Patch Tuesday: Code Execution Flaws in Adobe Commerce, Photoshop
Software maker Adobe on Tuesday released fixes for at least 13 security vulnerabilities in multiple product lines, warning that critical flaws in Adobe Commerce and Photoshop will require immediate attention.
As part of its scheduled batch of Patch Tuesday updates, Adobe documented at least 10 serious flaws in Adobe Commerce and Magento Open Source, a product line often targeted by malicious hackers.
“Successful exploitation could lead to arbitrary code execution, privilege escalation, arbitrary file system read, security feature bypass and application denial-of-service,” Adobe said in a critical-severity advisory.
The company identified the affected software versions as Adobe Commerce (multiple versions including 2.4.7-beta1 and earlier) and Magento Open Source (Multiple versions including 2.4.7-beta1 and earlier.)
Adobe said it was not aware of exploits for any of the documented vulnerabilities.
The San Jose, Calif. firm also released updates to fix a critical-severity flaw in the popular Adobe Photoshop software. The flaw, tagged as CVE-2023-26370, could be exploited to launch code execution attacks on both Windows and macOS systems.
Adobe said the patches apply to Photoshop 2022 (23.5.5 and earlier versions) and Photoshop 2023 (24.7 and earlier versions).
Advertisement. Scroll to continue reading.
Adobe’s security response team also released fixes for a pair of vulnerabilities in Adobe Bridge that could lead to memory corruption exploitation.
SAP Releases 7 New Notes on October 2023 Patch Day
German software maker SAP this week announced the release of seven new and two updated security notes as part of its October 2023 Security Patch Day.
The most severe of the security notes brings an update to the Chromium browser in SAP Business Client, which contains 37 fixes, including two critical- and 20 high-severity vulnerabilities.
One of these critical flaws, enterprise application security firm Onapsis notes, is CVE-2023-4863 an already exploited bug in the libwebp image rendering library, which vendors have been scrambling to patch lately.
Since libwebp is used in multiple applications other than web browsers, organizations are advised to check all their software for the presence of this vulnerability and apply available patches accordingly.
The update also addresses CVE-2023-5217, another exploited vulnerability that Google rolled out patches for in September and which CISA added to its Known Exploited Vulnerabilities catalog recently.
The second updated security note that SAP released this week addresses a log injection flaw in NetWeaver. Tracked as CVE-2023-31405 (CVSS score of 5.3), the vulnerability was initially patched in July 2023.
“Unlike many other updates, the updated note does not completely replace the initial patch. Customers need to implement both notes to be fully protected. While the initial note contains patches for all three affected software components (ENGINEAPI, SERVERCORE, and J2EE-APPS), [the update] only updates the ENGINEAPI component since the patch for this component was incomplete,” Onapsis explains.
Advertisement. Scroll to continue reading.
The remaining seven security notes described in SAP’s latest advisory deal with medium-severity bugs only, making this one of “the calmest Patch Days of the last 5 years,” as Onapsis points out.
The notes address issues such as cross-site scripting (XSS), missing XML validation, server-side request forgery (SSRF), missing authorization check, log injection, and information disclosure bugs impacting BusinessObjects, PowerDesigner Client, NetWeaver, S/4HANA, Business One, and Statutory Reporting.
One-Click GNOME Exploit Could Pose Serious Threat to Linux Systems
GitHub’s Security Lab has warned Linux users about a serious remote code execution vulnerability affecting a component of the popular GNOME desktop environment.
The flaw was found in Libcue, a library designed for parsing ‘cue’ files, which describe how the tracks on a CD are laid out. Libcue is used by a search engine called Tracker Miners, which in turn is used by GNOME to index files in the home directory to make searches more efficient.
GitHub Security Lab researcher Kevin Backhouse discovered that Libcue is affected by a vulnerability — tracked as CVE-2023-43641 — that can be exploited for remote code execution by getting the targeted user to click on a malicious link.
Backhouse has made available a video showing how an attacker could exploit the vulnerability to launch the calculator on a Linux system by getting the targeted user to click on a link that triggers a cue file download. When the attacker’s file is saved on the victim’s device, it’s automatically scanned by Tracker Miners and processed using the Libcue library, which triggers the exploit and executes the attacker’s code.
Backhouse has made public technical details, but said the weaponized proof-of-concept (PoC) exploit for CVE-2023-43641 will not be released until users have had the chance to install the patch.
The exploit has been tested against Ubuntu and Fedora, but the researcher believes all distributions running GNOME could be vulnerable. However, he noted that the exploit requires some tweaking for each distribution.
A simple version of the PoC, which causes a benign crash, has been made public to allow users to check whether their system is vulnerable to attacks exploiting CVE-2023-43641.
Advertisement. Scroll to continue reading.
“Sometimes a vulnerability in a seemingly innocuous library can have a large impact. Due to the way that it’s used by tracker-miners, this vulnerability in libcue became a 1-click RCE. If you use GNOME, please update today!” Backhouse said.
Thousands of WordPress sites have been hacked through tagDiv plugin vulnerability
Thousands of sites running the WordPress content management system have been hacked by a prolific threat actor that exploited a recently patched vulnerability in a widely used plugin.
The vulnerable plugin, known as tagDiv Composer, is a mandatory requirement for using two WordPress themes: Newspaper and Newsmag. The themes are available through the Theme Forest and Envato marketplaces and have more than 155,000 downloads.
Tracked as CVE-2023-3169, the vulnerability is what’s known as a cross-site scripting (XSS) flaw that allows hackers to inject malicious code into webpages. Discovered by Vietnamese researcher Truoc Phan, the vulnerability carries a severity rating of 7.1 out of a possible 10. It was partially fixed in tagDiv Composer version 4.1 and fully patched in 4.2.
According to a post authored by security researcher Denis Sinegubko, threat actors are exploiting the vulnerability to inject web scripts that redirect visitors to various scam sites. The redirections lead to sites pushing fake tech support, fraudulent lottery wins, and push notification scams, the latter of which trick visitors into subscribing to push notifications by displaying fake captcha dialogs.
Sucuri, the security firm Sinegubko works for, has been tracking the malware campaign since 2017 and has named it Balada. Sucuri estimates that in the past six years, Balada has compromised more than 1 million sites. Last month, Sucuri detected Balada injections on more than 17,000 sites, almost double the number the firm had seen the month before. More than 9,000 of the new infections were the result of injections made possible by exploiting CVE-2023-3169.
Sinegubko wrote:
We observed a rapid cycle of modifications to their injected scripts alongside new techniques and approaches. We saw randomized injections and obfuscation types, simultaneous use of multiple domains and subdomains, abuse of CloudFlare, and multiple approaches to attack administrators of infected WordPress sites.
September was also a very challenging month for thousands of users of the tagDiv Newspaper theme. The Balada Injector malware campaign performed a series of attacks targeting both the vulnerability in the tagDiv Composer plugin and blog administrators of already infected sites.
Sucuri has tracked no fewer than six waves of injections that leverage the vulnerability. While each wave is distinct, all contain a telltale script injected inside of these tags:
The malicious injection uses obfuscated code to make it hard to detect. It can be found in the database used by WordPress sites, specifically in the “td_live_css_local_storage” option of the wp_options table.
The Balada threat actor has always attempted to gain persistent control over the websites it compromises. The most common way it does this is by injecting scripts that create accounts with administrator privileges. If real admins detect and remove the redirection scripts but allow the fake admin accounts to remain, the threat actor uses its administrative control to add a new set of malicious redirect scripts.
The researcher wrote:
Balada Injector hackers always aim for persistent control over compromised sites by uploading backdoors, adding malicious plugins, and creating rogue blog administrators. In this case, the [CVE-2023-3169] vulnerability doesn’t allow them to easily achieve this goal. However, this never stopped Balada from trying to completely take over the sites with stored XSS vulnerabilities.
Balada is long known for injecting malicious scripts that target logged-in site administrators. The idea is when a blog administrator logs into a website, their browser contains cookies that allow them to do all their administrative tasks without having to authenticate themselves on every new page. So, if their browser loads a script that tries to emulate administrator activity, it will be able to do almost anything that can be done via the WordPress admin interface.
Anyone administering a site that uses the WordPress themes Newspaper or Newsmag should carefully inspect both their site and event logs for signs of infection using the many indicators of compromise included in the Sucuri post. As mentioned, the Balada threat actors attempt to gain persistent access to the sites they compromise. In addition to removing any malicious scripts added, it’s also important to check for backdoor code and the addition of any admin accounts.
https://arstechnica.com/?p=1974522
Patches Prepared for ‘Probably Worst’ cURL Vulnerability
The maintainers of the cURL data transfer project are working on patching two vulnerabilities in the software, including a high-severity bug impacting both libcurl and curl.
cURL provides both a library (libcurl) and command-line tool (curl) for transferring data with URL syntax, supporting various network protocols, including SSL, TLS, HTTP, FTP, SMTP, and more.
The two issues are tracked as CVE-2023-38545 and CVE-2023-38546, and the maintainers are warning that the former has a ‘high severity’ rating and could be considered one of the most severe flaws in the open source tool.
“We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW. The one rated HIGH is probably the worst curl security flaw in a long time,” the maintainers note in an advisory.
Details on the vulnerability itself and on the affected curl versions have yet to be disclosed, but the maintainers say that all iterations released over the “last several years” are vulnerable.
The advisory was published ahead of patches to warn organizations of the bug’s severity, so that they can prepare for the upcoming updates. Member distributions were also notified, so they can prepare patches.
“No one else gets details about these problems before October 11 without a support contract and a good reason,” curl’s maintainers say.
Advertisement. Scroll to continue reading.
“Organizations should urgently inventory and scan all systems utilizing curl and libcurl, anticipating identifying potentially vulnerable versions once details are disclosed with the release of Curl 8.4.0 on October 11. Immediate update implementation upon release is essential to safeguard systems against these pressing vulnerabilities,” Qualys product manager Saeed Abbasi points out.
According to curl’s maintainers, the vulnerability potentially impacts all projects relying on libcurl, although some software may use it in a way that does not allow exploitation.
“Updating the shared libcurl library should be enough to fix this issue on all operating systems,” the maintainers point out.
Google Expands Bug Bounty Program With Chrome, Cloud CTF Events
Google has announced the expansion of its vulnerability rewards program with two events focused on Chrome’s V8 JavaScript rendering engine and on Kernel-based Virtual Machine (KVM).
The v8CTF, which has already started, allows security researchers to earn monetary rewards for successfully exploiting a V8 version running on Google’s infrastructure.
The challenge is meant to complement Google’s VRP, allowing researchers who identify vulnerabilities in the JavaScript engine to earn additional rewards by submitting exploits to the v8CTF. However, participating researchers can also submit exploits for already known V8 vulnerabilities.
“If the bug that led to the initial memory corruption was found by you, i.e. reported from the same email address as used in the v8CTF submission, we will consider the exploit a 0-day submission. All other exploits are considered n-day submissions,” Google explains.
Researchers who identify a new vulnerability are encouraged to report it first to the Chrome VRP. Next, they can use the exploit in the v8CTF, to exfiltrate the flag from Google’s infrastructure.
According to the program’s rules, security researchers submitting valid exploits are eligible for a reward of $10,000.
“This is on top of any existing rewards for the vulnerabilities themselves. For example, if you find a vulnerability in V8 and then write an exploit for it, it can be eligible under both the Chrome VRP and the v8CTF,” Google explains.
Advertisement. Scroll to continue reading.
Set to be launched later this year, kvmCTF will reward researchers for exploits targeting zero-day and one-day vulnerabilities in KVM, the open-source virtualization module in the Linux kernel that allows it to function as a hypervisor.
The event will focus on the LTS kernel and will reward successful guest-to-host attacks. QEMU exploits or vulnerabilities are not within the event’s scope for now.
Google promises rewards of up to $99,999 for exploits leading to a full VM escape, but it will also reward arbitrary memory write/read ($34,999 and $24,999, respectively) and denial-of-service (DoS) exploits ($14,999).
“Note that the above rewards do not stack. For example if you submit a full VM escape exploit that uses an arbitrary memory write, you will be compensated with the reward for the VM escape ($99,999) and not with two separate rewards ($99,999 + $34,999),” Google explains.
Security researchers interested in participating are encouraged to read the rules for v8CTF and kvmCTF, exploit an identified vulnerability to grab the flag, and send the flag to Google, as specified in the rules.
“If you’re successful, you’ll not only earn a reward, but you’ll also help us make our products more secure for everyone. This is also a good opportunity to learn about technologies and gain hands-on experience exploiting them,” Google notes.
CISA Reverses Course on Malicious Exploitation of Video Conferencing Device Flaws
The US cybersecurity agency CISA has removed several Owl Labs product flaws from its Known Exploited Vulnerabilities (KEV) Catalog after SecurityWeek privately called into question its decision.
In mid-September, CISA added to its KEV catalog four vulnerabilities affecting Owl Labs’ Meeting Owl smart video conferencing product, a device shaped like an owl that features a 360° conference camera, a mic, and a speaker. Another Meeting Owl flaw was previously added to the KEV list.
The Meeting Owl vulnerabilities, discovered last year by researchers at Swiss cybersecurity firm Modzero, include inadequate encryption, hardcoded credentials, missing authentication, and improper authentication issues. An attacker can use them to take control of the targeted Meeting Owl device and turn it into a rogue access point, but exploitation would require an attacker to be in Bluetooth range of the targeted Meeting Owl device.
“CISA is continually collaborating with partners across government and the private sector. As a result of this collaboration, CISA has concluded that there is insufficient evidence to keep the [five Meeting Owl] CVEs in the catalog and has removed them,” the agency said.
When the vulnerabilities were added to the KEV list, SecurityWeek reached out to both CISA and the vendor for confirmation of malicious exploitation, given that there were no public reports about exploitation and the fact that the vulnerabilities seemed unlikely to be considered useful by threat actors as they require the attacker to be in Bluetooth range. Malicious hackers exploiting vulnerabilities via Bluetooth is — as far as we know — unheard of.
However, when faced with similar inquiries in the past, CISA insisted that only flaws for which it has reliable evidence of exploitation in the wild are added to the KEV catalog. In this case, it would have meant that the vulnerabilities were likely exploited by a highly motivated and sophisticated attacker as part of a targeted espionage campaign rather than as part of opportunistic operations.
CISA has still not responded to SecurityWeek’s inquiry. When contacted in mid-September, Owl Labs’ response suggested that the company had not been aware of any attacks. The vendor informed SecurityWeek of CISA’s decision to remove the CVEs from its catalog on Thursday, but did not say why the cybersecurity agency thought the vulnerabilities were exploited.
Advertisement. Scroll to continue reading.
When the flaws were added to the KEV catalog, Tenable’s Ben Smith noted in a blog post, “I’m not currently aware of any [Bluetooth Low Energy (BLE)] vulnerabilities actually exploited in the wild. I’m also not aware of any malware that contains Bluetooth or BLE functionality. Evidence would probably look like either logs from the device or a sample of the malware with this capability. If this is true, it likely marks the first time we have such evidence of exploitation of BLE vulnerabilities.”
Smith explained at the time that there are two primary paths for exploiting these types of vulnerabilities: by directly targeting a device from close range via Bluetooth or by using a remotely compromised device that is in the target’s vicinity.
A Bluetooth attack can theoretically be launched from up to 330 feet in the case of the Owl Labs device, which could possibly be achieved in some scenarios from a parking lot or sidewalk near the building housing the targeted device. In the scenario involving a compromised device, it’s not easy to achieve.
“Attackers could use BLE enumeration apps or install command-line tools like hcitool or gatttool to dive deeper into BLE exploration, but these are not installed by default on most laptops or mobile devices. So, malware wanting to exploit BLE vulnerabilities in a remote device would need to include such capabilities or an attacker would need to write some code to use BLE APIs exposed on the compromised device. These vary across operating systems and architectures,” Smith explained.
Cisco Plugs Gaping Hole in Emergency Responder Software
A remotely exploitable vulnerability in the Cisco Emergency Responder software could allow an unauthenticated attacker to log in to an affected device using the root account, according to a warning from the U.S. tech vendor.
The vulnerability, tracked as CVE-2023-20101, carries a CVSS severity score of 9.8/10 and a “critical” tag from Cisco’s security response team.
“A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.”
“This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.”
Cisco said the security defect affects only Cisco Emergency Responder Release 12.5(1)SU4.
The San Jose, Calif. company is urging Cisco Emergency Responder users to immediately apply the available patches, warning that there are no workarounds that address this vulnerability.
Advertisement. Scroll to continue reading.
The Cisco Emergency Responder software works in tandem with the Cisco Unified Communications Manager to send emergency calls to the appropriate Public Safety Answering Point (PSAP) for a caller’s location.
Available in the US and Canadian markets, the software is used to route emergency calls to a local public-safety answering point (PSAP), alert personnel by email or phone of an emergency call to respond to locally, keep logs of all emergency calls and provide the PSAP with accurate geolocation of the caller in need.
Vulnerabilities in Supermicro BMCs could allow for unkillable server rootkits
Getty Images
If your organization uses servers that are equipped with baseboard management controllers from Supermicro, it may be time, once again, to patch seven high-severity vulnerabilities that attackers could exploit to gain control of them. And sorry, but the fixes must be installed manually.
Typically abbreviated as BMCs, baseboard management controllers are small chips that are soldered onto the motherboard of servers inside data centers. Administrators rely on these powerful controllers for various remote management capabilities, including installing updates, monitoring temperatures and setting fan speeds accordingly, and reflashing the UEFI system firmware that allows servers to load their operating systems during reboots. BMCs provide these capabilities and more, even when the servers they’re connected to are turned off.
Code execution inside the BMC? Yup
The potential for vulnerabilities in BMCs to be exploited and used to take control of servers hasn’t been lost on hackers. In 2021, hackers exploited a vulnerability in BMCs from HP Enterprise and installed a custom rootkit, researchers from Amnpardaz, a security firm in Iran, reported that year. ILObleed, as the researchers named the rootkit, hid inside the iLO, a module in HPE BMCs that’s short for Integrated Lights-Out.
ILObleed was programmed to destroy data stored on disk. If admins reinstalled the operating system, iLObleed would remain intact and reactivate the disk-wiping attack repeatedly. The unknown attackers responsible took control of the BMCs by exploiting a vulnerability HPE had fixed four years earlier. In June, the National Security Agency urged admins to follow guidance to prevent such incidents.
Researchers from security firm Binarly on Tuesday disclosed seven high-severity vulnerabilities in the IPMI (Intelligent Platform Management Interface) firmware for older Supermicro BMCs. Supermicro said in an advisory that the vulnerabilities affect “select X11, H11, B11, CMM, M11, and H12 motherboards.” The advisory also thanked Binarly and provided patching information. There’s no automated way to install the updates. Supermicro said it’s unaware of any malicious exploitation of the vulnerabilities in the wild.
One of the seven vulnerabilities, tracked as CVE-2023-40289, allows for the execution of malicious code inside the BMC, but there’s a catch: Exploiting the flaw requires already obtained administrative privileges in the web interface used to configure and control the BMCs. That’s where the remaining six vulnerabilities come in. All six of them allow cross-site scripting, or XSS, attacks on machines used by admins. The exploit scenario is to use one or more of them in combination with CVE-2023-40289.
In an email, Binarly founder and CEO Alex Matrosov wrote:
Exploiting this vulnerability requires already obtained administrative privileges in the BMC Web Interface. To achieve it, a potential attacker can utilize any of the XSS vulnerabilities we found. In such a case, the exploitation path will look like this potential scenario:
1. an attacker prepares a malicious link with the malicious payload 2. includes it in phishing emails (for example) 3. when this click is opened, the malicious payload will be executed inside BMC OS.
Admins can remotely communicate with Supermicro BMCs through various protocols, including SSH, IPMI, SNMP, WSMAN, and HTTP/HTTPS. The vulnerabilities Binarly discovered can be exploited using HTTP. While the NSA and many other security practitioners strongly urge that BMC interfaces be isolated from the Internet, there’s evidence that this advice is routinely ignored. A recent query to the Shodan search engine revealed more than 70,000 instances of Supermicro BMC that have their IPMI web interface publicly available.
The road map for exploiting the vulnerabilities against servers with Supermicro interfaces exposed this way is illustrated below:
Enlarge/ The road map for exploiting a BMC that has its web interface exposed to the Internet.
In Tuesday’s post, Binarly researchers wrote:
First, it is possible to remotely compromise the BMC system by exploiting vulnerabilities in the Web Server component exposed to the Internet. An attacker can then gain access to the Server’s operating system via legitimate iKVM remote control BMC functionality or by flashing the UEFI of the target system with malicious firmware that allows persistent control of the host OS. From there, nothing prevents an attacker from lateral movement within the internal network, compromising other internal hosts.
All the vulnerabilities Binarly discovered originate in IPMI firmware third-party developer ATEN developed for Supermicro. While ATEN patched CVE-2023-40289 six months ago, the fix never made its way into the firmware.
“This is a supply chain problem because it can be other BMC vendors that can be potentially impacted by these vulnerabilities,” Matrosov wrote.
https://arstechnica.com/?p=1973415
Apple Warns of Newly Exploited iOS 17 Kernel Zero-Day
Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.
The Cupertino device maker on Wednesday rushed out a new patch to cover a pair of serious vulnerabilities and warned that one of the issues has already been exploited as zero-day in the wild.
In a barebones advisory, Apple said the exploited CVE-2023-42824 kernel vulnerability allows a local attacker to elevate privileges, suggesting it was used in an exploit chain in observed attacks.
“Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6,” the company said without providing additional details.
This is the 16th documented in-the-wild zero-day against Apple’s iOS, iPadOS and macOS-powered devices, according to data tracked by SecurityWeek. The majority of these attacks have been attributed to mercenary spyware vendors selling surveillance products.
The newest iOS 17.0.3 and iPadOS 17.0.3 updates also cover a buffer overflow vulnerability in WebRTC that exposes mobile devices to arbitrary code execution attacks. The issue was addressed by updating to libvpx 1.13.1, Apple said.
Apple is encouraging oft-targeted users to enable Lockdown Mode to reduce exposure to mercenary spyware exploits.
