Atlassian Patches Remote Code Execution Vulnerabilities in Confluence, Bamboo

Atlassian has released patches for two remote code execution (RCE) vulnerabilities in Confluence Data Center and Server and another in Bamboo Data Center.

The most severe of these issues, tracked as CVE-2023-22508 (CVSS score of 8.5), was introduced in Confluence version 7.4.0. The second bug, tracked as CVE-2023-22505 (CVSS score of 8.0), was introduced in Confluence version 8.0.0.

Exploitation of both vulnerabilities could allow an attacker to execute arbitrary code with impact on confidentiality, integrity, and availability. No user interaction is required for exploitation, but the attacker needs to be authenticated as a valid user.

Both flaws were addressed with the release of Confluence versions 8.3.2 and 8.4.0. Customers unable to upgrade to one of these versions should at least update to version 8.2.0, which patches CVE-2023-22508.

According to Atlassian, both vulnerabilities were discovered by private users and reported via the company’s bug bounty program.

The company also announced patches for CVE-2023-22506 (CVSS score of 7.5), a high-severity RCE bug in Bamboo Data Center. Introduced in version 8.0.0 of Bamboo, the vulnerability was addressed in versions 9.2.3 and 9.3.1 of the enterprise solution.

“This injection and RCE vulnerability allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction,” Atlassian explains.

Advertisement. Scroll to continue reading.

Atlassian notes in its advisory that the newly discovered flaws are the result of an expanded scope of its vulnerability disclosure policies, previously focused on first-party, critical-severity bugs.

“While this change results in an increase of visibility and disclosures, it does not mean there are more vulnerabilities. Rather, that we are taking a more proactive approach to vulnerability transparency and are committed to providing our customers with the information they need to make informed decisions about updating our products,” the company says.

Users and administrators are encouraged to apply the available patches as soon as possible. Successful exploitation of these bugs could lead to system takeover, the US Cybersecurity and Infrastructure Security Agency (CISA) notes.

Atlassian makes no mention of any of these issues being exploited in attacks.

https://www.securityweek.com/atlassian-patches-remote-code-execution-vulnerabilities-in-confluence-bamboo/

Perimeter81 Vulnerability Disclosed After Botched Disclosure Process

Network security company Perimeter81 apparently needs to improve its responsible disclosure process for vulnerabilities found in its products.

Cybersecurity researcher Erhad Husovic published a blog post in late June to disclose the details of a local privilege escalation vulnerability discovered in Perimeter81’s macOS application.

The researcher said the privilege escalation exploit leverages a misconfigured XPC service along with a command injection vulnerability. Exploitation allows an attacker to execute arbitrary commands with root privileges.

Husovic said at the time that he had first reported his findings to Perimeter81 in mid-March. The vendor was then contacted four more times, but the researcher claimed he only received one response saying that the issue was ‘wrongly sidetracked’.

The security hole was then reported by the researcher to the Vulnerability Information and Coordination Environment (VINCE) at the CERT Coordination Center (CERT/CC) at Carnegie Mellon University.

CERT/CC published its own advisory for the vulnerability, which is tracked as CVE-2023-33298, after failing to get a response from the vendor.

“At the time, the latest Perimeter81 MacOS application (10.0.0.19) suffers from local privilege escalation vulnerability inside its com.perimeter81.osx.HelperTool. This HelperTool allows main application to setup things which require administrative privileges such as VPN connection, changing routing table, etc,” CERT/CC said in its advisory.

Advertisement. Scroll to continue reading.

It added, “By combining insufficient checks of an XPC connection and creating a dictionary with the key ‘usingCAPath’ a command can be appended within that value to be run with administrative privileges.”

The researcher decided to disclose the vulnerability, along with a proof-of-concept (PoC) exploit, more than three months after the initial disclosure. The flaw does not appear to have been patched.

SecurityWeek reached out to Perimeter81 for comment several days before this article was published, but received no response.

The flaw does not seem critical as its exploitation requires access to the targeted system. However, it shows that even cybersecurity companies can botch the vulnerability disclosure process.

https://www.securityweek.com/perimeter81-vulnerability-disclosed-after-botched-disclosure-process/

OpenMeetings Flaws Allow Hackers to Hijack Instances, Execute Code on Servers

Three vulnerabilities in Apache OpenMeetings potentially expose organizations to remote code execution attacks, cybersecurity firm Sonar warns.

A web conferencing application, OpenMeetings is used for online meetings, collaboration, and presentations, either as standalone software or as a plugin for Confluence, Jira, and other applications.

On Thursday, Sonar published information on three OpenMeetings bugs – CVE-2023-28936, CVE-2023-29023, and CVE-2023-29246 – that could allow malicious attackers to take over an administrator account and execute arbitrary code remotely.

According to Sonar, a logical flaw and a weak hash comparison can be exploited for account takeover. By triggering certain actions, an attacker could create a room invitation that does not have a room assigned to it, which allows them to access any user account, and then gain administrator privileges.

“Due to insufficient validation of configurable items, attackers can use the acquired admin privileges to inject a null-byte in one of the binary paths. This can be leveraged to run an arbitrary binary and thus results in remote code execution,” Sonar notes.

OpenMeetings binds meeting invitations to a specific room and to a user, and also creates a unique hash it then uses to retrieve invitation information.

The first of the three vulnerabilities allows an attacker “to enumerate valid invitation hashes and redeem them”, while the second bug can be exploited to gain unrestricted access to a session.

Advertisement. Scroll to continue reading.

For that, the attacker can create an event, join the room, and then delete the event while present in the room, which turns it into a ‘zombie room’. Next, the attacker creates an invitation for the admin user to the room and, using a wildcard character, the attacker can redeem the invitation for themselves.

“Although an error is raised when redeeming the hash for such an invitation, a valid web session for the invitee with full permissions of this user is created. This web session can be accessed by using the session cookie in the server’s response,” Sonar explains.

The attacker can now modify the configuration of the OpenMeetings instance and, by injecting a null-byte in the configured path for the ImageMagic executable, they can gain remote code execution.

“When now uploading a fake image containing a valid image header followed by arbitrary shell commands, the conversion spawns /bin/sh with the first argument being the fake image, effectively executing every command in it,” Sonar notes.

A self-registered attacker can chain these vulnerabilities to hijack an instance and obtain remote code execution on the underlying server, the cybersecurity firm underlines.

All three vulnerabilities were resolved in Apache OpenMeetings version 7.1.0, which was released on May 9.

https://www.securityweek.com/openmeetings-flaws-allow-hackers-to-hijack-instances-execute-code-on-servers/

Firmware vulnerabilities in millions of computers could give hackers superuser status

Two years ago, ransomware crooks breached hardware-maker Gigabyte and dumped more than 112 gigabytes of data that included information from some of its most important supply-chain partners, including Intel and AMD. Now researchers are warning that the leaked information revealed what could amount to critical zero-day vulnerabilities that could imperil huge swaths of the computing world.

The vulnerabilities reside inside firmware that Duluth, Georgia-based AMI makes for BMCs (baseboard management controllers). These tiny computers soldered into the motherboard of servers allow cloud centers, and sometimes their customers, to streamline the remote management of vast fleets of computers. They enable administrators to remotely reinstall OSes, install and uninstall apps, and control just about every other aspect of the system—even when it’s turned off. BMCs provide what’s known in the industry as “lights-out” system management.

Lights-out forever

Researchers from security firm Eclypsium analyzed AMI firmware leaked in the 2021 ransomware attack and identified vulnerabilities that had lurked for years. They can be exploited by any local or remote attacker with access to an industry-standard remote-management interface known as Redfish to execute malicious code that will run on every server inside a data center.

Until the vulnerabilities are patched using an update AMI published on Thursday, they provide a means for malicious hackers—both financially motivated or nation-state sponsored—to gain superuser status inside some of the most sensitive cloud environments in the world. From there, the attackers could install ransomware and espionage malware that runs at some of the lowest levels inside infected machines. Successful attackers could also cause physical damage to servers or indefinite reboot loops that a victim organization can’t interrupt. Eclypsium warned such events could lead to “lights out forever” scenarios.

In a post published Thursday, Eclypsium researchers wrote:

These vulnerabilities range in severity from High to Critical, including unauthenticated remote code execution and unauthorized device access with superuser permissions. They can be exploited by remote attackers having access to Redfish remote management interfaces, or from a compromised host operating system. Redfish is the successor to traditional IPMI and provides an API standard for the management of a server’s infrastructure and other infrastructure supporting modern data centers. Redfish is supported by virtually all major server and infrastructure vendors, as well as the OpenBMC firmware project often used in modern hyperscale environments.

These vulnerabilities pose a major risk to the technology supply chain that underlies cloud computing. In short, vulnerabilities in a component supplier affect many hardware vendors, which in turn can be passed on to many cloud services. As such these vulnerabilities can pose a risk to servers and hardware that an organization owns directly as well as the hardware that supports the cloud services that they use. They can also impact upstream suppliers to organizations and should be discussed with key 3rd parties as part of general supply chain risk management due diligence.

BMCs are designed to provide administrators with near total and remote control over the servers they manage. AMI is a leading provider of BMCs and BMC firmware to a wide range of hardware vendors and cloud service providers. As a result, these vulnerabilities affect a very large number of devices, and could enable attackers to gain control of or cause damage not only to devices but to data centers and cloud service infrastructure. The same logic flaws may affect devices in fall-back data centers in different geographic regions part of the same service provider, and can challenge assumptions cloud providers (and their customers) often make in the context of risk management and continuity of operations.

The researchers went on to note that if they could locate the vulnerabilities and write exploits after analyzing the publicly available source code, there’s nothing stopping malicious actors from doing the same. And even without access to the source code, the vulnerabilities could still be identified by decompiling BMC firmware images. There’s no indication malicious parties have done so, but there’s also no way to know they haven’t.

The researchers privately notified AMI of the vulnerabilities, and the company created firmware patches, which are available to customers through a restricted support page. AMI has also published an advisory here.

The vulnerabilities are:

CVE-2023-34329, an authentication bypass via HTTP headers that has a severity rating of 9.9 out of 10, and
CVE-2023-34330, Code injection via Dynamic Redfish Extension. Its severity rating is 8.2.

https://arstechnica.com/?p=1955540

New AMI BMC Flaws Allowing Takeover and Physical Damage Could Impact Millions of Devices

Firmware and hardware security company Eclypsium has disclosed information on two new vulnerabilities found by its researchers in the American Megatrends (AMI) MegaRAC Baseboard Management Controller (BMC) software.

Eclypsium disclosed other flaws discovered as part of the same research project in December 2022. The analysis focused on information leaked as a result of a ransomware attack launched in 2021 against motherboard maker Gigabyte, a supply chain partner of AMI. The vulnerabilities discovered by the cybersecurity firm in the AMI BMC are collectively tracked as BMC&C.

The BMC software enables administrators to remotely monitor and control a device, without the need to go through the operating system or applications running on it. It can be used to update firmware, install operating systems, and analyze logs. While these features make BMC very useful, they can also make it a tempting target for threat actors.

The BMC made by AMI is present in millions of devices worldwide as it’s used in the products of major companies such as Ampere, Asrock, Asus, Arm, Dell, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan.

The new vulnerabilities disclosed by Eclypsium on Thursday are CVE-2023-34329, a critical authentication bypass issue that can be exploited by spoofing HTTP headers, and CVE-2023-34330, a code injection flaw.

“When both of these vulnerabilities are chained together, even a remote attacker with network access to BMC management interface and no BMC credentials, can achieve remote code execution by tricking BMC into believing that the http request is coming from the internal interface. As a result the attacker can remotely upload and execute arbitrary code, possibly from the Internet, if the interface is exposed to it,” Eclypsium explained.

Similar to the previously disclosed vulnerabilities, these new flaws can pose a significant risk to organizations. An attacker who has gained access to the targeted server’s BMC can conduct a wide range of activities, and the impact can be significant, particularly in the case of data centers and cloud environments.

Advertisement. Scroll to continue reading.

In one theoretical scenario described by Eclypsium, an attacker leverages existing BMC functionality to create a continuous shutdown loop on the host and prevent legitimate users from accessing it. These types of attacks are difficult to detect and address, and researchers warn that the method could be used to extort a targeted organization.

“When this happens to a small number of machines, the impact may be limited in scale, however should the same vulnerabilities be exploited across an entire BMC management segment and affect hundreds or thousands of devices at once, the impact can be catastrophic to operations, and result in indefinite downtime with no ability to recover,” the security firm said.

Access to the BMC also allows an attacker to stealthily access KVM (keyboard/video/mouse) functionality, enabling them not only to closely monitor legitimate users but also conduct activities on their behalf using KVM inputs.

A hacker can also cause physical destruction through power management tampering, by changing CPU voltages and permanently bricking them.

BMC access can also be used for lateral movement, including to other BMCs, network devices, and even to Active Directory.

While these vulnerabilities could pose a significant risk to millions of systems, Eclypsium is currently not aware of in-the-wild exploitation. Proof-of-concept (PoC) exploits have not been made public, but sophisticated threat actors could find the flaws on their own by looking at the same leaked information that the security firm analyzed.

https://www.securityweek.com/new-ami-bmc-flaws-allowing-takeover-and-physical-damage-could-impact-millions-of-devices/

Adobe Releases New Patches for Exploited ColdFusion Vulnerabilities

Adobe has released a second round of patches for some recently disclosed ColdFusion vulnerabilities, including flaws that appear to have been exploited in attacks.

On July 11, Adobe announced patches for CVE-2023-29298, an improper access control issue that can lead to a security feature bypass. On July 14, the company informed customers about fixes for CVE-2023-38203, a deserialization issue that could lead to arbitrary code execution.

A few days later, cybersecurity firm Rapid7 reported seeing attacks aimed at ColdFusion users. The company’s analysis showed that the attackers had exploited CVE-2023-29298 and chained it with what appeared to be CVE-2023-38203.

Rapid7 pointed out at the time that Adobe’s patch for CVE-2023-29298 was incomplete and easy to bypass.

On Wednesday, July 19, Adobe announced another ColdFusion update to patch three new CVEs. One of them, CVE-2023-38205, is the bypass for CVE-2023-29298.

The software giant warned in its advisory that CVE-2023-38205 has been “exploited in the wild in limited attacks”.

While ‘limited attacks’ could suggest exploitation by state-sponsored threat actors in highly targeted operations, ColdFusion vulnerabilities have also been known to be exploited by profit-driven cybercrime groups.

Advertisement. Scroll to continue reading.

Adobe has yet to confirm that CVE-2023-38203 has also been exploited in the wild.

CVE-2023-38203 was reported to Adobe by two parties, including researchers at open source security firm ProjectDiscovery.

On July 12, ProjectDiscovery made public what they believed to be an analysis of CVE-2023-29300, another ColdFusion vulnerability that could lead to remote code execution. However, their analysis inadvertently also disclosed CVE-2023-38203, which at the time had yet to be patched — Adobe released patches on July 14.

ProjectDiscovery quickly pulled its blog post after being notified by Adobe and on July 19 it re-published the post with clarifications. The company found that Adobe’s patch for CVE-2023-38203 was incomplete and one of Adobe’s latest ColdFusion fixes, for CVE-2023-38204, actually addresses that patch bypass.

Adobe on Wednesday also released a patch for CVE-2023-38206, a ColdFusion vulnerability discovered by researcher Brian Reilly, who was recently also credited by Adobe for another ColdFusion flaw tracked as CVE-2023-29301. The timing suggests that CVE-2023-38206 may have been assigned after the patch for CVE-2023-29301 was bypassed. SecurityWeek has reached out to Reilly for confirmation and will update this article if he responds.

https://www.securityweek.com/adobe-releases-new-patches-for-exploited-coldfusion-vulnerabilities/

Oracle Releases 508 New Security Patches With July 2023 CPU

Oracle on Tuesday announced the release of 508 new security patches as part of the July 2023 CPU, including more than 75 patches that resolve critical-severity vulnerabilities.

More than 350 of the security patches address vulnerabilities that can be exploited remotely, without authentication. Some of these flaws impact multiple products, Oracle’s advisory reveals.

As part of this quarterly set of security updates, Financial Services received the largest number of patches, at 147. Of the resolved vulnerabilities, 115 can be exploited by remote, unauthenticated attackers with network access.

Oracle’s July 2023 CPU includes 77 security patches for Communications, with 57 of the flaws remotely exploitable without authentication.

Fusion Middleware received 60 security patches, including fixes for 40 remotely exploitable, unauthenticated bugs. Communications Applications (40 patches – 30 issues exploitable remotely without authentication), Analytics (32 – 23), and MySQL (24 – 11) received numerous fixes as well.

On Tuesday, Oracle also announced patches for Utilities Applications, Supply Chain, Retail Applications, Java SE, PeopleSoft, Siebel CRM, Commerce, Enterprise Manager, Construction and Engineering, E-Business Suite, JD Edwards, and over a dozen other products.

Successful exploitation of some of these vulnerabilities may lead to complete application or system compromise, Oracle says. Many of the updates also include additional third-party patches.

Advertisement. Scroll to continue reading.

On Tuesday, Oracle also released the July 2023 Solaris bulletin, which includes 17 new security patches, including 11 for vulnerabilities that are remotely exploitable, without authentication. Two of the vulnerabilities are rated ‘critical severity’.

The tech giant also announced the release of 42 new security patches as part of its July 2023 Linux bulletin.

Customers are advised to apply the available patches in a timely manner, or to block network access to unpatched applications, to reduce the risk of an attack. Unpatched Oracle products are known to have been targeted in the wild.

“Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches,” the tech giant notes.

https://www.securityweek.com/oracle-releases-508-new-security-patches-with-july-2023-cpu/

Exploitation of New Citrix Zero-Day Likely to Increase, Organizations Warned

Citrix on Tuesday announced patches for three vulnerabilities, including an actively exploited zero-day that allows remote code execution.

The zero-day, tracked as CVE-2023-3519 and rated ‘critical’, affects Citrix ADC and Gateway products. It can be exploited remotely without authentication, but only against appliances that are configured as a gateway or AAA virtual server.

Citrix warned customers that it’s aware of attacks targeting CVE-2023-3519 on unmitigated appliances, and cybersecurity firm Rapid7 has warned organizations that exploitation is expected to quickly increase given the impacted products’ popularity.

No details are available about the attacks, but Citrix product vulnerabilities have been known to be exploited by both profit-driven cybercriminals and state-sponsored threat actors, including ones linked to China.

In addition to the zero-day, the latest Citrix ADC and Gateway updates address two high-severity vulnerabilities.

One of them, CVE-2023-3466, is a reflected cross-site scripting (XSS) issue that can be exploited by getting the targeted user to click on a malicious link. The other is CVE-2023-3467, which allows an authenticated attacker to escalate privileges to root administrator.

Patches for these security holes are included in NetScaler ADC and Gateway 13.1-49.13 and 13.0-91.13, and NetScaler ADC 13.1-FIPS 13.1-37.159, 12.1-FIPS 12.1-55.297, and ADC 12.1-NDcPP 12.1-55.297.

Advertisement. Scroll to continue reading.

The US Cybersecurity and Infrastructure Security Agency (CISA) has also issued an alert for the Citrix vulnerabilities, warning organizations about the zero-day.

https://www.securityweek.com/exploitation-of-new-citrix-zero-day-likely-to-increase-organizations-warned/

Chrome 115 Patches 20 Vulnerabilities

Google on Tuesday announced the release of Chrome 115 to the stable channel, with patches for 20 vulnerabilities, including 11 reported by external researchers.

Of the externally reported security defects, four are assessed with a ‘high severity’ rating. Based on the bug bounties paid for them, the most important of these are CVE-2023-3727 and CVE-2023-3728, two use-after-free issues in WebRTC. Google says it handed out a $7,000 reward for each of them.

The third high-severity flaw that Chrome 115 resolves is another use-after-free bug, this time in Tab Groups. Tracked as CVE-2023-3730, the vulnerability was awarded a $2,000 bug bounty.

The fourth high-severity issue, CVE-2023-3732, is described as an out-of-bounds memory access in Mojo. The bug was discovered by Google Project Zero researcher Mark Brand and, per Google’s policies, no bug bounty will be issued for it.

Chrome 115 resolves six externally reported medium-severity vulnerabilities, which are described as inappropriate implementation flaws in the WebApp Installs, Picture In Picture, Web API Permission Prompts, Custom Tabs, Notifications, and Autofill components.

This browser release also resolves a low-severity insufficient validation of untrusted input bug in Themes.

Google says it has paid a total of $34,000 in bug bounty rewards to the reporting researchers.

Advertisement. Scroll to continue reading.

The internet giant makes no mention of any of the newly resolved vulnerabilities being exploited in malicious attacks.

As usual, technical details on the resolved vulnerabilities are kept under wraps until the latest Chrome update is installed by most users.

https://www.securityweek.com/chrome-115-patches-20-vulnerabilities/

Two New Adobe ColdFusion Vulnerabilities Exploited in Attacks

At least two recently disclosed Adobe ColdFusion vulnerabilities appear to have been exploited in the wild, including a flaw that security experts say has not been completely patched by the software giant.

Last week, Adobe informed customers about three critical ColdFusion vulnerabilities. First, on July 11, it announced patches for CVE-2023-29298, an improper access control issue that can lead to a security feature bypass, and CVE-2023-29300, a deserialization issue that can be exploited for arbitrary code execution.

Then, on July 14, the company announced patches for CVE-2023-38203, another deserialization issue that could lead to arbitrary code execution.

In notification emails sent out to some customers, Adobe mistakenly said it was aware of attacks targeting CVE-2023-29300. There is no indication that this flaw has actually been exploited.

However, cybersecurity firm Rapid7 reported on Monday that the other two vulnerabilities patched last week, CVE-2023-29298 and CVE-2023-38203, do in fact appear to have been exploited in the wild.

Rapid7’s analysis shows that CVE-2023-29298 has been chained with another vulnerability, likely CVE-2023-38203. In attacks observed by the firm, the attackers executed PowerShell commands to create a webshell that gives them access to the targeted endpoint.

CVE-2023-38203 was discovered by researchers at ProjectDiscovery, which published a blog post detailing the findings on July 12, before Adobe announced its patch. The blog post was then taken down and Rapid7 believes ProjectDiscovery thought they were actually disclosing CVE-2023-29300, which had already been fixed by Adobe, but in reality their July 12 blog post detailed CVE-2023-38203, for which the vendor had yet to release a patch.

Advertisement. Scroll to continue reading.

Indeed, Adobe noted when it announced patches for CVE-2023-38203 on July 14 that a proof-of-concept (PoC) blog post describing the security hole was available.

Rapid7 warned that Adobe’s fix for one of the exploited vulnerabilities, CVE-2023-29298, is incomplete and a “trivially modified exploit still works against the latest version of ColdFusion”. The company has informed Adobe.

“There is currently no mitigation for CVE-2023-29298, but the exploit chain Rapid7 is observing in the wild relies on a secondary vulnerability for full execution on target systems. Therefore, updating to the latest available version of ColdFusion that fixes CVE-2023-38203 should still prevent the attacker behavior our MDR team is observing,” Rapid7 said.

The security firm’s blog post provides indicators of compromise (IoCs) and mitigation guidance.

This is the second time in 2023 that users have been warned about attacks exploiting ColdFusion vulnerabilities. In March, Adobe informed customers about a zero-day being leveraged in very limited attacks.

While ‘limited attacks’ could suggest exploitation by state-sponsored cyberspies in highly targeted operations, ColdFusion vulnerabilities have also been known to be exploited by cybercrime groups.

CISA’s Known Exploited Vulnerabilities Catalog currently contains nine ColdFusion vulnerabilities, but it does not include these latest flaws.

https://www.securityweek.com/two-new-adobe-coldfusion-vulnerabilities-exploited-in-attacks/