Atlassian Ships Urgent Patch for Exploited Confluence Zero-Day

Business software maker Atlassian on Wednesday called immediate attention to a major security defect in its Confluence Data Center and Server products and warned that the issue has already been exploited as zero-day in the wild.

An urgent advisory from Atlassian confirms that “a handful of customers” were hit by exploits targeting a remotely exploitable flaw in Confluence Data Center and Server instances.

“Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances,” the Australian company said.

The vulnerability, tracked as CVE-2023-22515, is described as a remotely exploitable privilege escalation issue affecting on-prem instances of Confluence Server and Confluence Data Center.

“Instances on the public internet are particularly at risk, as this vulnerability is exploitable anonymously,” Atlassian warned. “If an instance has already been compromised, upgrading will not remove the compromise.”

The company said Atlassian Cloud sites are not vulnerable to this issue.

Security vendor Rapid7 is underscoring the urgency for businesses to apply available patches and mitigations.

Advertisement. Scroll to continue reading.

“Atlassian’s advisory implies that the vulnerability is remotely exploitable, which is typically more consistent with an authentication bypass or remote code execution chain than a privilege escalation issue by itself,” Rapid7’s Caitlin Condon said.

Atlassian has published an FAQ urging business users to immediately check all affected Confluence instances for the following indicators of compromise:

Unexpected members of the confluence-administrator group
Unexpected newly created user accounts
Requests to /setup/*.action in network access logs
Presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory

“If it is determined that your instance has been compromised, our advice is to immediately shut down and disconnect the server from the network/Internet. Also, you may want to immediately shut down any other systems which potentially share a user base or have common username/password combinations with the compromised system,” Atlassian added.

Security problems in Atlassian’s software products have been targeted in the past by both cybercriminal and state-sponsored threat actors. In CISA’s KEV (Known Exploited Vulnerabilities) catalog, there are six distinct Confluence vulnerabilities marked for urgent attention.

https://www.securityweek.com/atlassian-ships-urgent-patch-for-exploited-confluence-zero-day/

New Supermicro BMC Vulnerabilities Could Expose Many Servers to Remote Attacks

Server and computer hardware giant Supermicro has released updates to address multiple vulnerabilities in Baseboard Management Controllers (BMC) IPMI firmware.

The issues (tracked as CVE-2023-40284 to CVE-2023-40290) could allow remote attackers to gain root access to the BMC system, firmware supply chain security firm Binarly, which identified the bugs, explains.

A special chip on server motherboards that support remote management, the BMC allows administrators to monitor various hardware variables and even update the UEFI system firmware. The BMC chips remain operational even if the system’s power is turned off.

The most severe of these bugs are three cross-site scripting (XSS) vulnerabilities in the BMC server frontend that could be exploited remotely, without authentication, to execute arbitrary JS code.

The flaws are tracked as CVE-2023-40284, CVE-2023-40287, and CVE-2023-40288 and, according to Supermicro’s advisory, have a CVSS score of 8.3.

“An attacker could send a phishing link that does not require login, tricking BMC administrators to click on that link while they are still logged in and thus authenticated by BMC Web UI,” Supermicro notes.

Binarly, however, considers these issues ‘critical severity’, with a CVSS score of 9.6. The security firm assumes that the attacker knows the BMC web server’s IP address and the administrator’s email address, which it uses to send a phishing email.

Advertisement. Scroll to continue reading.

CVE-2023-40289, which is described as a command injection bug in the BMC server backend, should also be considered critical severity, with a CVSS score of 9.1, Binarly says.

“The vulnerability is critical because it allows authenticated attackers to gain root access and completely compromise the BMC system. This privilege makes it possible to make the attack persistent even while the BMC component is rebooted and to move laterally within the compromised infrastructure, infecting other endpoints,” the security firm notes.

Supermicro, however, rates the issue with a CVSS score of 7.2, noting that it requires for the attacker to be logged into the BMC with administrator privileges.

Binarly also identified two XSS flaws (CVE-2023-40285 and CVE-2023-40286) in the Supermicro BMC IPMI firmware that could lead to the execution of malicious code every time a specific action is triggered. The complexity of the attack is low, with no circumstances preventing successful exploitation, Binarly says.

Both vulnerabilities can be exploited by sending phishing emails and tricking BMC administrators into clicking a link while they are still logged in to the BMC web UI.

CVE-2023-40290, another high-severity XSS flaw, can only be exploited using the Internet Explorer 11 browser on Windows.

According to Supermicro, the vulnerability impacts the BMC IPMI firmware of select B11, CMM, H11, H12, M11, and X11 motherboards.

The company says it is not aware of any malicious exploitation of these vulnerabilities.

Binarly’s research focused on the web server component due to it being the most accessible and most likely attack vector. The company has seen more than 70,000 instances of internet-exposed Supermicro IPMI web interfaces.

https://www.securityweek.com/new-supermicro-bmc-vulnerabilities-could-expose-many-servers-to-remote-attacks/

Severe Glibc Privilege Escalation Vulnerability Impacts Major Linux Distributions

Major Linux distributions such as Debian, Fedora, and Ubuntu are affected by a GNU C Library (glibc) vulnerability that could provide an attacker with full root privileges.

The C library present in GNU and most systems running the Linux kernel, glibc defines system calls and other functionality that a program typically requires.

The identified issue, named ‘Looney Tunables’ and tracked as CVE-2023-4911 (CVSS score of 7.8), impacts glibc’s dynamic loader, which is responsible for loading into memory the libraries that a program needs, linking them with the executable at runtime.

When performing these operations, the dynamic loader resolves symbol references, preparing everything for the program’s execution.

CVE-2023-4911 impacts the dynamic loader’s processing of GLIBC_TUNABLES environment variables (also referred to as ‘tunables’), which allow users to change the library’s behavior at runtime, by adjusting different parameters.

“The dynamic loader is extremely security sensitive, because its code runs with elevated privileges when a local user executes a set-user-ID program, a set-group-ID program, or a program with capabilities,” security firm Qualys, which identified the vulnerability, notes.

According to Qualys, the glibc dynamic loader’s processing of the tunables variables is susceptible to a buffer overflow that can be exploited to obtain full root privileges on an impacted system.

Advertisement. Scroll to continue reading.

The issue was introduced in April 2021, with the release of glibc 2.34, and has been successfully tested on Debian 12 and 13, Fedora 37 and 38, and Ubuntu 22.04 and 23.04. Other Linux distributions might be impacted as well, except for Alpine Linux, which uses musl libc, instead of glibc.

The issue resides in the way the dynamic loader’s processing function sanitizes tunables. Because the function removes all dangerous tunables but keeps specific ones, supplying a specifically crafted environment variable (in the form name=name=val) results in the tunable being processed twice, overflowing the buffer.

Because the vulnerability can lead to full root privileges and is relatively easy to exploit, Qualys is not sharing its proof-of-concept (PoC) code, although it has provided an extensive technical analysis.

“Our successful exploitation, leading to full root privileges on major distributions like Fedora, Ubuntu, and Debian, highlights this vulnerability’s severity and widespread nature. Although we are withholding our exploit code for now, the ease with which the buffer overflow can be transformed into a data-only attack implies that other research teams could soon produce and release exploits,” Qualys notes.

The vulnerability was resolved in upstream glibc, with Debian, Gentoo Linux, Red Hat, and Ubuntu already releasing patches as well.

https://www.securityweek.com/severe-glibc-privilege-escalation-vulnerability-impacts-major-linux-distributions/

Qualcomm Patches 3 Zero-Days Reported by Google

US chip giant Qualcomm this week announced patches for more than two dozen vulnerabilities found in its products, including three zero-days reported to the company by Google cybersecurity units.

Qualcomm learned from Google’s Threat Analysis Group and Google Project Zero that flaws tracked as CVE-2023-33106, CVE-2023-33107, CVE-2023-33063 and CVE-2022-22071 “may be under limited, targeted exploitation”.

However, only three of the flaws are zero-days as CVE-2022-22071 was patched by Qualcomm in May.

No information has been shared on the attacks exploiting these vulnerabilities, but the fact that they were reported by Google suggests that they may have been exploited by commercial spyware vendors.

Google has investigated several exploit chains attributed to spyware vendors in the past few years. Threat actors have been observed using such exploits to deliver spyware to devices running Android or iOS, both of which can include Qualcomm chips.

A vast majority of the remaining vulnerabilities for which patches were announced this week by Qualcomm have been assigned ‘critical’ and ‘high’ severity ratings, but they were discovered internally by the company.

Most of these security holes impact modems, WLAN firmware, and automotive products, and they have been described as memory bugs and information disclosure issues. Memory bugs can typically lead to arbitrary code execution or denial of service (DoS).

Advertisement. Scroll to continue reading.

Also this week, Google released Android security updates that patch two zero-days, including CVE-2023-4211, a bug in the Arm Mali GPU driver that is known to have been targeted in attacks delivering spyware.

https://www.securityweek.com/qualcomm-patches-3-zero-days-reported-by-google/

They’ve begun: Attacks exploiting vulnerability with maximum 10 severity rating

Ransomware hackers have started exploiting one or more recently fixed vulnerabilities that pose a grave threat to enterprise networks around the world, researchers said.

One of the vulnerabilities has a severity rating of 10 out of a possible 10 and another 9.9. They reside in WS_FTP Server, a file-sharing app made by Progress Software. Progress Software is the maker of MOVEit, another piece of file-transfer software that was recently hit by a critical zero-day vulnerability that has led to the compromise of more than 2,300 organizations and the data of more than 23 million people, according to security firm Emsisoft. Victims include Shell, British Airways, the US Department of Energy, and Ontario’s government birth registry, BORN Ontario, the latter of which led to the compromise of information for 3.4 million people.

About as bad as it gets

CVE-2023-40044, as the vulnerability in WS_FTP Server is tracked, and a separate vulnerability tracked as CVE-2023-42657 that was patched in the same October 27 update from Progress Software, are both about as critical as vulnerabilities come. With a severity rating of 10, CVE-2023-40044 allows attackers to execute malicious code with high system privileges with no authentication required. CVE-2023-42657, which has a severity rating of 9.9, also allows for remote code execution but requires the hacker to first be authenticated to the vulnerable system.

Last Friday, researchers from security firm Rapid7 delivered the first indication that at least one of these vulnerabilities might be under active exploitation in “multiple instances. On Monday, the researchers updated their post to note they had discovered a separate attack chain that also appeared to target the vulnerabilities. Shortly afterward, researchers from Huntress confirmed an “in-the-wild exploitation of CVE-2023-40044 in a very small number of cases within our partner base (single digits currently).” In an update Tuesday, Huntress said that on at least one hacked host, the threat actor added persistence mechanisms, meaning it was attempting to establish a permanent presence on the server.

Also on Tuesday came a post on Mastodon from Kevin Beaumont, a security researcher with extensive ties to organizations whose enterprise networks are under attack.

“An org hit by ransomware is telling me the threat actor got in via WS_FTP, for infos, so you might want to prioritize patching that,” he wrote. “The ransomware group targeting WS_FTP are targeting the web version.” He added advice for admins using the file transfer program to search for vulnerable entry points using the Shodan search tool.

A bit shocking

On the same day that Rapid7 first saw active exploits, someone published proof of concept exploit code on social media. In an emailed statement, Progress Software officials criticized such actions. They wrote:

We are disappointed in how quickly third parties released a proof of concept (POC), reverse-engineered from our vulnerability disclosure and patch, released on Sept. 27. This provided threat actors a roadmap on how to exploit the vulnerabilities while many of our customers were still in the process of applying the patch. We are not aware of any evidence that these vulnerabilities were being exploited prior to that release. Unfortunately, by building and releasing a POC rapidly after our patch was released, a third-party has given cyber criminals a tool to attempt attacks against our customers. We are encouraging all WS_FTP server customers to patch their environments as quickly as possible.

CVE-2023-40044 is what’s known as a deserialization vulnerability, a form of bug in code that allows user-submitted input to be converted into a structure of data known as an object. In programming, objects are variables, functions, or data structures that an app refers to. By essentially transforming untrusted user input into code of the attacker’s making, deserialization exploits have the potential to carry severe consequences. The deserialization vulnerability in WS_FTP Server is found in code written in the .NET programming language.

Researchers from security firm Assetnote discovered the vulnerability by decompiling and analyzing the WS_FTP Server code. They eventually identified a “sink,” which is code designed to receive incoming events, that was vulnerable to deserialization and worked their way back to the source.

“Ultimately, we discovered that the vulnerability could be triggered without any authentication, and it affected the entire Ad Hoc Transfer component of WS_FTP,” Assetnote researchers wrote Monday. “It was a bit shocking that we were able to reach the deserialization sink without any authentication.”

Besides requiring no authentication, the vulnerability can be exploited by sending a single HTTP request to a server, as long as there’s what’s known as a ysoserial gadget pre-existing.

The WS_FTP Server vulnerability may not pose as grave a threat to the Internet as a whole compared to the exploited vulnerability in MOVEit. One reason is that a fix for WS_FTP Server became publicly available before exploits began. That gave organizations using the file-transfer software time to patch their servers before they came under fire. Another reason: Internet scans find many fewer servers running WS_FTP Server as compared to MOVEit.

Still, the damage to networks that have yet to patch CVE-2023-40044 will likely be as severe as what was inflicted on unpatched MOVEit servers. Admins should prioritize patching, and if that’s not possible right away, disable server-ad hoc transfer mode. They should also analyze their environments for signs they’ve been hacked. Indicators of compromise include:

103[.]163[.]187[.]12:8080
64[.]227[.]126[.]135
86[.]48[.]3[.]172
103[.]163[.]187[.]12
161[.]35[.]27[.]144
162[.]243[.]161[.]105
C:\Windows\TEMP\zpvmRqTOsP.exe
C:\Windows\TEMP\ZzPtgYwodVf.exe

Other helpful security guidance is available here from security firm Tenable.

https://arstechnica.com/?p=1973010

Critical TorchServe Flaws Could Expose AI Infrastructure of Major Companies

A series of critical vulnerabilities impacting a tool called TorchServe could allow threat actors to take complete control of servers that are part of the artificial intelligence (AI) infrastructure of some of the world’s largest companies, according to a cybersecurity firm.

The flaws were discovered by Oligo, a company that specializes in runtime application security and observability, which disclosed its findings on Tuesday. The firm named the attack ShellTorch.

TorchServe is an open source package in PyTorch, a machine learning framework used for applications such as computer vision and natural language processing. PyTorch is currently part of the Linux Foundation and received significant contributions from Meta (its original developer) and AWS.

TorchServe is used by organizations around the world and has more than 30,000 PyPi downloads every month and over one million DockerHub pulls. It’s used by major companies such as Amazon, Google, Intel, Microsoft, Tesla and Walmart.

Oligo researchers discovered that TorchServe is affected by three vulnerabilities, including two that have been assigned a ‘critical severity’ rating based on their CVSS score.

One of the issues is actually a default misconfiguration that results in the TorchServe management interface being exposed to remote access without authentication.

The other two vulnerabilities can be exploited for remote code execution, through server-side request forgery (SSRF), tracked as CVE-2023-43654, and through unsafe deserialization, tracked as CVE-2022-1471. It’s worth noting that while Oligo has assigned both issues a ‘critical’ rating, PyTorch developers have assigned a ‘high severity’ rating to CVE-2023-43654.

Advertisement. Scroll to continue reading.

Using a simple IP scanner, the cybersecurity firm identified tens of thousands of instances that could be vulnerable to attacks, including many belonging to Fortune 500 companies.

“These vulnerabilities can completely compromise the AI infrastructure of the world’s biggest businesses,” Oligo warned.

The security firm explained that an attacker can exploit the vulnerabilities to gain initial access and execute malicious code on the targeted organization’s PyTorch server, and then move laterally within the network to even more sensitive systems.

“But lateral movement may not even be necessary: using ShellTorch, the attackers are already in the core of the AI infrastructure, allowing them to gain and leverage TorchServe’s high privileges in order to view, modify, steal, and delete AI models, which often contain a business’s core IP,” Oligo said.

“Making these vulnerabilities even more dangerous: when an attacker exploits the model serving server, they can access and alter sensitive data flowing in and out from the target TorchServe server, harming the trust and credibility of the application,” it added.

AWS has published an advisory informing customers that versions 0.3.0 through 0.8.1 are impacted and 0.8.2 patches the flaws. Oligo said Meta took steps to address the default misconfiguration that exposed servers.

“The issues in TorchServe – an optional tool for PyTorch – were patched in August rendering the exploit chain described in this blog post moot. We encourage developers to use the latest version of TorchServe,” a Meta spokesperson told SecurityWeek.

*updated to add CVE-2022-1471; add statement from Meta; reworded last paragraph to make it clear that version 0.8.2 patches all vulnerabilities

https://www.securityweek.com/critical-torchserve-flaws-could-expose-ai-infrastructure-of-major-companies/

Vulnerable Arm GPU drivers under active exploitation. Patches may not be available

Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit" — Getty Images

Arm warned on Monday of active ongoing attacks targeting a vulnerability in device drivers for its Mali line of GPUs, which run on a host of devices, including Google Pixels and other Android handsets, Chromebooks, and hardware running Linux.

“A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory,” Arm officials wrote in an advisory. “This issue is fixed in Bifrost, Valhall and Arm 5th Gen GPU Architecture Kernel Driver r43p0. There is evidence that this vulnerability may be under limited, targeted exploitation. Users are recommended to upgrade if they are impacted by this issue.”

The advisory continued: “A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.”

Getting access to system memory that’s no longer in use is a common mechanism for loading malicious code into a location an attacker can then execute. This code often allows them to exploit other vulnerabilities or to install malicious payloads for spying on the phone user. Attackers often gain local access to a mobile device by tricking users into downloading malicious applications from unofficial repositories. The advisory mentions drivers for the affected GPUs being vulnerable but makes no mention of microcode that runs inside the chips themselves.

The most prevalent platform affected by the vulnerability is Google’s line of Pixels, which are one of the only Android models to receive security updates on a timely basis. Google patched Pixels in its September update against the vulnerability, which is tracked as CVE-2023-4211. Google has also patched Chromebooks that use the vulnerable GPUs. Any device that shows a patch level of 2023-09-01 or later is immune to attacks that exploit the vulnerability. The device driver on patched devices will show as version r44p1 or r45p0.

CVE-2023-4211 is present in a range of Arm GPUs released over the past decade. The Arm chips affected are:

Midgard GPU Kernel Driver: All versions from r12p0 – r32p0
Bifrost GPU Kernel Driver: All versions from r0p0 – r42p0
Valhall GPU Kernel Driver: All versions from r19p0 – r42p0
Arm 5th Gen GPU Architecture Kernel Driver: All versions from r41p0 – r42p0

Devices believed to use the affected chips include the Google Pixel 7, Samsung S20 and S21, Motorola Edge 40, OnePlus Nord 2, Asus ROG Phone 6, Redmi Note 11, 12, Honor 70 Pro, RealMe GT, Xiaomi 12 Pro, Oppo Find X5 Pro, and Reno 8 Pro and some phones from Mediatek.

Arm also makes drivers for the affected chips available for Linux devices.

Little is currently known about the vulnerability, other than that Arm credited discovery of the active exploitations to Maddie Stone, a researcher in Google’s Project Zero team. Project Zero tracks vulnerabilities in widely used devices, particularly when they’re subjected to zero-day or n-day attacks, which refer to those targeting vulnerabilities for which there are no patches available or those that have very recently been patched.

Arm’s Monday advisory disclosed two additional vulnerabilities that have also received patches. CVE-2023-33200 and CVE-2023-34970 both allow a non-privileged user to exploit a race condition to perform improper GPU operations to access already freed memory.

All three vulnerabilities are exploitable by an attacker with local access to the device, which is typically achieved by tricking users into downloading applications from unofficial repositories.

It’s currently unknown what other platforms, if any, have patches available. Until this information can be tracked down, people should check with the manufacturer of their device. Sadly, many vulnerable Android devices receive patches months or even years after becoming available, if at all.

https://arstechnica.com/?p=1972619

Live Exploitation Underscores Urgency to Patch Critical WS-FTP Server Flaw

Just days after the release of patches for a critical pre-authentication flaw in Progress Software’s WS_FTP server product, security experts have detected active exploitation in the wild against multiple target environments.

Cybersecurity vendor Rapid7 raised the alarm over the weekend after it spotted instances of live exploitation of the WS_FTP vulnerability in various customer environments.

According to Caitlin Condon, head of vulnerability research at Rapid7, the easy-to-exploit CVE-2023-40044 vulnerability is already in the crosshairs of attackers attempting mass exploitation of vulnerable WS_FTP servers.

“The process execution chain looks the same across all observed instances, indicating possible mass exploitation of vulnerable WS_FTP servers. Additionally, our MDR team has observed the same Burp Suite domain used across all incidents, which may point to a single threat actor behind the activity we’ve seen,” Condon said.

The critical-severity flaw, which carries a CVSS score of 10/10, can be triggered by attackers over the internet and affects all WS_FTP Server versions prior to 8.7.4 and 8.8.2

Assetnote, the research outfit that discovered the issue, warns that the flaw affects the entire Ad Hoc Transfer component of WS_FTP. “It was a bit shocking that we were able to reach the deserialization sink without any authentication,” the company said in a note documenting the findings.

“The issue discovered in Progress WS_FTP was within a HTTP Module called MyFileUpload.UploadModule. This HTTP module is responsible for _all_ file uploads made within the AHT application. It was wild to see all file upload functionality being implemented inside a HTTP module, as our belief as engineers is that HTTP modules should not be responsible for file upload functionality (especially given that HTTP modules run on literally every request cycle),” Assetnote added.

Advertisement. Scroll to continue reading.

Assetnote said it found nearly 3,000 hosts on the internet that are running WS_FTP with an exposed web server and noted that most of the exposed assets belong to large enterprises, governments and educational institutions.

Progress Software’s security response team has found itself scrambling to respond to a wave of debilitating ransomware attacks that exploited zero-day flaws in its MOVEit managed file transfer software product.

Earlier this year, the company rushed out patches to cover at least three critical vulnerabilities and announced plans to release regular service packs with a “predictable, simple and transparent process for product and security fixes.”

Software vendors typically use a service pack to deliver a collection of updates, fixes, features or enhancements to an application. Service packs are delivered in the form of a single installable package.

https://www.securityweek.com/live-exploitation-underscores-urgency-to-patch-critical-ws-ftp-server-flaw/

Unpatched Exim Vulnerabilities Expose Many Mail Servers to Attacks

The existence of several unpatched vulnerabilities impacting Exim mail transfer agent (MTA) installations was disclosed last week, more than one year after they were initially reported to developers.

Trend Micro’s Zero Day Initiative (ZDI) learned about six Exim vulnerabilities last year and reported the findings to the MTA software’s developers in June 2022. However, Exim developers have only now started working on patches, with accusations being made by both sides.

Exim, a piece of software used to receive and relay emails, is present on hundreds of thousands of servers. Vulnerabilities affecting the software can be highly valuable to threat actors, which have been known to exploit Exim flaws in their attacks.

ZDI last week released six individual advisories describing the flaws, reported to the company by an anonymous researcher. The most serious of them, rated ‘critical’ and tracked as CVE-2023-42115, can be exploited by a remote, unauthenticated attacker to execute arbitrary code.

Three other flaws, classified as ‘high severity’ and tracked as CVE-2023-42116, CVE-2023-42117 and CVE-2023-42118, can also be exploited for remote code execution without authentication.

The remaining two issues have a lower severity rating and their exploitation can lead to information disclosure.

According to ZDI’s timeline, the vulnerabilities were reported to Exim developers in June 2022 and ZDI reached out for an update in late April 2023, with the bug reports being resent to Exim in May.

Advertisement. Scroll to continue reading.

ZDI made its advisories public on September 27 and a public discussion regarding the flaws was initiated late last week on the Openwall mailing list.

Exim is working on patches and says they should become available shortly, though there still seems to be some confusion within Exim on what exactly has been reported via ZDI. Developers claim the vulnerabilities can only be exploited if certain features are used.

Exim developers have complained that ZDI failed to provide needed clarifications between its initial report in June 2022 and May 2023.

Some have argued that it has still taken Exim developers a long time to start addressing the flaws, even if it only learned about them in May.

In response to the Exim team’s complaints, ZDI said, “The ZDI reached out multiple times to the developers regarding multiple bug reports with little progress to show for it. After our disclosure timeline was exceeded by many months, we notified the maintainer of our intent to publicly disclose these bugs, at which time we were told, ‘you do what you do’.”

https://www.securityweek.com/unpatched-exim-vulnerabilities-expose-many-mail-servers-to-attacks/

Recently Patched TeamCity Vulnerability Exploited to Hack Servers

In-the-wild exploitation of a critical vulnerability in JetBrains’ TeamCity continuous integration and continuous deployment (CI/CD) server started just days after the availability of a patch was announced.

The vulnerability, tracked as CVE-2023-42793, impacts the on-premises version of TeamCity and it allows an unauthenticated attacker with access to a targeted server to achieve remote code execution and gain administrative control of the system.

JetBrains announced the release of TeamCity 2023.05.4, which patches the flaw, on September 21.

Sonar, the code security firm whose researchers discovered the issue, released some limited information the same day, and published technical details roughly a week later after a proof-of-concept (PoC) exploit was made public.

Sonar warned in its initial blog post that in-the-wild exploitation would likely be observed soon due to how easily the flaw can be exploited.

Threat intelligence firm GreyNoise started seeing the first exploitation attempts on September 27, with a peak seen the following day. The company has seen attack attempts coming from 56 unique IP addresses as of October 1.

A different threat intelligence company, Prodaft, reported seeing “many popular ransomware groups” targeting CVE-2023-42793.

Advertisement. Scroll to continue reading.

The Shadowserver Foundation, a non-profit cybersecurity organization, has scanned the internet for vulnerable TeamCity servers and identified nearly 1,300 unique IPs, with the highest percentage located in the United States, followed by Germany, Russia and China.

Organizations using TeamCity should update their installation as soon as possible. For customers who cannot immediately install the update, JetBrains has provided a security patch plugin that can be used to mitigate the issue on servers running TeamCity 8.0 and later. TeamCity Cloud customers do not need to take any action.

https://www.securityweek.com/recently-patched-teamcity-vulnerability-exploited-to-hack-servers/