Details Disclosed for Critical SAP Vulnerabilities, Including Wormable Exploit Chain

A cybersecurity firm has disclosed the details of critical SAP vulnerabilities, including a wormable exploit chain, that can expose organizations to attacks.

The vulnerabilities were reported to the enterprise software giant by Fabian Hagg, researcher at SEC Consult, an Austria-based cybersecurity consulting firm that is part of the Atos Group’s Eviden business. Hagg found the flaws as part of a research project that spanned three years, with patches being released by SAP in mid-2021 and January 2023.

The vulnerabilities are tracked as CVE-2021-27610, CVE-2021-33677, CVE-2021-33684 and CVE-2023-0014, and they impact products that use the SAP Application Server for ABAP component. This includes SAP ERP Central Component (ECC), S/4HANA, BW/4HANA, Solution Manager (SolMan), SAP for Oil & Gas, SAP for Utilities, Supplier Relationship Management (SRM), Human Capital Management (HCM), and Employee Central Payroll (ECP) products.

The issues, which include both design and implementation problems, were discovered during an analysis of the Remote Function Call (RFC) interface, which is designed for communication between SAP systems.

Two of the flaws have been assigned ‘critical’ severity ratings based on their CVSS score: CVE-2021-27610 and CVE-2023-0014.

Exploitation of the vulnerabilities discovered by Hagg can lead to a full system compromise. The attacker only needs network access to the targeted system.

Johannes Greil, head of the SEC Consult Vulnerability Lab, told SecurityWeek that the impacted systems are typically only reachable internally, but there may be certain products and configurations that could allow exploitation of the vulnerabilities directly from the internet. No user interaction or special permissions are required to exploit the flaws.

Advertisement. Scroll to continue reading.

The vulnerabilities can be dangerous individually, but they pose an even greater risk when chained, making automated exploitation possible. The exploit chain was described as having wormable attack capabilities, enabling lateral movement in SAP environments.

While patches have been released by the vendor, organizations need to ensure that they have installed the fixes. SEC Consult recommends prioritizing systems exposed to untrusted networks. In addition to patches, configuration changes and “complex system adjustments” are required to address one of the flaws, the security firm explained.

“In case patching is not an option, we advise to limit network-wise access (RFC/HTTP) to vulnerable servers as far as possible in order to minimize the available attack surface. Furthermore, we advise to fully enforce encrypted server-to-server communications by means of HTTPS and SNC. Lastly, please refer to the additional measures described by the vendor in the corresponding SAP notes and in the FAQ for Security Note 3089413,” SEC Consult said.

Details of the vulnerabilities, along with a deep dive into the RFC protocol, are available in a paper published by SEC Consult. The company has also published a blog post summarizing the findings.

The research was also presented by Hagg on Thursday at the Troopers security conference in Germany.

https://www.securityweek.com/details-disclosed-for-critical-sap-vulnerabilities-including-wormable-exploit-chain/

Serious Vulnerability Exposes Admin Interface of Arcserve UDP Backup Solution

Proof-of-concept (PoC) code targeting a high-severity authentication bypass vulnerability in the Arcserve Unified Data Protection (UDP) backup software was published one day after patches were released earlier this week.

Tracked as CVE-2023-26258, the security defect was identified in the web management interface of Arcserve UDP. Successful exploitation of the bug could allow an attacker to access the administrative interface.

According to MDSec, the flaw was discovered in the way HTTP requests containing login information were transmitted between the web browser and the administrative interface.

Specifically, MDSec’s security researchers observed that a user validation method being invoked creates a client acting as a proxy that communicates with a web service responsible for validating the supplied credentials.

Because the location of the web service is supplied in the request, the researchers were able to modify the request so that the client would contact an HTTP server controlled by them.

Further analysis of the requests transmitted between the client and the web service allowed the researchers to identify information such as OS version, domain name, and administrator account name, along with a method that validates users by UUID, and an AuthUUID value.

Once they supplied the AuthUUID value to the web service, the researchers received the cookie for a valid administrator session in response, which allowed them to retrieve the encrypted password for that account.

Advertisement. Scroll to continue reading.

MDSec reported the vulnerability in early February 2023. A patch was released on June 27, roughly four months after a CVE identifier was assigned to the bug.

Arcserve UDP 9.1 resolves CVE-2023-26258, along with an Apache Commons FileUpload (CVE-2023-24998) flaw, three Spring Framework vulnerabilities made public last year, and various other issues.

On June 28, MDSec released PoC code exploiting the vulnerability to retrieve encrypted passwords, along with additional tools to decrypt the credentials.

MDSec claims that, even if the Arcserve UDP instances are patched against this vulnerability, an attacker on the local network could scan for Arcserve instances that are using default credentials, or may attempt to retrieve the credentials from the Windows registry or using the Remote Registry service.

https://www.securityweek.com/serious-vulnerability-exposes-admin-interface-of-arcserve-udp-backup-solution/

Chrome 114 Update Patches High-Severity Vulnerabilities

Google this week announced a new Chrome 114 update that patches a total of four vulnerabilities, including three high-severity bugs reported by external researchers.

The internet giant says it paid out a total of $35,000 in bug bounty rewards to the reporting researchers.

The highest payout went to GitHub Security Lab researcher Man Yue Mo, who discovered a type confusion issue in Chrome’s V8 JavaScript rendering engine. Tracked as CVE-2023-3420, the vulnerability was awarded a $20,000 bug bounty.

Next in line is CVE-2023-3421, a use-after-free vulnerability in Media. Cisco Talos researcher Piotr Bania earned a $10,000 bug bounty for finding this security defect.

Use-after-free vulnerabilities, a type of memory corruption issues that Google has been battling in both Chrome and Android, may lead to arbitrary code execution, data corruption, or denial of service.

In Chrome, these flaws could lead to a sandbox escape, if the attacker targets a privileged browser process or a vulnerability in the underlying operating system.

The third externally reported bug is CVE-2023-3422, a use-after-free flaw in Guest View for which Google paid a $5,000 reward to a security researcher known as ‘asnine’.

Advertisement. Scroll to continue reading.

Google makes no mention of any of these vulnerabilities being exploited in attacks.

The latest Chrome iteration is now rolling out as version 114.0.5735.198 for macOS and Linux and as versions 114.0.5735.198/199 for Windows.

This week, Cisco Talos released technical details on CVE-2023-1531, a use-after-free vulnerability in the ANGLE library (open source, cross-platform graphics engine in Chrome) that was addressed in March with the release of Chrome 111.0.5563.110.

According to Cisco, the flaw is triggered when a user accesses a specially crafted web page.

“That page could trigger a use-after-free condition in the application. Adversaries often leverage use-after-free conditions to corrupt data on the targeted machine or purposefully leak data,” it explained.

https://www.securityweek.com/chrome-114-update-patches-high-severity-vulnerabilities/

Fortinet Patches Critical RCE Vulnerability in FortiNAC

Fortinet has released patches to address a critical vulnerability in its FortiNAC network access control solution.

The zero trust access solution allows organizations to view devices and users on the network and provides granular control over network access policies.

Tracked as CVE-2023-33299 (CVSS score of 9.6), the critical flaw is described as an issue related to deserialization of untrusted data that can lead to remote code execution (RCE).

An unauthenticated attacker could exploit this vulnerability “to execute unauthorized code or commands via specifically crafted requests to the TCP/1050 service”, Fortinet explains in an advisory.

The vulnerability impacts FortiNAC versions up to 7.2.1, up to 9.4.2, up to 9.2.7, and up to 9.1.9, as well as all 8.x iterations.

Fortinet has addressed the security defect with the release of FortiNAC versions 9.4.3, 9.2.8, 9.1.10, and 7.2.2, but will not release patches for FortiNAC 8.x.

Code White security researcher Florian Hauser, who identified the issue, notes that there are few organizations exposing TCP port 1050 to the public internet. One of the identified organizations removed the vulnerable services a few days after Hauser reported them to CISA.

Advertisement. Scroll to continue reading.

In addition to the RCE bug, Hauser identified and reported CVE-2023-33300, a medium-severity command injection via FortiNAC’s TCP/5555 service.

Described as an improper neutralization of special elements, the vulnerability can be exploited by “an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields”.

According to Fortinet, access to the copied data is only possible if the attacker has an existing foothold and enough privileges on the device.

The vulnerability was resolved with the release of FortiNAC versions 9.4.4 and 7.2.2.

Fortinet makes no mention of any of these vulnerabilities being exploited in attacks. However, it is not uncommon for threat actors to target security defects in Fortinet products for which patches had been released.

https://www.securityweek.com/fortinet-patches-critical-rce-vulnerability-in-fortinac/

Remotely Exploitable DoS Vulnerabilities Patched in BIND

The Internet Systems Consortium (ISC) has released patches for three remotely exploitable denial-of-service (DoS) vulnerabilities in the DNS software suite BIND.

Tracked as CVE-2023-2828, CVE-2023-2829 and CVE-2023-2911, these high-severity issues could be exploited to exhaust the available memory, or could cause named – BIND’s daemon that functions both as a recursive resolver and as an authoritative name server – to crash.

CVE-2023-2828, ISC explains in an advisory, impacts a named function responsible for cleaning the memory cache to prevent it from reaching the maximum allowed value (the default is 90% of the total amount of memory available on the host).

“It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order,” ISC notes.

An attacker can exploit the vulnerability to cause the amount of memory used by named to exceed the maximum allowed amount. If the default configuration is used, the attacker could exhaust all available memory on the host, causing a DoS condition.

The second flaw, CVE-2023-2829, only impacts named instances “configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option enabled”.

A remote attacker could send specific queries to the resolver, causing named to terminate unexpectedly. The vulnerable option is enabled by default in BIND versions 9.18 and 9.18-S and newer but was disabled in earlier versions, unless enabled explicitly. Turning the option off prevents the issue.

Advertisement. Scroll to continue reading.

The third bug, CVE-2023-2911, impacts BIND 9 resolvers that reach the quota of recursive clients, if they are configured to return ‘stale’ cached answers with the ‘stale-answer-client-timeout 0;’ option.

The flaw can be triggered with a sequence of serve-stale-related lookups, causing named to loop and crash. The vulnerability can be prevented by changing the value of ‘stale-answer-client-timeout’.

“Users of versions 9.18.10, 9.16.36, 9.16.36-S1 or older who are unable to upgrade should set stale-answer-client-timeout to off; using a non-zero value with these older versions leaves named vulnerable to CVE-2022-3924,” ISC explains.

All three vulnerabilities were addressed with the release of BIND versions 9.16.42, 9.18.16, and 9.19.14, and BIND Supported Preview Edition versions 9.16.42-S1 and 9.18.16-S1.

ISC says it is not aware of any of these flaws being exploited in attacks.

https://www.securityweek.com/remotely-exploitable-dos-vulnerabilities-patched-in-bind/

NSA Issues Guidance on Mitigating BlackLotus Bootkit Infections

The National Security Agency (NSA) has published technical mitigation guidance to help organizations harden systems against BlackLotus UEFI bootkit infections.

The NSA’s recommendations provide a blueprint for defenders to protect systems from BlackLotus, a stealthy malware that emerged on underground forums in late 2022 with capabilities that include user access control (UAC) and secure boot bypass, unsigned driver loading, and prolonged persistence.

To disable secure boot, the bootkit exploits a year-old vulnerability in Windows (CVE-2022-21894) and deploys an older, vulnerable Windows boot loader to exploit the bug.

In April, Microsoft shared information on how threat hunters can identify BlackLotus infections in their environments, underlining that the bootkit can only be deployed on already compromised systems. In May, the company released optional mitigations to prevent the roll-back to vulnerable boot loaders.

The NSA mitigation document notes that BlackLotus can be executed on fully-patched systems, because the vulnerable boot loaders it targets have not been added to the Secure Boot DBX revocation list.

According to the NSA, although bootkit targets the earliest software stage of boot, “defensive software solutions can be configured to detect and prevent the installation of the BlackLotus payload or the reboot event that starts its execution and implantation.”

The agency urges system administrators within the Department of Defense and other networks to take action, as the available security patches may provide a false sense of security.

Advertisement. Scroll to continue reading.

“Because BlackLotus integrates Shim and GRUB into its implantation routine, Linux administrators should also be vigilant for variants affecting popular Linux distributions,” the NSA added.

Organizations are advised to keep their Windows systems always updated, to configure security software to monitor for EFI boot partition changes and, if such changes are identified, to prevent devices from rebooting, and to update Secure Boot with DBX deny list hashes preventing the execution of older and vulnerable boot loaders.

“Adding boot loader hashes to the DBX may render many Windows install and recovery images, discs, and removable media drives unbootable. Microsoft provides updated install and recovery images for Windows 11 and 10. Only update the DBX after acquiring install and recovery media with the January 2022 or later patch assortment applied,” according to the NSA.

Linux system administrators, the agency’s guidance explains, can remove the Microsoft Windows Production CA 2011 certificate from the Secure Boot database, thus eliminating the need to add DBX hashes.

https://www.securityweek.com/nsa-issues-guidance-on-mitigating-blacklotus-bootkit-infections/

CISA Tells US Agencies to Patch Exploited Roundcube, VMware Flaws

The US government’s cybersecurity agency CISA on Thursday added another batch of security flaws to its Known Exploited Vulnerabilities (KEV) catalog and urged federal agencies to patch these issues as a matter of urgency.

The already exploited vulnerabilities affect users of the open-source Roundcube webmail server and VMware Aria Operations for Networks.

Exploitation of the open-source mail server Roundcube flaws has been linked to Russian state-sponsored attacks against the Ukrainian government and other high-profile entities in the country.

Threat intelligence firm Recorded Future and Ukraine’s Computer Emergency Response Team (CERT-UA) have attributed the attacks to APT28, a notorious threat actor actor believed to be linked to Russia’s GRU military spy unit.

Tracked as CVE-2020-35730, CVE-2020-12641, and CVE-2021-44026, the exploited flaws are described as cross-site scripting (XSS), remote code execution (RCE), and SQL injection bugs, respectively. Patches and mitigations have been available since at least 2021.

The VMware Aria Operations for Networks vulnerability, tracked as CVE-2023-20887 (CVSS severity score 9.8/10), is a command injection flaw that exposes unpatched systems to remote code execution exploits.

The flaw was patched in early June, but VMware updated its advisory this week to warn of in-the-wild exploitation reported by threat intelligence firm GreyNoise.

Advertisement. Scroll to continue reading.

In addition to these four issues, CISA expanded its KEV catalog with two older bugs in Mozilla Firefox (CVE-2016-9079) and Microsoft Windows’ kernel-mode driver (CVE-2016-0165).

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned.

Per Binding Operational Directive (BOD) 22-01, federal agencies are required to identify and patch the vulnerabilities in CISA’s ‘Must Patch’ list within three weeks after they were added to the catalog. In this case, the six bugs should be addressed by July 13, 2023.

https://www.securityweek.com/cisa-tells-us-agencies-to-patch-exploited-roundcube-vmware-flaws/

VMware Patches Code Execution Vulnerabilities in vCenter Server

Virtualization giant VMware has published software updates to address multiple memory corruption vulnerabilities in vCenter Server that could lead to remote code execution.

A total of five security defects were patched in the software’s implementation of the DCERPC protocol, including four that VMware flags as ‘important’, with a CVSS score of 8.1.

Two of these issues, tracked as CVE-2023-20892 (heap buffer overflow due to uninitialized memory) and CVE-2023-20893 (use-after-free) could lead to code execution, according to VMware’s advisory.

“A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server,” VMware notes for both.

Next in line is CVE-2023-20894, a remotely exploitable out-of-bounds write bug that can be triggered via specially crafted packets to cause memory corruption.

The fourth vulnerability, CVE-2023-20895, is a memory corruption flaw that can be exploited over the network to bypass authentication.

VMware’s updates also address a important-severity out-of-bounds read vulnerability that a malicious actor can exploit remotely to cause a denial-of-service (DoS) condition on services such as vmcad, vmdird, and vmafdd.

Advertisement. Scroll to continue reading.

Patches for all flaws were included in vCenter Server and Cloud Foundation versions 8.0 U1b and 7.0 U3m. VMware also released Async patches for VCF customers.

vCenter Server is an advanced server management software for virtual infrastructure delivery across the hybrid cloud. The appliance is included in vSphere and Cloud Foundation products.

VMware recommends that all customers update to a patched version of the impacted products, noting that there is no workaround for any of these vulnerabilities. The company says it is not aware of any of these flaws being exploited in the wild.

https://www.securityweek.com/vmware-patches-code-execution-vulnerabilities-in-vcenter-server/

PoC Exploit Published for Cisco AnyConnect Secure Vulnerability

A security researcher has published proof-of-concept (PoC) code targeting a recently patched high-severity vulnerability in the Cisco AnyConnect Secure Mobility Client and Secure Client for Windows.

The software allows remote employees to connect to an organization’s network using a secure virtual private network (VPN) and provides monitoring capabilities.

Tracked as CVE-2023-20178 (CVSS score of 7.8), the security defect impacts the client update process of the software, allowing a local attacker with low-privileges to elevate their access and execute code with System privileges.

“This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process,” Cisco explains in an advisory.

At large, this is an arbitrary folder delete issue that can be triggered during the software update process, when a temporary folder is created to store copies of files that are being modified, to allow a rollback if the installation process is not completed.

An attacker with knowledge of this temporary folder can run an exploit containing an executable file designed to start an update process but trigger a rollback midway. At the same time, the exploit continuously attempts to replace the contents of the temporary folder with malicious files.

Once the update process halts, Windows attempts to restore the files in the temporary folder to their original location, but instead consumes the attacker’s malicious content.

Advertisement. Scroll to continue reading.

This week, security researcher Filip Dragovic, who reported CVE-2023-20178 to Cisco, released a PoC that works in a similar manner, triggering an arbitrary file delete with System privileges.

The researcher says he tested the PoC on Secure Client version 5.0.01242 and AnyConnect Secure Mobility Client version 4.10.06079. Only the Windows iterations of the software are impacted.

Cisco addressed CVE-2023-20178 in early June with the release of AnyConnect Secure Mobility Client version 4.10.07061 and Secure Client version 5.0.02075.

https://www.securityweek.com/poc-exploit-published-for-cisco-anyconnect-secure-vulnerability/

The Benefits of Red Zone Threat Intelligence

Exploit trends help reveal the areas that cybercriminals are actively investigating for potential attacks and what they’re currently targeting. New intelligence allows CISOs to prioritize risk mitigation and reduce the active attack surface with an expanded “Red Zone” approach.

Entering the Red Zone

When FortiGuard Labs researchers looked at data from the second half of 2022, they found that less than 1 percent of the total observed vulnerabilities discovered in an enterprise-size organization were on endpoints. Why is this important? It’s key to helping defenders narrow in on what’s actively under attack – in other words, the red zone of where they need to focus on the most.

Mapping CVEs reveals vulnerability “Red Zone” to help CISOs prioritize

Our analysis (PDF) found that the majority of CVEs were not found on endpoints, and even fewer of those that were found were also being exploited. The red zone is computed by comparing the open attack surface of endpoints (open CVEs) to the active attack surface (the CVEs attackers are exploiting.) The resulting Red Zone is 8.9% for the second half of 2022.

We would anticipate that attackers would prioritize CVEs based on their presence on endpoints. Instead, we observed a large number of CVEs that are prevalent on endpoints but rare among attacks. Why? Attackers choose their targets based on a variety of factors, but a multitude of exploitable CVEs doesn’t seem to be one of them.

Examining prevalent vulnerabilities

Advertisement. Scroll to continue reading.

When examining the most prevalent vulnerabilities – we saw that Log4j continued to reign supreme. Log4j-based attacks overwhelmingly focused on the technology sector, irrespective of region. That’s mainly because Apache Log4j is such a popular open-source program. Many businesses might not even know that they have built their existing systems on top of a Log4j component, as it can be so deeply integrated into a variety of applications.

It’s used even in unexpected places, like Ghidra (a debugger), where it has been completely incorporated. Its wide use suggests its popularity won’t die off any time soon.

These old-timers like Log4J were joined by some newcomers – including those we’ve designated the “rookies of the half,” meaning vulnerabilities that have only recently been discovered but had high frequency among companies during the six-month period. The latest recipient of this designation is the Workspace One Access Catalog vulnerability in VMWare, which first came to light in mid-2022 during a server-side injection problem. It is a significant remote code execution vulnerability that was discovered in July 2022. The nodes that were seen using this flaw appear to be comparable to those of generic botnets.

Three of the top six “rookies of the half” were connected to Spring, the open-source Java framework. If the word “Spring” seems familiar, it’s because two zero-day vulnerabilities in the Spring framework were revealed in 2022. Although they aren’t very common, it’s a good idea to keep them in mind as we proceed in 2023.

Prioritizing patching

By providing CISOs with information on the active attack surface, these insights offer CISOs a clear view of the Red Zone and where to focus patching efforts. Of course, as soon as vulnerabilities are found, the majority of software providers offer patches. But those patches are useless if you don’t apply them. The most damaging malware attacks of the last 10 years have therefore focused on software flaws for which updates were easily accessible. CISOs and IT executives need to prioritize effective patch management and regularly upgrade or replace software.

The first step in defending against zero-day vulnerabilities is determining what needs to be secured. There will always be a mix of network- and endpoint-based detection and security measures. To provide total visibility across all areas and industries, both kinds of measures should incorporate the most recent security updates and threat data offered by a global threat research team.

Intelligence is power

As the threat landscape and organizations’ attack surfaces are continually changing, the capacity of bad actors to create and modify their tactics to meet this changing environment continues to pose a serious risk to enterprises of all sizes, regardless of sector or location.

In the second part of 2022, criminals were continuing to exploit known and new vulnerabilities – but not necessarily at end points. It’s information like this that helps organizations know how to prioritize their security teams’ time and plug the leakiest holes. Incorporating Red Zone threat intelligence into your security strategy will help you stay on top of the latest threats and better protect your organization.

https://www.securityweek.com/the-benefits-of-red-zone-threat-intelligence/