Exploit Code Published for Critical-Severity VMware Security Defect

Just days after shipping a major security update to correct vulnerabilities in its Aria Operations for Networks product line, VMWare is warning that exploit code has been published online.

In an updated advisory, the virtualization technology giant confirmed the public release of exploit code that provides a roadmap for hackers to bypass SSH authentication and gain access to the Aria Operations for Networks command line interface.

The exploit code and root-cause analysis, released by SinSinology researcher Sina Kheirkhah, documents the problem as a case where VMWare “forgot to regenerate” SSH keys.

He pointed to VMWare’s CVE-2023-34039 advisory (CVSS severity score of 9.8 out of 10) that describes the bug as a network authentication bypass and warns that the issue is being mischaracterized.

“Interestingly, VMware has named this issue “Networks Authentication Bypass”, but in my opinion, nothing is getting bypassed. There is SSH authentication in place; however, VMware forgot to regenerate the keys,” Kheirkha said.

“After reading both descriptions, I realized that this must be a hardcoded SSH key issue,” he said, noting that VMware’s Aria Operations for Networks had hardcoded its keys from version 6.0 to 6.10.

“The main challenge in exploiting this vulnerability is that each version of VMware’s Aria Operations for Networks has a unique SSH key. To create a fully functional exploit, I had to collect all the keys from different versions of this product,” he said.

Advertisement. Scroll to continue reading.

The release of exploit code for this flaw amplifies the urgency for network admins to apply the available patches from VMWare.

The VMware Aria Operations for Networks product, formerly vRealize Network Insight, is used by businesses to monitor, discover and analyze networks and applications to build secure network infrastructure across clouds.

VMware has struggled with security problems in the Aria Operations for Networks product, recently patching a gaping command injection flaw that was remotely exploited in the wild. The Aria Operations for Network product has also been tagged in the U.S. government’s CISA Known Exploited Vulnerabilities catalog.

https://www.securityweek.com/exploit-code-published-for-critical-severity-vmware-security-defect/

In Other News: Hacking Encrypted Linux Computers, Android Fuzzing, Skype Leaking IPs

SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar.

We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports.

Here are this week’s stories:

Quickly hitting Enter key to hack an encrypted Linux computer

Researchers at Pulse Security discovered that an attacker who has physical access to an encrypted Linux system can gain local root access to the computer — bypassing full-disk encryption — by quickly hitting Enter on the keyboard or using a special device to simulate the process. These types of attacks are not new.

High-severity vulnerability patched in Chrome

Advertisement. Scroll to continue reading.

A new Chrome 116 update patches a high-severity use-after-free vulnerability. These types of flaws can typically be combined with other bugs for sandbox escapes and remote code execution. The bug bounty for the vulnerability has yet to be determined by Google.

Google details Android fuzzing efforts

Google has published a blog post detailing its Android fuzzing efforts, including how it finds vulnerabilities, why it continues to invest in fuzzing, challenges, and how others can contribute.

Top-level domains and DNS issues

Cisco Talos has conducted research into top-level domain (TLDs) and DNS issues, highlighting potential risks related to the .kids TLD, ‘zombified’ DNS name issues related to various country TLDs, as well as problems with second-level TLDs.

Skype mobile app is leaking IP addresses

The Skype mobile application is leaking IP addresses, according to a report from 404 Media. A hacker can obtain a targeted user’s IP by sending them a link over Skype — the victim does not have to interact with the link. Microsoft has been notified, but the company is not rushing to patch it.

Rackspace says cost of ransomware attack remediation tops $10 million (so far)

After being hit by a ransomware attack in December 2022, cloud computing company Rackspace said in a recent earnings presentation that it has spent $10.8 million so far responding to the incident that impacted its hosted Exchange infrastructure, forcing it to sunset the offering. The company said it expects to continue to incur legal and other professional services costs in future periods.

University of Michigan cyberattack

The University of Michigan has been targeted in a cyberattack that resulted in significant disruptions to its systems, as well as internet outages. The university has not shared any information on the attack itself, citing an ongoing investigation.

CISA and FBI release QakBot infrastructure indicators of compromise (IOCs)

CISA and the FBI have released IoCs associated with the recently disrupted QakBot botnet infrastructure. The botnet was targeted as part of an international law enforcement operation that involved the distribution of a utility designed to automatically remove the malware from infected systems.

Classiscam cybercrime groups made millions by scamming users worldwide

Group-IB has a report on Classiscam, a scam operation that has allowed hundreds of cybercrime groups to make nearly $65 million by targeting individuals across 79 countries, tricking them into sending money for inexistent goods sold online. An automated scam-as-a-service program has made it easier for scammers to conduct their activities.

Malwarebytes laying off 100 employees

Cybersecurity firm Malwarebytes has laid off 100 employees as it prepares to separate its consumer- and enterprise-focused business units. Last year, the company terminated 14% of its staff (roughly 125 people).

https://www.securityweek.com/in-other-news-hacking-encrypted-linux-computers-android-fuzzing-skype-leaking-ips/

Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks

A vulnerability in several extensions for the All-in-One WP Migration plugin potentially exposes WordPress websites to attacks leading to sensitive information disclosure.

With more than five million installations and maintained by ServMask, All-in-One WP Migration is a highly popular plugin for moving websites that also provides several premium extensions for migrating to third-party platforms.

On Wednesday, WordPress security firm Patchstack shared details on a vulnerability impacting All-in-One WP Migration’s Box, Google Drive, OneDrive, and Dropbox extensions that could allow attackers to access sensitive information.

Tracked as CVE-2023-40004 and described as an unauthenticated access token manipulation issue, the bug could allow an unauthenticated attacker to tamper with the access token configuration of the affected extension.

“This access token manipulation could result in a potential sensitive information disclosure of migration to the attacker’s controlled third-party account or restore a malicious backup,” Patchstack says.

The flaw was identified in the init function of the affected extensions, which is “hooked to the WordPress’s admin_init hook”, which in turn can be triggered by an attacker, without authentication.

“Since there is no permission and nonce validation on the init function, an unauthenticated user is able to modify or delete the access token used on each of the affected extensions,” Patchstack explains.

Advertisement. Scroll to continue reading.

On July 18, the WordPress security firm reported the vulnerability to ServMask, which patched the bug in all impacted extensions by “adding permission and nonce validation on the init function”.

Users are advised to update to All-in-One WP Migration’s Box extension version 1.54, Google Drive extension version 2.80, OneDrive extension version 1.67, and Dropbox extension version 3.76, which were released at the end of July.

https://www.securityweek.com/vulnerability-in-wordpress-migration-plugin-exposes-websites-to-attacks/

Splunk Patches High-Severity Flaws in Enterprise, IT Service Intelligence

Splunk on Wednesday announced patches for multiple high-severity vulnerabilities in Splunk Enterprise and IT Service Intelligence, including flaws in third-party packages.

The most severe of the bugs resolved in Splunk Enterprise this month is CVE-2023-40595 (CVSS score of 8.8), which is described as a remote code execution issue exploitable using crafted queries.

“The exploit requires the use of the collect SPL command which writes a file within the Splunk Enterprise installation. The attacker can then use this file to submit a serialized payload that can result in execution of code within the payload,” Splunk explains in an a d visory.

Next in line is CVE-2023-40598, a command injection vulnerability impacting a legacy internal function, which could be exploited to execute arbitrary code.

“The vulnerability revolves around the currently-deprecated runshellscript command that scripted alert actions use. This command, along with external command lookups, lets an attacker use this vulnerability to inject and execute commands within a privileged context from the Splunk platform instance,” Splunk explains.

The latest Splunk Enterprise releases also resolve a cross-site scripting (XSS) flaw (CVE-2023-40592), an absolute path traversal bug leading to code execution (CVE-2023-40597), and a privilege escalation issue resulting from an insecure path reference in a DLL (CVE-2023-40596).

All vulnerabilities were addressed with the release of Splunk Enterprise versions 8.2.12, 9.0.6, and 9.1.1, which also patch two medium-severity denial-of-service (DoS) flaws.

Advertisement. Scroll to continue reading.

On Wednesday, Splunk also announced patches for an unauthenticated log injection bug (CVE-2023-4571, CVSS score of 8.6) in IT Service Intelligence.

The issue allows an attacker to inject ANSI escape codes into log files, resulting in malicious code being executed when the log file is read in a vulnerable terminal application.

While IT Service Intelligence is not directly impacted by the flaw, indirect impact results from the permissions the terminal application has, and from where and how the user reads the malicious log files.

Splunk patched the vulnerability in IT Service Intelligence versions 4.13.3 and 4.15.3.

The software company makes no mention of any of these vulnerabilities being exploited in attacks. Additional information on the bugs can be found on Splunk’s security advisories page.

The updates Splunk announced on Wednesday also resolve multiple high-severity issues in third-party packages used in Splunk Enterprise, IT Service Intelligence, and Universal Forwarder.

https://www.securityweek.com/splunk-patches-high-severity-flaws-in-enterprise-it-service-intelligence/

Recent Juniper Flaws Chained in Attacks Following PoC Exploit Publication

Threat actors have started exploiting four recently patched vulnerabilities in the J-Web component of Juniper Networks’ Junos OS after proof-of-concept (PoC) exploit code was published online.

The issues, tracked as CVE-2023-36844 through CVE-2023-36847, are medium-severity bugs that can be exploited to control environment variables remotely and to upload arbitrary files, without authentication.

Juniper Networks released patches for these vulnerabilities ten days ago, warning that an attacker could chain them to achieve remote code execution and rating the chained exploitation as ‘critical severity’.

The bugs, the networking appliances maker says, impact the SRX series firewalls and EX series switches running Junos OS versions prior to 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, and 23.2R1.

According to non-profit cybersecurity organization Shadowserver Foundation, exploitation of these vulnerabilities started on August 25, the same day that PoC exploit code was published.

“Since 25th August we are seeing exploitation attempts from multiple IPs for Juniper J-Web CVE-2023-36844 (& friends) targeting /webauth_operation.php endpoint. Same day an exploit POC was published. This involves combining lower severity CVEs to achieve pre-auth RCE,” Shadowserver says.

Shadowserver tracks roughly 8,200 instances of exposed J-Web interfaces, most of them located in Asia (5,170), followed by North America (1,292) and Europe (1,018). It has observed more than 3,300 events related to the exploitation of these flaws.

Advertisement. Scroll to continue reading.

The attacks appear to be related to the PoC exploit that attack surface management firm WatchTowr published on August 25 alongside a technical analysis of two of these vulnerabilities – namely CVE-2023-36846 and CVE-2023-36847.

Pointing out that the exploitation of these flaws is trivial, the cybersecurity firm urged administrators to update the affected firewalls and switches to the latest available firmware releases and to check the PHP log files on their appliances for specific error messages that could indicate intrusion attempts.

“Given the simplicity of exploitation, and the privileged position that JunOS devices hold in a network, we would not be surprised to see large-scale exploitation,” WatchTowr warned.

https://www.securityweek.com/recent-juniper-flaws-chained-in-attacks-following-poc-exploit-publication/

High-Severity Memory Corruption Vulnerabilities Patched in Firefox, Chrome

Mozilla and Google on Tuesday announced the release of stable updates for Firefox and Chrome to address several high-severity vulnerabilities, including memory corruption issues.

Mozilla released Firefox 117 with patches for 13 vulnerabilities, including seven rated ‘high severity’, four of which are described as memory corruption bugs affecting the browser’s IPC CanvasTranslator, IPC ColorPickerShownCallback, IPC FilePickerShownCallback, and JIT UpdateRegExpStatics components.

Reported by the same security researcher (known as sonakkbi) and tracked as CVE-2023-4573, CVE-2023-4574, and CVE-2023-4575 the first three flaws “could have led to a use-after-free causing a potentially exploitable crash,” Mozilla explains in its advisory.

Tracked as CVE-2023-4577, the fourth vulnerability could have led to a potentially exploitable crash as well.

Mozilla also patched a high-severity integer overflow (CVE-2023-4576) in the RecordedSourceSurfaceCreation component of Firefox for Windows, resulting in “a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape”.

Firefox 117 also addresses multiple high-severity memory safety bugs that are collectively tracked as CVE-2023-4584 and CVE-2023-4585 and which also impact Firefox ESR and Thunderbird.

The remaining six issues addressed with this browser release are medium- and low-severity vulnerabilities that could lead to site spoofing, sensitive information leaks, the download of files without a warning of their potential harm, a buffer overflow, or browser context not being cleared when closing a private window.

Advertisement. Scroll to continue reading.

On Tuesday, the browser maker also announced the release of Firefox ESR 115.2 with patches for 14 vulnerabilities, including 12 resolved in Firefox 117. Additionally, Mozilla released Firefox ESR 102.15 with patches for six vulnerabilities.

More information on these vulnerabilities can be found on Mozilla’s security advi sories page.

Google on Tuesday released its second weekly update for Chrome, now rolling out as version 116.0.5845.140 for macOS and Linux and as versions 116.0.5845.140/.141 for Windows.

The Chrome update resolves one vulnerability, tracked as CVE-2023-4572 and described as a use-after-free flaw in MediaStream. Such issues may often be exploited to escape Chrome’s sandbox and achieve remote code execution, if combined with other vulnerabilities.

Mozilla and Google make no mention of any of these flaws being exploited in attacks.

https://www.securityweek.com/high-severity-memory-corruption-vulnerabilities-patched-in-firefox-chrome/

VMware Patches Major Security Flaws in Network Monitoring Product

Virtualization technology giant VMware on Tuesday shipped a major security update to correct at least two critical vulnerabilities in its Aria Operations for Networks product line.

In a critical-severity advisory, VMware said the flaws could be exploited by malicious hackers to bypass SSH authentication and gain access to the Aria Operations for Networks command line interface.

VMware tagged the network authentication bypass issue as CVE-2023-34039 and applied a CVSS severity score of 9.8 out of 10.

“Aria Operations for Networks contains an authentication bypass vulnerability due to a lack of unique cryptographic key generation. VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.8,” the company said.

The VMware Aria Operations for Networks product, formerly vRealize Network Insight, is used by enterprises to monitor, discover and analyze networks and applications to build secure network infrastructure across clouds.

The company said the Aria Operations for Networks collectors are impacted by the vulnerability but advised customers that upgrading the platform appliance will remediate the issue.

VMware also shipped a patch for a second bug — CVE-2023-20890 — that allows an authenticated malicious actor with administrative access to VMware Aria Operations for Networks to write files to arbitrary locations.

Advertisement. Scroll to continue reading.

VMware has struggled with security problems in the Aria Operations for Networks product, recently patching a gaping command injection flaw that was remotely exploited in the wild.

The Aria Operations for Network product has been tagged in the U.S. government’s CISA Known Exploited Vulnerabilities catalog.

https://www.securityweek.com/vmware-patches-major-security-flaws-in-network-monitoring-product/

Cisco Patches Vulnerabilities Exposing Switches, Firewalls to DoS Attacks

Cisco on Wednesday announced patches for six vulnerabilities in its products, including three high-severity bugs in NX-OS and FXOS software that could be exploited to cause a denial-of-service (DoS) condition.

Impacting the FXOS software of Firepower 4100 and Firepower 9300 security appliances and of UCS 6300 series fabric interconnects, the most severe of these flaws is CVE-2023-20200, described as the improper handling of specific SNMP requests.

The issue allows an authenticated, remote attacker to send crafted SNMP requests to an affected device and cause it to reload, resulting in a DoS condition.

“This vulnerability affects all supported SNMP versions. To exploit this vulnerability through SNMPv2c or earlier, an attacker must know the SNMP community string that is configured on an affected device. To exploit this vulnerability through SNMPv3, the attacker must have valid credentials for an SNMP user who is configured on the affected device,” Cisco explains.

The second high-severity flaw, CVE-2023-20169, impacts the NX-OS software for Nexus 3000 and Nexus 9000 series switches in standalone NX-OS mode, and is described as an insufficient input validation in the Intermediate System-to-Intermediate System (IS-IS) protocol.

The bug allows an unauthenticated, Layer 2 adjacent attacker to send crafted IS-IS packets to an affected device, causing the IS-IS process to restart, which could cause the device to reload, leading to a DoS condition.

Cisco also patched a high-severity vulnerability in the TACACS+ and RADIUS remote authentication for NX-OS software. Tracked as CVE-2023-20168, the bug is described as an incorrect input validation issue that allows an unauthenticated, local attacker to enter a crafted string at login and cause a DoS condition.

Advertisement. Scroll to continue reading.

The flaw impacts multiple Nexus series switches, the MDS 9000 series switches, and the Nexus 1000 virtual edge for VMware vSphere, and can only be exploited over Telnet or over the console management connection.

The three vulnerabilities were resolved as part of Cisco’s August 2023 semiannual security advisory bundle, which also includes patches for two medium-severity bugs leading to file overwrites.

On Wednesday, Cisco also announced patches for a medium-severity issue in the Application Policy Infrastructure Controller (APIC), which “could allow an authenticated, remote attacker to read, modify, or delete non-tenant policies created by users associated with a different security domain on an affected system”.

The tech giant says it is not aware of any of these vulnerabilities being exploited in malicious attacks. Additional information can be found on Cisco’s product security page.

https://www.securityweek.com/cisco-patches-vulnerabilities-exposing-switches-firewalls-to-dos-attacks/

3,000 Openfire Servers Exposed to Attacks Targeting Recent Vulnerability

More than 3,000 Openfire servers have not been patched against a recent vulnerability and remain exposed to attacks relying on a new exploit, vulnerability intelligence firm VulnCheck reports.

Maintained by Ignite Realtime, Openfire is a cross-platform real time collaboration server written in Java that uses the XMPP protocol, and which supports administration via a web interface.

Tracked as CVE-2023-32315, the high-severity flaw was discovered in Openfire’s administration console and is described as a path traversal bug via the setup environment that allows unauthenticated attackers to access restricted pages in the admin console.

The issue exists because the path traversal protections in Openfire did not protect against ‘certain non-standard URL encoding for UTF-16 characters’ that were not supported by the webserver – support was added without updating the protections.

All Openfire iterations from version 3.10.0, which was released in April 2015, through versions 4.7.5 and 4.6.8, released in May 2023 to patch the vulnerability, are impacted.

The vulnerability has been exploited in malicious attacks for more than two months, with threat actors seen creating new admin console user accounts to install a new plugin containing a remote web shell, allowing them to execute arbitrary commands and access any data on the server.

Various public exploits targeting CVE-2023-32315 are already available, but all follow the same pattern. However, VulnCheck now says it has discovered a new exploit path that does not require creating the administrative user account.

Advertisement. Scroll to continue reading.

The threat intelligence firm says it has identified over 6,300 Openfire servers accessible from the internet, with roughly half of them being either patched against the vulnerability, older versions that are not vulnerable, or forks that might not be affected.

“This leaves approximately 50% of the internet-facing Openfire servers using affected versions. While that’s only a few thousand servers, it’s a decent number given the server’s trusted position associated with chat clients,” VulnCheck notes.

Because the security defect allows an unauthenticated attacker to access the plugin administration endpoint, the firm explains, the attacker can upload the plugin directly and then access the web shell, also without authentication.

“This approach keeps login attempts out of the security audit log and prevents the ‘uploaded plugin’ notification from being recorded. That’s a pretty big deal because it leaves no evidence in the security audit log,” VulnCheck explains.

While the malicious activity might be visible in the openfire.log file, the attacker can use the path traversal to delete the log via the web shell, thus leaving the plugin itself as the only indicator of compromise, the company warns.

“This vulnerability has already been exploited in the wild, likely even by a well-known botnet. With plenty of vulnerable internet-facing systems, we assume exploitation will continue into the future,” VulnCheck concludes.

https://www.securityweek.com/3000-openfire-servers-exposed-to-attacks-targeting-recent-vulnerability/

First Weekly Chrome Security Update Patches High-Severity Vulnerabilities

Google this week announced a Chrome 116 security update that patches five memory safety vulnerabilities reported by external researchers, including four issues rated ‘high severity’.

Based on the bug bounty reward Google paid out for these flaws, the most severe of them is CVE-2023-4430, a use-after-free bug in Vulkan, the cross-platform, open standard for 3D graphics.

The vulnerability was reported by Cassidy Kim, who received a $10,000 bug bounty reward for the finding, Google notes in its advisory.

Next in line is another use-after-free issue, this time in the Loader component. The flaw is tracked as CVE-2023-4429 and was reported by an anonymous researcher, who received a $3,000 bounty.

The internet giant says it also handed out a $2,000 reward for a high-severity out-of-bounds memory access vulnerability in CSS.

However, per Google’s policy, no bug bounty reward will be paid for a similar issue in the V8 JavaScript engine, which was reported by a Google Project Zero researcher, nor for a medium-severity out-of-bounds memory access flaw in Fonts, which was reported by a Microsoft security researcher.

The latest Chrome iteration is rolling out as version 116.0.5845.110 for Mac and Linux and as versions 116.0.5845.110/.111 for Windows.

Advertisement. Scroll to continue reading.

Google makes no mention of any of these vulnerabilities being exploited in attacks.

The update arrives one week after Chrome 116 was released in the stable channel, in line with Google’s previously laid out plans to deliver patches for new vulnerabilities faster than before.

While major Chrome iterations will continue to arrive every four weeks, stable security updates will be released weekly, to reduce the window for n-day exploits. Since 2020, the internet giant has been shipping stable updates every two weeks.

https://www.securityweek.com/first-weekly-chrome-security-update-patches-high-severity-vulnerabilities/