Cloudflare Users Exposed to Attacks Launched From Within Cloudflare: Researchers

Gaps in Cloudflare’s security controls allow users to bypass customer-configured protection mechanisms and target other users from the platform itself, technology consulting firm Certitude warns.

The issue, the company says, arises from the shared infrastructure that all Cloudflare tenants have access to, allowing malicious actors to abuse the trust customers place in the platform’s protections to target them via Cloudflare.

A major cybersecurity vendor offering web application firewall (WAF), bot management, and distributed denial-of-service (DDoS) protections, Cloudflare relies on a network of reverse-proxy servers to inspect all traffic headed to customers’ web servers for malicious activity.

According to Certitude, because traffic originating from Cloudflare’s own infrastructure is considered trusted by default, it is not passed through the configured reverse-proxy servers, as is traffic from other parties.

Because of that, the consulting firm says, an attacker registered with Cloudflare can target other users on the platform, essentially bypassing the platform’s protections.

One gap Certitude discovered is related to the ‘Authenticated Origin Pulls’ on Transport Layer mechanism, which relies on a Cloudflare SSL certificate for authentication.

When setting up the authentication mechanism to their web servers (origin servers), customers can opt for using a Cloudflare certificate or for using their own certificate.

Advertisement. Scroll to continue reading.

However, because the available options are insufficiently documented, and because a custom certificate can only be used with an API, “it is reasonable to assume that customers will opt for the more convenient choice of using the Cloudflare certificate,” Certitude notes.

The use of a shared certificate means that all connections originating from Cloudflare are permitted, regardless of the tenant initiating them.

A similar gap was identified in the ‘Allowlist Cloudflare IP addresses’ on Network Layer mechanism, which blocks connections originating from outside Cloudflare’s IP ranges, but permits all connections from within Cloudflare’s infrastructure.

“An attacker can establish a custom domain with Cloudflare, direct the DNS A record to the victims IP address. Next, they disable all protection features for that custom domain and route their attack(s) through Cloudflare’s infrastructure, effectively bypassing the protection features that the victim has configured,” Certitude explains.

The consulting firm has published a proof-of-concept (PoC) demonstration of these issues and recommends the use of custom certificates for connection authentication and the use of Cloudflare Aegis to mitigate the gaps.

Certitude says it reported the issues through Cloudflare’s bug bounty program in March, and that its report was marked as ‘informative’ and closed without a fix. A Cloudflare spokesperson has yet to respond to SecurityWeek’s request for a statement.

https://www.securityweek.com/cloudflare-users-exposed-to-attacks-launched-from-within-cloudflare-researchers/

Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product

Enterprise technology vendor Progress Software on Thursday shipped patches for critical-level security flaws in its WS_FTP file transfer software, warning that a pre-authenticated attacker could wreak havoc on the underlying operating system.

An urgent bulletin from the Burlington, Mass. company documented at least eight security defects that could be exploited remotely and urged business customers to immediately upgrade to WS_FTP Server 2020.0.4 (8.7.4) and WS_FTP Server 2022.0.2 (8.8.2).

Progress Software said two of the vulnerabilities — CVE-2023-40044 and CVE-2023-40045 — are rated critical because of the risk of pre-auth remote command execution attacks.

From the Progress Software bulletin:

CVE-2023-40044 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system. Critical — CVSS: 10/10.
CVE-2023-42657 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system. Critical — CVSS: 9.9/10.

The company also called attention to a trio of high-severity bugs that could lead to reflected cross-site scripting (XSS) and SQL injection attacks.

Progress Software’s security response team has found itself scrambling to respond to a wave of debilitating ransomware attacks that exploited zero-day flaws in its MOVEit managed file transfer software produyt.

Earlier this year, the company rushed out patches to cover at least three critical vulnerabilities and announced plans to release regular service packs with a “predictable, simple and transparent process for product and security fixes.”

“We have heard from you that a regular cadence and predictable timeline will enable you to better plan your resources and make it easier to adopt new product updates and fixes. As a part of these Service Packs, we will also be optimizing the installation process to make the upgrade process simpler,” Progress said in a note posted with the first service pack.

Advertisement. Scroll to continue reading.

Software vendors typically use a service pack to deliver a collection of updates, fixes, features or enhancements to an application. Service packs are delivered in the form of a single installable package.

https://www.securityweek.com/progress-software-patches-critical-pre-auth-flaws-in-ws_ftp-server-product/

Cisco Warns of IOS Software Zero-Day Exploitation Attempts

Cisco this week announced patches for multiple vulnerabilities impacting its products, including a medium-severity flaw in IOS and IOS XE software that appears to have been exploited in attacks.

Tracked as CVE-2023-20109, the bug impacts the Group Encrypted Transport VPN (GET VPN) feature of IOS and IOS XE and can lead to remote code execution. Successful exploitation of the flaw requires that the attacker has valid credentials and administrative control over a group member or a key server.

“This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker,” Cisco notes in its advisory.

All Cisco products running a vulnerable IOS or IOS XE release with the GDOI or G-IKEv2 protocol enabled are impacted by this issue. There are no workarounds available for this bug and Cisco recommends that all customers update to a patched IOS or IOS XE release.

The tech giant also notes that it has observed exploitation attempts targeting this vulnerability.

“Cisco discovered attempted exploitation of the GET VPN feature and conducted a technical code review of the feature. This vulnerability was discovered during our internal investigation,” the company notes.

This week, Cisco also released patches for multiple flaws in the Catalyst SD-WAN Manager product, including a critical-severity bug (CVE-2023-20252, CVSS score of 9.8) in the SAML APIs that could allow an unauthenticated attacker to gain unauthorized access to the application as an arbitrary user.

Advertisement. Scroll to continue reading.

The vulnerability was resolved along with four high-severity bugs that could be exploited to bypass authorization and roll back controller configurations, access a system’s Elasticsearch database, access another tenant managed on the same instance, or cause a denial-of-service (DoS) condition.

Multiple other high-severity issues leading to code execution, DoS, data access and tampering, and file exfiltration were addressed with software updates for IOS, IOS XE, and Cisco DNA Center. The tech giant also patched several other medium-severity issues impacting its products.

Cisco says that, aside from CVE-2023-20109, it is not aware of any of these vulnerabilities being exploited in attacks. Additional information can be found on Cisco’s security advisories page.

https://www.securityweek.com/cisco-warns-of-ios-software-zero-day-exploitation-attempts/

Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor

Google has rushed to patch another Chrome zero-day vulnerability exploited by a commercial spyware vendor.

The internet giant announced on Tuesday that the stable channel of Chrome for Windows, macOS and Linux has been updated to version 117.0.5938.132.

The latest update patches 10 vulnerabilities, three of which have been highlighted by the company in its advisory.

The most important vulnerability, tracked as CVE-2023-5217, has been described as a “heap buffer overflow in vp8 encoding in libvpx”. The issue was reported to the Chrome team by Clement Lecigne of Google’s Threat Analysis Group (TAG) just two days before the patch was released.

Google warned that CVE-2023-5217 has been exploited in the wild.

While the advisory does not provide any information on the attacks exploiting the zero-day, Google TAG researcher Maddie Stone revealed that it has been leveraged by a commercial surveillance vendor.

The news comes shortly after Google TAG and the University of Toronto’s Citizen Lab group released details on an operation whose goal was to deliver a piece of spyware known as Predator to an opposition politician in Egypt.

Advertisement. Scroll to continue reading.

An analysis showed that the threat actor has used various zero-days and man-in-the-middle (MitM) attacks to deliver spyware to both Android and iOS devices.

CVE-2023-5217 is the sixth Chrome zero-day patched by Google in 2023, after CVE-2023-4762, CVE-2023-4863, CVE-2023-3079, CVE-2023-2033, and CVE-2023-2136.

The latest Chrome update also patches CVE-2023-5186 and CVE-2023-5187, two high-severity use-after-free bugs in the Passwords and Extensions components.

https://www.securityweek.com/google-rushes-to-patch-new-zero-day-exploited-by-spyware-vendor/

Firefox 118 Patches High-Severity Vulnerabilities

Mozilla on Tuesday announced security updates for both Firefox and Thunderbird, addressing a total of nine vulnerabilities in its products, including high-severity flaws.

Firefox 118 was released to the stable channel with patches for all nine vulnerabilities – all are memory issues, most of which could lead to exploitable crashes.

Tracked as CVE-2023-5168 and CVE-2023-5169, the first two high-severity flaws are described as out-of-bounds write issues in the browser’s FilterNodeD2D1 and PathOps components. According to Mozilla, both could lead to “a potentially exploitable crash in a privileged process”.

The third bug, CVE-2023-5170, is a memory leak issue that “could be used to effect a sandbox escape if the correct data was leaked”, Mozilla explains in its advisory.

Another high-severity vulnerability was patched in the Ion compiler. Tracked as CVE-2023-5171 and described as a use-after-free condition, the bug allowed an attacker to write two NUL bytes, causing a potentially exploitable crash.

Firefox 118 also patches CVE-2023-5172, a memory corruption in Ion Hints that could lead to a use-after-free condition and a potentially exploitable crash.

The browser update also resolves multiple high-severity memory safety bugs that are collectively tracked as CVE-2023-5176. According to Mozilla, “with enough effort”, an attacker could exploit some of these flaws to execute arbitrary code.

Advertisement. Scroll to continue reading.

The three remaining issues patched with the release of Firefox 118 are medium- and low-severity memory bugs.

On Tuesday, Mozilla announced the release of Firefox ESR 115.3 and Thunderbird 115.3 with patches for five vulnerabilities each. These include four of the high-severity flaws and one medium-severity bug that Firefox 118 addresses.

Mozilla makes no mention of any of these vulnerabilities being exploited in malicious attacks. Additional details can be found on Mozilla’s security advisories page.

https://www.securityweek.com/firefox-118-patches-high-severity-vulnerabilities/

macOS 14 Sonoma Patches 60 Vulnerabilities

Apple on Tuesday announced the release of macOS 14 Sonoma. A security advisory published by the tech giant shows that the latest version of the operating system patches more than 60 vulnerabilities.

The flaws can be exploited to obtain potentially sensitive information (location, calendar, contacts, photos, credentials), execute arbitrary code with elevated privileges, escape the sandbox, read arbitrary files, cause a denial-of-service (DoS) condition, escalate privileges, bypass security mechanisms, delete files, modify protected parts of the file system, and conduct UI spoofing.

While some of these vulnerabilities can be exploited remotely by getting the targeted user to access a specially crafted website, a majority require the presence of a malicious app on the targeted device.

A few of these vulnerabilities were first patched with previous updates, including CVE-2023-41993, which has been exploited as a zero-day to deliver spyware to iPhones.

Apple also released an iOS 17 update on Tuesday, but said it does not patch any security flaws.

The company has updated its September 21 advisory for iOS 16.7 and iPadOS 16.7 to inform users that these versions patch an additional 17 vulnerabilities.

macOS Sonoma 14, which brings several new features and enhancements, is available for Mac Studio, iMac, Mac Pro, Mac mini, MacBook Air, MacBook Pro, and iMac Pro devices.

Advertisement. Scroll to continue reading.

https://www.securityweek.com/macos-14-sonoma-patches-60-vulnerabilities/

In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover

A critical vulnerability in the TeamCity CI/CD server could be exploited remotely, without authentication, to execute arbitrary code and gain administrative control over a vulnerable server.

Developed by JetBrains, TeamCity is a general-purpose build management and continuous integration platform available both for on-premises installation and as a cloud service.

The recently identified critical flaw, tracked as CVE-2023-42793 (CVSS score of 9.8), is described as an authentication bypass impacting the on-premises version of TeamCity.

The issue can be exploited by attackers over an HTTP(S) connection and does not require user interaction for successful exploitation, code security firm Sonar Source, which identified the bug, explains.

“This enables attackers not only to steal source code but also stored service secrets and private keys. And it’s even worse: With access to the build process, attackers can inject malicious code, compromising the integrity of software releases and impacting all downstream users,” Sonar notes.

This, Sonar says, is possible because CI/CD servers such as TeamCity automate the software development process, meaning that they have access to an organization’s source code and other sensitive information associated with the building, testing, and deployment processes.

According to JetBrains, all TeamCity on-premises instances up to and including version 2023.05.3 are impacted by this vulnerability. TeamCity cloud is not affected by the vulnerability.

Advertisement. Scroll to continue reading.

The bug was addressed in TeamCity version 2023.05.4. JetBrains also released a security patch plugin for TeamCity versions 8.0 and above, but says it is not considering to backport the fix.

“The security patch plugin will only address the RCE vulnerability described above. We always recommend users upgrade their servers to the latest version to benefit from many other security updates,” JetBrains explains.

TeamCity servers that are accessible from the internet should be patched immediately or made inaccessible until the patch is installed.

Both JetBrains and Sonar say that technical details on the vulnerability are not being published for now. According to Sonar, the bug is trivial to exploit and it is likely that in-the-wild exploitation will be observed.

https://www.securityweek.com/in-the-wild-exploitation-expected-for-critical-teamcity-flaw-allowing-server-takeover/

BIND Updates Patch Two High-Severity DoS Vulnerabilities

The Internet Systems Consortium (ISC) has released security updates to address two remotely exploitable denial-of-service (DoS) vulnerabilities in the DNS software suite BIND.

Both bugs, ISC says, reside in named – the BIND daemon that acts both as an authoritative name server and as a recursive resolver – and may cause it to terminate unexpectedly.

The first of the flaws, tracked as CVE-2023-3341 (CVSS score of 7.5), is described as a stack exhaustion issue impacting the control channel message processing. The code calls for certain functions recursively, which could lead to memory exhaustion.

“Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly,” ISC notes in its advisory.

Because each message is fully parsed before its content is authenticated, a remote attacker with access to the control channel’s configured TCP port can exploit the vulnerability without a valid RNDC key.

According to ISC, “the attack only works in environments where the stack size available to each process/thread is small enough; the exact threshold depends on multiple factors and is therefore impossible to specify universally.”

The issue impacts BIND versions 9.2.0 to 9.16.43, 9.18.x, and 9.19.x, and was resolved in BIND versions 9.16.44, 9.18.19, and 9.19.17. BIND Supported Preview Edition versions 9.9.3-S1 to 9.16.43-S1 and 9.18.0-S1 to 9.18.18-S1 are also affected, with patches included in versions 9.16.44-S1 and 9.18.19-S1.

Advertisement. Scroll to continue reading.

Tracked as CVE-2023-4236 (CVSS score of 7.5), the second flaw is described as an assertion failure in the networking code that handles DNS-over-TLS queries.

“When internal data structures are incorrectly reused under significant DNS-over-TLS query load”, named may crash unexpectedly, ISC explains.

DNS-over-HTTPS code in BIND uses a different TLS implementation and is not affected.

The flaw impacts BIND versions 9.18.0 to 9.18.18 and BIND Supported Preview Edition versions 9.18.11-S1 to 9.18.18-S1, and was addressed with the release of BIND version 9.18.19 and BIND Supported Preview Edition version 9.18.19-S1.

ISC says it is not aware of any of these vulnerabilities being exploited in malicious attacks.

https://www.securityweek.com/bind-updates-patch-two-high-severity-dos-vulnerabilities/

Faster Patching Pace Validates CISA’s KEV Catalog Initiative

The Known Exploited Vulnerabilities (KEV) Catalog maintained by the US cybersecurity agency CISA has led to significant improvements in federal agencies’ patching efforts, with more than 1,000 vulnerabilities now included in the list.

Launched in November 2021, the KEV Catalog lists flaws that CISA has proof are being exploited in malicious attacks, and is accompanied by the Binding Operational Directive (BOD) 22-01, which requires federal agencies to patch newly added bugs within a specified timeframe.

Since November 2021, CISA says, federal agencies have patched over 12 million instances of KEV entries, with 7 million of them being addressed in 2023 alone.

Overall, federal agencies have experienced a 72% decrease of KEVs exposed for 45 days or more, while local governments and critical infrastructure entities have seen a 31% decrease.

According to CISA, the KEV catalog has helped federal agencies and other enrolled entities significantly accelerate their patching efforts, with mean-time-to-remediate for KEVs being nine days faster compared to that of non-KEVs. For internet-facing issues in the catalog, the remediation was 36 days faster.

The purpose of the KEV Catalog, CISA underlines, is to help organizations prioritize vulnerability management, based on how a vulnerable product is being used and the impact exploitation could have.

“A KEV in an Internet-facing web server providing privileged access to customer accounts would, reasonably, be a much higher priority for mitigation than the exact same KEV in an internal system providing unprivileged access to the organization’s cafeteria menu,” CISA explains.

Advertisement. Scroll to continue reading.

While the idea behind the KEV Catalog is to reduce cybersecurity risks, organizations should not rely solely on this list when implementing a vulnerability response plan.

CISA explains that new entries are added to the KEV Catalog only if there is irrefutable proof of in-the-wild exploitation, and if there are means to address it, such as a patch or mitigation information.

“Sometimes it’s impossible to find an official patch. In these instances, we coordinate alternative messaging to inform the public about the vulnerability with actions that should be taken so there’s something that can be done to prevent exploitation. In any event, we don’t add a vulnerability to the KEV unless there is an actionable patch or other suitable mitigation,” CISA notes.

The cybersecurity agency encourages organizations to consult decision models such as the Stakeholder Specific Vulnerability Categorization (SSVC) and prioritize vulnerability management based on them.

Moving forward, CISA is exploring the idea of adding more information on the exploitation of each vulnerability in the KEV Catalog, and to find ways to incorporate the KEV Catalog into existing tools that help organizations prioritize patching.

In time, CISA says, the addition of new entries to the catalog should become a rare occurrence, which can be achieved by implementing a secure-by-design approach that will reduce the prevalence of vulnerabilities.

“Consistent with the National Cybersecurity Strategy, we will continue to drive the ecosystem toward a future where nearly all KEVs are eliminated before a product is released to the market,” CISA notes.

https://www.securityweek.com/faster-patching-pace-validates-cisas-kev-catalog-initiative/

Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones

Apple announced on Thursday that its latest operating system updates patch three new zero-day vulnerabilities. Based on the previous work of the organizations credited for reporting the flaws, they have likely been exploited by a spyware vendor.

The zero-days are tracked as CVE-2023-41991, which allows a malicious app to bypass signature verification, CVE-2023-41992, a kernel flaw that allows a local attacker to elevate privileges, and CVE-2023-41993, a WebKit bug that can be exploited for arbitrary code execution by luring the targeted user to a malicious webpage.

Apple patched some or all of these vulnerabilities in Safari, iOS and iPadOS (including versions 17 and 16), macOS (including Ventura and Monterey), and watchOS.

It’s worth noting that while each of these operating systems is impacted by the zero-days, Apple said it’s only aware of active exploitation targeting iOS versions before 16.7.

Apple has not shared any information about the attacks exploiting the new vulnerabilities. However, considering that they were reported to the tech giant by researchers at the University of Toronto’s Citizen Lab group and Google’s Threat Analysis Group, they have likely been exploited by a commercial spyware vendor to hack iPhones.

Citizen Lab and Apple recently investigated attacks involving a zero-day identified as CVE-2023-41064. That security hole, part of a zero-click exploit named BlastPass, was used to deliver the NSO Group’s notorious Pegasus spyware to iPhones.

In an attack investigated by Citizen Lab, the spyware was delivered to an employee at an international civil society organization based in Washington DC.

Advertisement. Scroll to continue reading.

CVE-2023-41064 impacts the WebP image format. The affected library is also used in the Chrome and Firefox web browsers, and Google and Mozilla were also forced to release emergency updates to address the zero-day, which they track as CVE-2023-4863.

https://www.securityweek.com/apple-patches-3-zero-days-likely-exploited-by-spyware-vendor-to-hack-iphones/