-group/

Critical Vulnerabilities Expose Veeam ONE Software to Code Execution

Veeam Software has rolled out patches for four severe security vulnerabilities that expose users of its Veeam ONE product to remote code execution attacks

The Ohio company issued an urgent advisory to document the flaws, which include a pair of critical issues with CVSS severity scores of 9.9 out of 10.

An IT monitoring and analytics solution, Veeam ONE provides organizations with real-time monitoring, management reporting, and business documentation for Veeam’s backup products.

Veeam is documenting the most serious issue as CVE-2023-38547 (CVSS 9.9), a security defect that could allow an attacker to execute code remotely.

“A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration database. This may lead to remote code execution on the SQL server hosting the Veeam ONE configuration database,” the company warned.

The second critical issue, tracked as CVE-2023-38548 (CVSS 9.8), could allow an attacker obtained the hashed password for the Veeam ONE Reporting Service.

“A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by the Veeam ONE Reporting Service,” Veeam said.

Veeam also patched a medium-severity issue (CVE-2023-38549) that allows an attacker with ‘power user’ privileges to obtain the access token of a Veeam ONE administrator. Successful exploitation requires interaction from the administrator.

A fourth issue, tracked as CVE-2023-41723, was also fixed to block attackers with read-only access from viewing the application’s dashboard schedule.

Advertisement. Scroll to continue reading.

Veeam released hotfixes to address these flaws in Veeam ONE versions 11, 12, and 13. Administrators are advised to download the patches and install them as soon as possible.

Veeam makes no mention of any of these vulnerabilities being exploited in attacks, but attackers are known to have targeted flaws in its backup solutions.

https://www.securityweek.com/critical-vulnerabilities-expose-veeam-one-software-to-code-execution/

Exploitation of Critical Confluence Vulnerability Begins

The first in-the-wild exploitation attempts targeting a recent vulnerability in Atlassian Confluence Data Center and Confluence Server were observed over the weekend, threat intelligence firm GreyNoise warns.

Patched a week ago, the critical security defect tracked as CVE-2023-22518 (CVSS score of 9.1) is an improper authorization flaw that could lead to “significant data loss”, Atlassian warned. The issue impacts all Confluence versions.

Less than five days after releasing the patch, Atlassian issued a second warning, informing customers that “critical information about the vulnerability” had been made public, and that the risk of exploitation had increased significantly.

The enterprise software maker issued the fresh alert on the same day that ProjectDiscovery published technical information on the flaw, along with details on potential exploitation methods.

On Friday, Atlassian updated its initial advisory again, to warn that the vulnerability is under active exploitation.

“We received a customer report of an active exploit. Customers must take immediate action to protect their instances. If you already applied the patch, no further action is required,” the company’s updated advisory reads.

Over the weekend, GreyNoise’s scanners caught in-the-wild exploitation of CVE-2023-22518 targeting organizations in the US, Taiwan, Ukraine, Georgia, Latvia, and Moldova.

Attacks were originating from three different IP addresses, GreyNoise CEO and founder Andrew Morris pointed out on Sunday.

Advertisement. Scroll to continue reading.

While the issue cannot be exploited to exfiltrate data from vulnerable Confluence servers, it could be used to replace the state of an instance to attacker-supplied data, without authentication.

Rapid7 too has observed multiple attempts to exploit web-accessible Confluence servers and says that at least some of the attacks targeted CVE-2023-22518, while others targeted CVE-2023-22515, a critical Confluence zero-day that came to light on October 4.

“The process execution chain, for the most part, is consistent across multiple environments, indicating possible mass exploitation of vulnerable internet-facing Atlassian Confluence servers,” Rapid7 notes in a November 6 post.

Multiple attack chains, the cybersecurity firm notes, involved the post-exploitation execution of commands to download a malicious payload, leading to a Cerberus ransomware infection.

Confluence Data Center and Server versions 7.19.16, 8.3.4, 8.4.4, 8.5.3, and 8.6.1 were released last week to address CVE-2023-22518. All users are advised to update their instances as soon as possible or at least create backups and block internet access to vulnerable instances until patches are applied.

*Updated with information from Rapid7

https://www.securityweek.com/exploitation-of-critical-confluence-vulnerability-begins/

Microsoft Says Exchange ‘Zero Days’ Disclosed by ZDI Already Patched or Not Urgent

Microsoft says four Exchange ‘zero-days’ disclosed by ZDI have either already been patched or they don’t require immediate attention.

The post Microsoft Says Exchange ‘Zero Days’ Disclosed by ZDI Already Patched or Not Urgent appeared first on SecurityWeek.

https://www.securityweek.com/microsoft-says-exchange-zero-days-disclosed-by-zdi-already-patched-or-not-urgent/

Atlassian Issues Second Warning on Potential Exploitation of Critical Confluence Flaw

Atlassian warns that ‘critical information’ released on the Confluence bug CVE-2023-22518 increases the risk of exploitation.

The post Atlassian Issues Second Warning on Potential Exploitation of Critical Confluence Flaw appeared first on SecurityWeek.

https://www.securityweek.com/atlassian-issues-second-warning-on-potential-exploitation-of-critical-confluence-flaw/