Many Vulnerabilities Found in PrinterLogic Enterprise Software

Vulnerabilities identified in PrinterLogic’s enterprise management printer solution could expose organizations to authentication bypass, SQL injection, cross-site scripting (XSS) and other types of attacks.

PrinterLogic’s platform allows organizations to manage all printers within their environments from a single console.

An analysis of the PrinterLogic SaaS platform and of the source code of the Virtual Appliance available on PrinterLogic’s website (Build 1.0.757) has revealed 18 vulnerabilities that could allow attackers to bypass authentication, inject code, and expose credentials, among others. The analysis was conducted by security researchers at Australian employment marketplace Seek.

One major issue the researchers discovered is that the platform is susceptible to an authentication bypass attack, allowing unauthenticated third-parties to access administrative scripts and modify the service’s configuration.

The bug exists because the application lacks a central framework for authentication and authorization handling. The individual PHP files need to implement the necessary checks instead, but, because some files lack these checks, unauthenticated access is possible via their direct URLs.

Another major problem the researchers have discovered is that the platform uses a flawed mechanism for preventing SQL injection, and that no input validation is present in some cases, which could lead to SQL injection.

The researchers also discovered multiple XSS flaws in the application, which could be exploited to hijack administrator accounts by leaking user session cookies. Furthermore, because the application does not issue a new session identifier after login, an attacker in possession of a session ID could use it to bypass authentication.

Advertisement. Scroll to continue reading.

When logging in as admin, the URL contains the encoded password, which could be leaked via “referrer headers, browser history, server logs, proxy logs, URL shortening services,” and more, the researchers say.

The application was also found to log requests that may contain passwords in plaintext and to store passwords using unsalted SHA1 hashing. When transmitting usernames and passwords, the application uses a double base64 encoding for obfuscation, but attackers can easily recover these credentials.

The researchers also discovered that no cross-site request forgery (CSRF) checks are enforced for most forms, that the application allows admins to manually upload printer drivers with known vulnerabilities or which have not been cryptographically signed with valid certificates, and that it lacks authorization checks.

Other identified issues include the enumeration of user emails via the forgot password function, the inclusion of an arbitrary URL in an iframe (leading to untrusted file downloads), the possibility to rename a host to impersonate another machine, OAuth authentication bypass, cookie values included in the page body, and the use of known vulnerable JavaScript libraries.

The researchers initiated the responsible disclosure process in February, but the vendor has yet to provide a patch time frame. The company did note that some issues impact legacy code and at least one flaw will not be patched.

https://www.securityweek.com/many-vulnerabilities-found-in-printerlogic-enterprise-software/

Zyxel Firewalls Hacked by Mirai Botnet

A Mirai botnet variant has been exploiting a recently patched vulnerability tracked as CVE-2023-28771 to hack many Zyxel firewalls.

The Taiwan-based networking device manufacturer informed customers about the security hole on April 25, when it announced the availability of patches for impacted ATP, VPN, USG Flex and ZyWALL/USG firewalls.

The OS command injection vulnerability, found by Trapa Security, is caused by improper error message handling in some firewalls, and it could allow an unauthenticated attacker to remotely execute OS commands by sending specially crafted packets to the targeted device.

By mid-May, security experts reported reproducing the exploit, and Rapid7 warned a few days later that it would likely end up being exploited in the wild.

Rapid7 said it had seen 42,000 instances of internet-exposed Zyxel device web interfaces, but noted that the actual number of exploitable devices was likely much higher.

Researcher Kevin Beaumont reported on Thursday that CVE-2023-28771 has been ‘mass exploited’ by a Mirai botnet variant, with many SMB appliances being impacted.

Mirai botnets typically abuse compromised devices to launch DDoS attacks, which can be massive.

It’s not uncommon for hackers to target Zyxel devices using recently patched vulnerabilities.

Advertisement. Scroll to continue reading.

Zyxel this week announced fixes for two other potentially serious flaws affecting its firewalls. The bugs, tracked as CVE-2023-33009 and CVE-2023-33010, are buffer overflows that can allow unauthenticated attackers to cause a DoS condition or execute arbitrary code on affected devices.

https://www.securityweek.com/zyxel-firewalls-hacked-by-mirai-botnet-via-recently-patched-vulnerability/

GitLab Security Update Patches Critical Vulnerability

DevOps platform GitLab this week resolved a critical-severity vulnerability impacting both GitLab Community Edition (CE) and Enterprise Edition (EE).

An open source end-to-end software development platform, GitLab helps developers and organizations build, secure, and operate software. The platform has approximately 30 million registered users.

Tracked as CVE-2023-2825 and leading to arbitrary file reads, the newly addressed security defect has the maximum CVSS score of 10.

“An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups,” GitLab explains in an advisory.

The web-based Git repository will release details on the bug only next month, after 30 days have passed since the patch was made available.

According to GitLab, the issue was introduced in GitLab CE/EE version 16.0.0 and was resolved on Tuesday with the release of version 16.0.1 of the platform.

The flaw was reported by a researcher named ‘pwnie’ via GitLab’s HackerOne-hosted bug bounty program.

Advertisement. Scroll to continue reading.

Given the severity of the bug, all GitHub users running version 16.0.0 of GitLab CE or EE are strongly advised to upgrade to the latest version of the platform as soon as possible. The patch has already been deployed on GitLab.com.

GitLab made no mention of this vulnerability being exploited in malicious attacks.

https://www.securityweek.com/gitlab-security-update-patches-critical-vulnerability/

Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances

Security, application delivery and data protection solutions provider Barracuda Networks is warning customers about a zero-day vulnerability that has been exploited to hack the company’s Email Security Gateway (ESG) appliances.

The zero-day, tracked as CVE-2023-2868, was addressed with a patch (BNSF-36456) that has been automatically applied to all impacted appliances.

An entry in NIST’s vulnerability database describes CVE-2023-2868 as a remote command injection vulnerability affecting versions 5.1.3.001 through 9.2.0.006 of the Barracuda ESG appliance.

“The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl’s qx operator with the privileges of the Email Security Gateway product,” the advisory explains.

Barracuda said the zero-day was discovered on May 19 and a patch was rolled out to all ESG appliances the next day. A second fix was released on May 21 as part of what the company described as its ‘containment strategy’.

“The vulnerability existed in a module which initially screens the attachments of incoming emails. No other Barracuda products, including our SaaS email security services, were subject to this vulnerability,” the company noted.

Barracuda’s investigation, which is ongoing, showed that “the vulnerability resulted in unauthorized access to a subset of email gateway appliances”.

Advertisement. Scroll to continue reading.

Impacted users have been notified through the ESG user interface and provided with instructions on the actions they need to take.

Barracuda has promised to share updates as its investigation progresses on its status page. In addition, impacted customers are being directly contacted.

“Barracuda’s investigation was limited to the ESG product, and not the customer’s specific environment. Therefore, impacted customers should review their environments and determine any additional actions they want to take,” Barracuda recommended.

Only a few vulnerabilities affecting Barracuda Networks products were publicly disclosed in recent years and there do not appear to be any previous reports of malicious exploitation.

On the other hand, threat actors have been known to target appliances made by F5, Cisco, Fortinet, SonicWall and Sophos.

https://www.securityweek.com/zero-day-vulnerability-exploited-to-hack-barracuda-email-security-gateway-appliances/

OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers

OAuth-related vulnerabilities found in the widely used application development framework Expo could have been exploited to take control of user accounts, according to API security firm Salt Security.

Expo is an open source platform for developing universal native apps for mobile devices and the web. The company says its product is used by more than 600,000 developers, including several major companies.

Researchers at Salt Security analyzed the OAuth functionality provided by Expo, which allows developers to enable user authentication through third-party services such as Facebook and Google.

Their analysis led to the discovery of security flaws that could have been exploited by tricking the targeted user into clicking on a specially crafted link. An attacker could have used the attack method to hijack sessions and take full control of the user’s account which, Salt Security pointed out, could have led to the exposure of sensitive information, financial fraud, or identity theft.

In some cases, an attacker could have also used the exploit to perform actions on behalf of the targeted user on platforms such as Facebook, Google or Twitter.

The vulnerabilities, tracked as CVE-2023-28131, were reported to Expo developers in mid-February and they were quickly addressed. Expo published a blog post detailing the steps it has taken to prevent exploitation. There is no evidence of a breach or malicious exploitation, Expo developers said.

“The vulnerability would have allowed a potential attacker to trick a user into visiting a malicious link, logging in to a third-party auth provider, and inadvertently revealing their third-party auth credentials” the company explained. “This was because auth.expo.io used to store an app’s callback URL before the user explicitly confirmed they trust the callback URL. After the hotfix, auth.expo.io now requires users to confirm they trust unverified callback URLs.”

Advertisement. Scroll to continue reading.

Salt Security noted that only implementations using the AuthSession Proxy of the social login component of Expo were affected.

Salt researchers found hundreds of potentially impacted services, including coding classes platform Codecademy, on which they demonstrated how the exploit could be used to take control of accounts.

Salt Security’s disclosure comes just months after the company reported finding OAuth implementation vulnerabilities that could have been exploited to hack Booking.com accounts.

https://www.securityweek.com/oauth-vulnerabilities-in-widely-used-expo-framework-allowed-account-takeovers/

Mikrotik Belatedly Patches RouterOS Flaw Exploited at Pwn2Own

Latvian network equipment manufacturer MikroTik has shipped a patch for a major security defect in its RouterOS product and confirmed the vulnerability was exploited five months ago at the Pwn2Own Toronto hacking contest.

In a barebones advisory documenting the CVE-2023-32154 flaw, Mikrotik confirmed the issue affects devices running MikroTik RouterOS versions v6.xx and v7.xx with enabled IPv6 advertisement receiver functionality.

According to ZDI, organizers of the Pwn2Own software exploitation event, the vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS.

“Authentication is not required to exploit this vulnerability,” ZDI warned in an advisory.

“The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root,” the company said.

The Pwn2Own organizers decided to go public with an advisory prior to the availability of patches after waiting five months for MikroTik to acknowledge and fix the already-exploited security flaw.

ZDI said it reported the issue to MikroTik during the event last December and asked again for an update in May this year, five months later. On May 10, ZDI said it “re-disclosed the report at the vendor’s request” and gave the company an extra week to provide fixes.

Advertisement. Scroll to continue reading.

In its response, MikroTik said it cannot find a record of the December disclosure from ZDI and that it was not present at the Toronto event in December to discuss the exploit.

Security defects in MikroTik routers have featured in the CISA must-patch list and have been used in the past to build malicious botnets.

https://www.securityweek.com/mikrotik-belatedly-patches-routeros-flaw-exploited-at-pwn2own/

Samsung Smartphone Users Warned of Actively Exploited Vulnerability

Samsung smartphone users have been warned by the vendor and the US Cybersecurity and Infrastructure Security Agency (CISA) about a recently patched vulnerability being exploited in attacks.

The flaw in question is CVE-2023-21492, described as a kernel pointer exposure issue related to log files. The security hole can allow a privileged local attacker to bypass the ASLR exploit mitigation technique. This indicates that it has likely been chained with other bugs.

Samsung patched CVE-2023-21492 with its May 2023 security updates and said it learned about the flaw in mid-January. The company said certain Android 11, 12 and 13 devices are impacted.

CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog on Friday, instructing government agencies to patch it by June 9.

The vulnerability was discovered by Google’s Threat Analysis Group, which suggests that it has likely been exploited by a commercial spyware vendor. Google noted in its zero-day exploitation database that CVE-2023-21492 was discovered in 2021.

Reports published by Google in recent months describe campaigns in which threat actors linked to spyware vendors attempted to hack Samsung smartphones through various zero-day and n-day vulnerabilities.

In one such campaign, discovered in December 2022, attackers attempted to deliver Android spyware to users in the United Arab Emirates through the Samsung Internet Browser. The attacks were linked by the internet giant to Variston, a Spanish commercial spyware vendor.

Advertisement. Scroll to continue reading.

Google has also disclosed the details of several Samsung phone vulnerabilities with a 2021 CVE identifier that had been exploited by a spyware vendor while they still had a zero-day status. The company is aware of nine Samsung vulnerabilities discovered in 2021 that have been exploited in attacks.

CISA on Friday also added two Cisco IOS vulnerabilities to its KEV catalog. One of them is CVE-2016-6415, whose existence came to light in 2016 as a result of the Shadow Brokers leaks.

The second is a very old DoS vulnerability tracked as CVE-2004-1464. Cisco warned customers about its exploitation back in 2004 when it released patches.

https://www.securityweek.com/samsung-smartphone-users-warned-of-actively-exploited-vulnerability/

Pimcore Platform Flaws Exposed Users to Code Execution

Security researchers are warning that vulnerabilities patched in the open-source Pimcore platform could have led to the execution of arbitrary code when clicking on a link.

A digital experience platform, Pimcore provides data and user experience management capabilities to over 100,000 organizations worldwide.

In March 2023, version 10.5.19 of the Pimcore platform resolved two issues that could have been used together to achieve arbitrary code execution, open source software security company Sonar Source says.

The two vulnerabilities, a path traversal bug and an SQL injection flaw, were identified in a GET request endpoint only accessible to admins, but which lacked CSRF protections.

Because the value of the endpoint’s exportFile parameter was not sanitized prior to being appended to the web root path, an attacker could “control the extension as well as traverse back in the folder path”, Sonar Source says.

This allowed an attacker to control the “CSV output file path, name, and extension”, leading to the creation of PHP files on the server.

To be able to control the content of the file for code execution, the attacker could then exploit an SQL injection flaw in the same endpoint, which allowed for the execution of arbitrary SQL queries.

Advertisement. Scroll to continue reading.

The two vulnerabilities, which are tracked together as CVE-2023-28438, could be chained together in a single GET request by creating a malicious link and tricking an administrator to click on it, resulting in the deployment of a web shell on the server.

“The impact of [the] path traversal and arbitrary extension is limited (creation of arbitrary files and appending data to existing files) but when combined with the SQL Injection, the exported data can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver,” Pimcore said an advisory.

Pimcore platform users are advised to update to version 10.5.19 as soon as possible, or to apply the available patches manually.

https://www.securityweek.com/pimcore-platform-flaws-exposed-users-to-code-execution/

Apple Patches 3 Exploited WebKit Zero-Day Vulnerabilities

Apple on Thursday released security updates for its operating systems to patch dozens of vulnerabilities that could expose iPhones and Macs to hacker attacks, including three zero-days affecting the WebKit browser engine.

Two of the actively exploited vulnerabilities, CVE-2023-28204 and CVE-2023-32373, have been reported to the tech giant by an anonymous researcher. Their exploitation can lead to sensitive information disclosure and arbitrary code execution if the attacker can trick the targeted user into processing specially crafted web content — this includes luring them to a malicious site.

No information is available on the attacks exploiting these zero-day flaws.

Apple revealed in its advisories that these were the vulnerabilities that it patched with its first Rapid Security Response updates, specifically iOS 16.4.1(a), iPadOS 16.4.1(a), and macOS 13.3.1(a).

Now, iOS 16.5 and iPadOS 16.5 fix CVE-2023-28204 and CVE-2023-32373, as well as CVE-2023-32409, a WebKit zero-day that can be exploited to escape the Web Content sandbox.

CVE-2023-32409 was reported to Apple by Google’s Threat Analysis Group and Amnesty International, which indicates that it has likely been exploited by the products of a commercial spyware vendor.

Google recently detailed several iOS and Android exploits that the company has linked to various spyware vendors.

Advertisement. Scroll to continue reading.

The latest iOS and iPadOS updates patch over 30 other vulnerabilities, including ones that can lead to a security bypass, sandbox escape, arbitrary code execution, exposure of location and other user data, privilege escalation, termination of an app, recovery of deleted photos, retaining access to system configuration files, contact information exposure from the lock screen, and modifications of protected parts of the file system.

CVE-2023-28204 and CVE-2023-32373 have also been fixed with the release of iOS and iPadOS 15.7.6

The exploited WebKit vulnerabilities have also been resolved in Apple TV, Apple Watch and Safari.

The latest macOS Ventura update fixes the three zero-days, along with nearly 50 other vulnerabilities that can lead to sensitive information disclosure, arbitrary code execution, DoS attacks, a security feature bypass, and privilege escalation.

Apple has also updated macOS Monterey to version 12.6.6 and Big Sur to version 11.7.7 to patch more than two dozen vulnerabilities, but none of the zero-days.

https://www.securityweek.com/apple-patches-3-exploited-webkit-zero-day-vulnerabilities/

Google Announces New Rating System for Android and Device Vulnerability Reports

Google on Wednesday announced that it’s updating the Android and Google Devices Vulnerability Reward Program (VRP) with a new system for rating the quality of bug reports.

The new quality rating system, the internet giant says, should encourage researchers to provide more details on the identified security defects and should also help address them faster.

Per the new rating system, received vulnerability reports will be rated as ‘high’, ‘medium’, or ‘low’ quality, and will be awarded bounty rewards accordingly.

“The highest quality and most critical vulnerabilities are now eligible for larger rewards of up to $15,000,” the internet giant says.

Google expects researchers to describe the identified flaw clearly and accurately and to include in their reports the device name and version, a full root cause analysis of the bug, a high-quality proof-of-concept (PoC) demonstrating the issue, and a step-by-step explanation of how to reproduce it.

Additionally, the internet giant expects researchers to provide evidence or an analysis demonstrating the level of access or execution that can be achieved by exploiting the vulnerability.

Google also says that it’s no longer assigning CVEs for most Android vulnerabilities that are assigned ‘moderate’ severity ratings.

Advertisement. Scroll to continue reading.

The Android and Google Devices VRP currently covers Pixel 4a to Pixel 7 Pro phones, Google Nest devices (cameras, doorbells, speakers, displays, thermostats, Wi-Fi, streaming, alarms, and door locks), and Fitbit wearables (Versa 3, Sense, Luxe, Inspire 2, and Charge 5).

https://www.securityweek.com/google-announces-new-rating-system-for-android-and-device-vulnerability-reports/