Thousands of servers running the Exim mail transfer agent are vulnerable to potential attacks that exploit critical vulnerabilities, allowing remote execution of malicious code with little or no user interaction.

The vulnerabilities were reported on Wednesday by Zero Day Initiative, but they largely escaped notice until Friday when they surfaced in a security mail list. Four of the six bugs allow for remote code execution and carry severity ratings of 7.5 to 9.8 out of a possible 10. Exim said it has made patches for three of the vulnerabilities available in a private repository. The status of patches for the remaining three vulnerabilities—two of which allow for RCE—are unknown. Exim is an open source mail transfer agent that is used by as many as 253,000 servers on the Internet.

“Sloppy handling” on both sides

ZDI provided no indication that Exim has published patches for any of the vulnerabilities, and at the time this post went live on Ars, the Exim website made no mention of any of the vulnerabilities or patches. On the OSS-Sec mail list on Friday, an Exim project team member said that fixes for two of the most severe vulnerabilities and a third, less severe one are available in a “protected repository and are ready to be applied by the distribution maintainers.”

There were no more details about the fixes, precisely how admins obtain them, or if there are mitigations available for those who can’t patch right away. Exim project team members didn’t respond to an email asking for additional information.

The most severe of the vulnerabilities, tracked as CVE-2023-42115, is among those that the Exim team member said have been patched. ZDI described it as an out-of-bounds flaw in an Exim component that handles authentication.

“This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim,” Wednesday’s advisory stated. “Authentication is not required to exploit this vulnerability.”

Another patched vulnerability, tracked as CVE-2023-42116, is a stack-based overflow in the Exim challenge component. Its severity rating is 8.1 and also allows for RCE.

“The specific flaw exists within the handling of NTLM challenge requests,” ZDI said. “The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”

The third fixed vulnerability is tracked as CVE-2023-42114, which allows for disclosure of sensitive information. It carries a rating of 3.7.

Some critics have called out the Exim project for not transparently disclosing the vulnerabilities. Adding more fuel to the critiques, the ZDI disclosures provided a timeline that indicated company representatives notified Exim project members of the vulnerabilities in June 2022. A handful of back-and-forth interactions occurred over the intervening months until ZDI disclosed them Wednesday.

In a post on Friday to the OSS-Sec mail list, Exim project team member Heiko Schlittermann said that after receiving the private ZDI report in June 2022, team members asked for additional details “but didn’t get answers we were able to work with.” The next contact didn’t occur until May 2023. “Right after this contact we created project bug tracker for 3 of the 6 issues,” Schlittermann said. “The remaining issues are debatable or miss information we need to fix them.”

Some people participating in the discussion criticized both sides.

“This looks like sloppy handling of these issues so far by both ZDI and Exim—neither team pinging the other for 10 months, then Exim taking 4 months to fix even the 2 high-scored issues it did have sufficient info on,” the distinguished security researcher known as Solar Designer wrote. “What are you doing to improve the handling from this point on?”

The critic also asked Schlittermann when OS distributions will be permitted to make the Exim updates public since the fixes are currently in a protected repository. “I suggest that you set a specific date/time e.g. in 2 days from now when both the Exim project will make the repo and the fixed bug entries … public _and_ distros will release updates.”

No one from Exim responded to those questions or, as mentioned earlier, to questions Ars sent by email shortly afterward.

With only a limited number of details becoming available so late on a Friday, patching and potential mitigations may not be as straightforward as some admins might hope. Despite any potential hardships, the vulnerabilities sound serious. In 2020, the National Security Agency reported that hackers in Sandworm, an elite threat actor backed by the Kremlin, had been exploiting a critical Exim vulnerability to compromise networks belonging to the US government and its partners. Now that new Exim vulnerabilities have come to light, it wouldn’t be surprising if threat actors hope to capitalize on them. https://arstechnica.com/?p=1972409

US cybersecurity agency CISA is warning organizations that an old vulnerability affecting JBoss RichFaces has been exploited in attacks.

The flaw, tracked as CVE-2018-14667, was added by CISA on Thursday to its Known Exploited Vulnerabilities (KEV) Catalog, with federal agencies being instructed to apply mitigations or discontinue the use of the product by October 19. 

RichFaces is a Red Hat JBoss project that provides an advanced UI component framework for easily integrating Ajax capabilities into business applications using JSF. The project officially reached end-of-life in June 2016.

CVE-2018-14667 was discovered in 2018, when Red Hat confirmed that several of its products were impacted and released patches. 

The vulnerability, rated ‘critical’, has been described as an expression language injection issue that allows a remote, unauthenticated attacker to execute arbitrary code.

While proof-of-concept (PoC) exploits and tools designed to exploit the flaw have been around for years, there do not appear to be any public reports describing actual exploitation in the wild. However, CISA only adds vulnerabilities to its KEV catalog if it has reliable evidence of exploitation. 

Since no information has been shared on the attacks exploiting CVE-2018-14667, it’s unclear if CISA is aware of active exploitation or if it recently became aware of old attacks. 

Related: CISA Says Owl Labs Vulnerabilities Requiring Close Physical Range Exploited in Attacks

Related: Faster Patching Pace Validates CISA’s KEV Catalog Initiative

Related: CISA Warns of Another Exploited Adobe ColdFusion Vulnerability

https://www.securityweek.com/cisa-warns-of-old-jboss-richfaces-vulnerability-being-exploited-in-attacks/

A high-severity remote code execution (RCE) vulnerability in Apache NiFi, for which an exploitation tool already exists, can lead to unauthorized access and data breaches, cybersecurity firm Cyfirma warns.

An open-source data integration and automation tool, Apache NiFi is used for the processing and distribution of data.

Tracked as CVE-2023-34468 (CVSS score of 8.8) and addressed in June 2023, the issue can be exploited by authenticated users to “configure a database URL with the H2 driver that enables custom code execution”.

The issue exists because certain NiFi services support configurable access to databases using JDBC and because any string could be introduced when setting properties such as the connection URL.

This essentially allows an attacker to craft connection strings for H2 – an embedded Java-based database typically used in Apache NiFi – to execute code remotely on vulnerable NiFi instances and gain unauthorized access to systems and data.

“The impact of this vulnerability is severe, as it grants attackers the ability to gain unauthorized access to systems, exfiltrate sensitive data, and execute malicious code remotely,” Cyfirma notes in an analysis of the bug and its exploitation.

The bug impacts NiFi versions 0.0.2 through 1.21.0 and was addressed with the release of NiFi version 1.22.0, which “disables H2 JDBC URLs in the default configuration”.

As of August 30, a public exploit exists for this vulnerability, but no malicious exploitation of the flaw has been observed to date, Cyfirma notes.

However, considering the severity and impact of the bug, and the fact that vulnerabilities in similar software products are known to have been exploited in malicious attacks, organizations are advised to update their NiFi instances and remain vigilant of potential exploitation attempts.

“It is important to acknowledge that threat actors may attempt to exploit CVE-2023-34468 in Apache NiFi. This could lead to unauthorized access, data breaches, or network compromise. Organizations should take this risk seriously and apply patches or updates to secure their systems,” Cyfirma notes.

In fact, Cyfirma notes that it has observed cyber actors “actively discussing or exploiting CVE-2023-34468” on the dark web and that the attack complexity level for this bug is low.

The cybersecurity firm has identified roughly 2,700 Apache NiFi instances exposed to the internet, belonging to organizations in various sectors, including finance, government, healthcare, telecommunications, and others.

Related: Azure HDInsight Flaws Allowed Data Access, Session Hijacking, Payload Delivery

Related: OpenMeetings Flaws Allow Hackers to Hijack Instances, Execute Code on Servers

Related: Organizations Warned of Security Risk in Default Apache Superset Configurations

https://www.securityweek.com/hackers-set-sights-on-apache-nifi-flaw-that-exposes-many-organizations-to-attacks/

Gaps in Cloudflare’s security controls allow users to bypass customer-configured protection mechanisms and target other users from the platform itself, technology consulting firm Certitude warns.

The issue, the company says, arises from the shared infrastructure that all Cloudflare tenants have access to, allowing malicious actors to abuse the trust customers place in the platform’s protections to target them via Cloudflare.

A major cybersecurity vendor offering web application firewall (WAF), bot management, and distributed denial-of-service (DDoS) protections, Cloudflare relies on a network of reverse-proxy servers to inspect all traffic headed to customers’ web servers for malicious activity.

According to Certitude, because traffic originating from Cloudflare’s own infrastructure is considered trusted by default, it is not passed through the configured reverse-proxy servers, as is traffic from other parties.

Because of that, the consulting firm says, an attacker registered with Cloudflare can target other users on the platform, essentially bypassing the platform’s protections.

One gap Certitude discovered is related to the ‘Authenticated Origin Pulls’ on Transport Layer mechanism, which relies on a Cloudflare SSL certificate for authentication.

When setting up the authentication mechanism to their web servers (origin servers), customers can opt for using a Cloudflare certificate or for using their own certificate.

However, because the available options are insufficiently documented, and because a custom certificate can only be used with an API, “it is reasonable to assume that customers will opt for the more convenient choice of using the Cloudflare certificate,” Certitude notes.

The use of a shared certificate means that all connections originating from Cloudflare are permitted, regardless of the tenant initiating them.

A similar gap was identified in the ‘Allowlist Cloudflare IP addresses’ on Network Layer mechanism, which blocks connections originating from outside Cloudflare’s IP ranges, but permits all connections from within Cloudflare’s infrastructure.

“An attacker can establish a custom domain with Cloudflare, direct the DNS A record to the victims IP address. Next, they disable all protection features for that custom domain and route their attack(s) through Cloudflare’s infrastructure, effectively bypassing the protection features that the victim has configured,” Certitude explains.

The consulting firm has published a proof-of-concept (PoC) demonstration of these issues and recommends the use of custom certificates for connection authentication and the use of Cloudflare Aegis to mitigate the gaps.

Certitude says it reported the issues through Cloudflare’s bug bounty program in March, and that its report was marked as ‘informative’ and closed without a fix. A Cloudflare spokesperson has yet to respond to SecurityWeek’s request for a statement.

Related: Threat Actors Abuse Cloudflare Tunnel for Persistent Access, Data Theft

Related: Cloudflare Unveils New Secrets Management Solution

Related: Record-Breaking 71 Million RPS DDoS Attack Seen by Cloudflare

https://www.securityweek.com/cloudflare-users-exposed-to-attacks-launched-from-within-cloudflare-researchers/

Enterprise technology vendor Progress Software on Thursday shipped patches for critical-level security flaws in its WS_FTP file transfer software, warning that a pre-authenticated attacker could wreak havoc on the underlying operating system.

An urgent bulletin from the Burlington, Mass. company documented at least eight security defects that could be exploited remotely and urged business customers to immediately upgrade to WS_FTP Server 2020.0.4 (8.7.4) and WS_FTP Server 2022.0.2 (8.8.2).

Progress Software said two of the vulnerabilities —  CVE-2023-40044 and CVE-2023-40045 — are rated critical because of the risk of pre-auth remote command execution attacks.

From the Progress Software bulletin:

• CVE-2023-40044 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system. Critical — CVSS: 10/10.
• CVE-2023-42657 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path.  Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system. Critical — CVSS: 9.9/10.

The company also called attention to a trio of high-severity bugs that could lead to reflected cross-site scripting (XSS) and SQL injection attacks.

Progress Software’s security response team has found itself scrambling to respond to a wave of debilitating ransomware attacks that exploited zero-day flaws in its MOVEit managed file transfer software produyt.

Earlier this year, the company rushed out patches to cover at least three critical vulnerabilities and announced plans to release regular service packs with a “predictable, simple and transparent process for product and security fixes.”

“We have heard from you that a regular cadence and predictable timeline will enable you to better plan your resources and make it easier to adopt new product updates and fixes. As a part of these Service Packs, we will also be optimizing the installation process to make the upgrade process simpler,” Progress said in a note posted with the first service pack.

Software vendors typically use a service pack to deliver a collection of updates, fixes, features or enhancements to an application.  Service packs are delivered in the form of a single installable package.

Related: Nearly 1,000 Org, 60M Individuals Impacted by MOVEit Hack

Related: MOVEit Customers Urged to Patch 3rd Critical Vulnerability

Related: Ransomware Group Naming Victims of MOVEit Zero-Days

Related: After Zero-Days, MOVEit Turns to Security Service Packs

https://www.securityweek.com/progress-software-patches-critical-pre-auth-flaws-in-ws_ftp-server-product/

Cisco this week announced patches for multiple vulnerabilities impacting its products, including a medium-severity flaw in IOS and IOS XE software that appears to have been exploited in attacks.

Tracked as CVE-2023-20109, the bug impacts the Group Encrypted Transport VPN (GET VPN) feature of IOS and IOS XE and can lead to remote code execution. Successful exploitation of the flaw requires that the attacker has valid credentials and administrative control over a group member or a key server.

“This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker,” Cisco notes in its advisory.

All Cisco products running a vulnerable IOS or IOS XE release with the GDOI or G-IKEv2 protocol enabled are impacted by this issue. There are no workarounds available for this bug and Cisco recommends that all customers update to a patched IOS or IOS XE release.

The tech giant also notes that it has observed exploitation attempts targeting this vulnerability.

“Cisco discovered attempted exploitation of the GET VPN feature and conducted a technical code review of the feature. This vulnerability was discovered during our internal investigation,” the company notes.

This week, Cisco also released patches for multiple flaws in the Catalyst SD-WAN Manager product, including a critical-severity bug (CVE-2023-20252, CVSS score of 9.8) in the SAML APIs that could allow an unauthenticated attacker to gain unauthorized access to the application as an arbitrary user.

The vulnerability was resolved along with four high-severity bugs that could be exploited to bypass authorization and roll back controller configurations, access a system’s Elasticsearch database, access another tenant managed on the same instance, or cause a denial-of-service (DoS) condition.

Multiple other high-severity issues leading to code execution, DoS, data access and tampering, and file exfiltration were addressed with software updates for IOS, IOS XE, and Cisco DNA Center. The tech giant also patched several other medium-severity issues impacting its products.

Cisco says that, aside from CVE-2023-20109, it is not aware of any of these vulnerabilities being exploited in attacks. Additional information can be found on Cisco’s security advisories page.

Related: Cisco ASA Zero-Day Exploited in Akira Ransomware Attacks

Related: Cisco Patches Critical Vulnerability in BroadWorks Platform

Related: Cisco Patches Vulnerabilities Exposing Switches, Firewalls to DoS Attacks

https://www.securityweek.com/cisco-warns-of-ios-software-zero-day-exploitation-attempts/

Google has rushed to patch another Chrome zero-day vulnerability exploited by a commercial spyware vendor. 

The internet giant announced on Tuesday that the stable channel of Chrome for Windows, macOS and Linux has been updated to version 117.0.5938.132.

The latest update patches 10 vulnerabilities, three of which have been highlighted by the company in its advisory.

The most important vulnerability, tracked as CVE-2023-5217, has been described as a “heap buffer overflow in vp8 encoding in libvpx”. The issue was reported to the Chrome team by Clement Lecigne of Google’s Threat Analysis Group (TAG) just two days before the patch was released.

Google warned that CVE-2023-5217 has been exploited in the wild.

While the advisory does not provide any information on the attacks exploiting the zero-day, Google TAG researcher Maddie Stone revealed that it has been leveraged by a commercial surveillance vendor. 

The news comes shortly after Google TAG and the University of Toronto’s Citizen Lab group released details on an operation whose goal was to deliver a piece of spyware known as Predator to an opposition politician in Egypt. 

An analysis showed that the threat actor has used various zero-days and man-in-the-middle (MitM) attacks to deliver spyware to both Android and iOS devices. 

CVE-2023-5217 is the sixth Chrome zero-day patched by Google in 2023, after CVE-2023-4762, CVE-2023-4863, CVE-2023-3079, CVE-2023-2033, and CVE-2023-2136. 

The latest Chrome update also patches CVE-2023-5186 and CVE-2023-5187, two high-severity use-after-free bugs in the Passwords and Extensions components.

Related: Federal Agencies Instructed to Patch New Chrome Zero-Day

Related: Exploitation of Recent Chrome Zero-Day Linked to Israeli Spyware Company

Related: Google Attempts to Explain Surge in Chrome Zero-Day Exploitation

https://www.securityweek.com/google-rushes-to-patch-new-zero-day-exploited-by-spyware-vendor/

Mozilla on Tuesday announced security updates for both Firefox and Thunderbird, addressing a total of nine vulnerabilities in its products, including high-severity flaws.

Firefox 118 was released to the stable channel with patches for all nine vulnerabilities – all are  memory issues, most of which could lead to exploitable crashes.

Tracked as CVE-2023-5168 and CVE-2023-5169, the first two high-severity flaws are described as out-of-bounds write issues in the browser’s FilterNodeD2D1 and PathOps components. According to Mozilla, both could lead to “a potentially exploitable crash in a privileged process”.

The third bug, CVE-2023-5170, is a memory leak issue that “could be used to effect a sandbox escape if the correct data was leaked”, Mozilla explains in its advisory.

Another high-severity vulnerability was patched in the Ion compiler. Tracked as CVE-2023-5171 and described as a use-after-free condition, the bug allowed an attacker to write two NUL bytes, causing a potentially exploitable crash.

Firefox 118 also patches CVE-2023-5172, a memory corruption in Ion Hints that could lead to a use-after-free condition and a potentially exploitable crash.

The browser update also resolves multiple high-severity memory safety bugs that are collectively tracked as CVE-2023-5176. According to Mozilla, “with enough effort”, an attacker could exploit some of these flaws to execute arbitrary code.

The three remaining issues patched with the release of Firefox 118 are medium- and low-severity memory bugs.

On Tuesday, Mozilla announced the release of Firefox ESR 115.3 and Thunderbird 115.3 with patches for five vulnerabilities each. These include four of the high-severity flaws and one medium-severity bug that Firefox 118 addresses.

Mozilla makes no mention of any of these vulnerabilities being exploited in malicious attacks. Additional details can be found on Mozilla’s security advisories page.

Related: High-Severity Memory Corruption Vulnerabilities Patched in Firefox, Chrome

Related: Firefox 116 Patches High-Severity Vulnerabilities

Related: Firefox 115 Patches High-Severity Use-After-Free Vulnerabilities

https://www.securityweek.com/firefox-118-patches-high-severity-vulnerabilities/

Apple on Tuesday announced the release of macOS 14 Sonoma. A security advisory published by the tech giant shows that the latest version of the operating system patches more than 60 vulnerabilities.

The flaws can be exploited to obtain potentially sensitive information (location, calendar, contacts, photos, credentials), execute arbitrary code with elevated privileges, escape the sandbox, read arbitrary files, cause a denial-of-service (DoS) condition, escalate privileges, bypass security mechanisms, delete files, modify protected parts of the file system, and conduct UI spoofing.

While some of these vulnerabilities can be exploited remotely by getting the targeted user to access a specially crafted website, a majority require the presence of a malicious app on the targeted device. 

A few of these vulnerabilities were first patched with previous updates, including CVE-2023-41993, which has been exploited as a zero-day to deliver spyware to iPhones. 

Apple also released an iOS 17 update on Tuesday, but said it does not patch any security flaws. 

The company has updated its September 21 advisory for iOS 16.7 and iPadOS 16.7 to inform users that these versions patch an additional 17 vulnerabilities. 

macOS Sonoma 14, which brings several new features and enhancements, is available for Mac Studio, iMac, Mac Pro, Mac mini, MacBook Air, MacBook Pro, and iMac Pro devices.

Related: Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones

Related: Apple Ships Urgent iOS Patch for WebKit Zero-Day

Related: Apple Releases First-Ever Security Updates for Beats, AirPods Headphones

https://www.securityweek.com/macos-14-sonoma-patches-60-vulnerabilities/

A critical vulnerability in the TeamCity CI/CD server could be exploited remotely, without authentication, to execute arbitrary code and gain administrative control over a vulnerable server.

Developed by JetBrains, TeamCity is a general-purpose build management and continuous integration platform available both for on-premises installation and as a cloud service.

The recently identified critical flaw, tracked as CVE-2023-42793 (CVSS score of 9.8), is described as an authentication bypass impacting the on-premises version of TeamCity.

The issue can be exploited by attackers over an HTTP(S) connection and does not require user interaction for successful exploitation, code security firm Sonar Source, which identified the bug, explains.

“This enables attackers not only to steal source code but also stored service secrets and private keys. And it’s even worse: With access to the build process, attackers can inject malicious code, compromising the integrity of software releases and impacting all downstream users,” Sonar notes.

This, Sonar says, is possible because CI/CD servers such as TeamCity automate the software development process, meaning that they have access to an organization’s source code and other sensitive information associated with the building, testing, and deployment processes.

According to JetBrains, all TeamCity on-premises instances up to and including version 2023.05.3 are impacted by this vulnerability. TeamCity cloud is not affected by the vulnerability.

The bug was addressed in TeamCity version 2023.05.4. JetBrains also released a security patch plugin for TeamCity versions 8.0 and above, but says it is not considering to backport the fix.

“The security patch plugin will only address the RCE vulnerability described above. We always recommend users upgrade their servers to the latest version to benefit from many other security updates,” JetBrains explains.

TeamCity servers that are accessible from the internet should be patched immediately or made inaccessible until the patch is installed.

Both JetBrains and Sonar say that technical details on the vulnerability are not being published for now. According to Sonar, the bug is trivial to exploit and it is likely that in-the-wild exploitation will be observed.

Related: CISA Offering Free Vulnerability Scanning Service to Water Utilities

Related: SAP Patches Critical Vulnerability in PowerDesigner Product

Related: Fortinet Patches Critical FortiOS Vulnerability Leading to Remote Code Execution

https://www.securityweek.com/in-the-wild-exploitation-expected-for-critical-teamcity-flaw-allowing-server-takeover/