VULNERA Pulse

CVE-2022-41697

CVSS Not Assigned

Public Exploits Available

Published: Dec. 22, 2022

A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.

Quotes

• This gives unprivileged users the ability to view and change settings they were not intended to have access to - The Hacker News

Headlines

• Dec. 23, 2022 - Ghost CMS vulnerable to critical authentication bypass flaw
• Dec. 22, 2022 - Two New Security Flaws Reported in Ghost CMS Blogging Software
• Dec. 21, 2022 - Vulnerability Spotlight: Authentication bypass and enumeration vulnerabilities in Ghost CMS

CVE-2022-41654

CVSS Not Assigned

Public Exploits Available

Published: Dec. 22, 2022

An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.

Quotes

• This gives unprivileged users the ability to view and change settings they were not intended to have access to - The Hacker News

Headlines

• Dec. 23, 2022 - Ghost CMS vulnerable to critical authentication bypass flaw
• Dec. 22, 2022 - Two New Security Flaws Reported in Ghost CMS Blogging Software
• Dec. 21, 2022 - Vulnerability Spotlight: Authentication bypass and enumeration vulnerabilities in Ghost CMS

CVE-2022-42821

MEDIUM CVSS 5.50

Public Exploits Available

Published: Dec. 15, 2022

A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks.

Quotes

• Gatekeeper bypasses such as this could be leveraged as a vector for initial access by malware and other threats and could help increase the success rate of malicious campaigns and attacks on macOS - Dark Reading
• Do not delay, Simply patch it today - Naked Security - Sophos
• For initial access by malware and other threats - The Register - Security
• On July 27, 2022, Microsoft discovered a vulnerability in macOS that can allow attackers to bypass application execution restrictions imposed by Apple's Gatekeeper security mechanism, designed to ensure only trusted apps run on Mac devices. We developed a proof-of-concept exploit to demonstrate the vulnerability, which we call - Security Affairs
• Allow attackers to bypass application execution restrictions imposed by Apple's Gatekeeper security mechanism, designed to ensure only trusted apps run on Mac devices - BetaNews
• Apple's Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles. - BleepingComputer
• Apple's Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles - BleepingComputer

Headlines

• Dec. 23, 2022 - Microsoft discovers new Gatekeeper bypass; Apple updates past security advisories
• Dec. 21, 2022 - Critical flaw on macOS: you should update your laptop!
• Dec. 21, 2022 - Microsoft Spots macOS Vulnerability That Lets Malware Bypass Security Checks
• Dec. 21, 2022 - Apple shot in the heel by Achilles
• Dec. 21, 2022 - Gatekeeper bypass exposes Macs to malware
• Dec. 20, 2022 - Microsoft Warns on 'Achilles' macOS Gatekeeper Bypass
• Dec. 20, 2022 - Apple Fixes Mac Bug that Let Malware Bypass Gatekeeper Security
• Dec. 20, 2022 - Microsoft dishes the dirt on Apple’s “Achilles heel” shortly after fixing similar Windows bug
• Dec. 20, 2022 - Microsoft reports macOS Gatekeeper has an 'Achilles' heel
• Dec. 20, 2022 - Microsoft exposes nasty ‘Achilles’ bug that leaves your Mac defenseless to attack
• Dec. 20, 2022 - Apple fixes bug that let malicious apps skirt macOS’ security protections
• Dec. 20, 2022 - Microsoft shares details for a Gatekeeper Bypass bug in Apple macOS
• Dec. 20, 2022 - Microsoft uncovers macOS flaw that could let malware run riot
• Dec. 20, 2022 - Microsoft finds macOS bug that lets malware bypass security checks
• Dec. 20, 2022 - Microsoft Details Recent macOS Gatekeeper Bypass Vulnerability
• Dec. 20, 2022 - Microsoft Reveals macOS Vulnerability That Bypasses Gatekeeper and Lockdown Mode to Run Malware
• Dec. 20, 2022 - macOS had a vulnerability that Lockdown Mode wouldn't defeat
• Dec. 20, 2022 - This critical macOS flaw may leave your Mac defenseless
• Dec. 20, 2022 - Apple fixes Gatekeeper-bypass vulnerability after Microsoft discovers macOS security flaw
• Dec. 20, 2022 - Microsoft Details Gatekeeper Bypass Vulnerability in Apple macOS Systems
• Dec. 20, 2022 - Microsoft spots new macOS Achilles’ heel identified as CVE-2022-42821
• Dec. 19, 2022 - Microsoft: Achilles macOS bug lets hackers bypass Gatekeeper

CVE-2022-41080

CRITICAL CVSS 9.80

Risk Context N/A

Published: Nov. 9, 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-41123.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

• CrowdStrike recently discovered a new exploit method (called OWASSRF) consisting of CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution (RCE) through Outlook Web Access (OWA). The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint provided by Microsoft in response to ProxyNotShell - Security Affairs
• Previously undocumented way to reach the PowerShell remoting service through the OWA frontend endpoint, instead of leveraging the Autodiscover endpoint - Dark Reading
• CVE-2022-41080, has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022-41040 used in the ProxyNotShell exploit chain, and it has been marked 'exploitation more likely'. Based on these findings, CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022-41080 - SecurityWeek
• The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint - The Hacker News
• In each case, CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022-41040 for initial access - BleepingComputer

Headlines

• Dec. 21, 2022 - Play ransomware attacks use a new exploit to bypass ProxyNotShell mitigations on Exchange servers
• Dec. 21, 2022 - Ransomware Attackers Bypass Microsoft's ProxyNotShell Mitigations With Fresh Exploit
• Dec. 21, 2022 - A new Microsoft Exchange flaw is being used to attack servers
• Dec. 21, 2022 - Ransomware Uses New Exploit to Bypass ProxyNotShell Mitigations
• Dec. 21, 2022 - Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations
• Dec. 20, 2022 - Ransomware gang uses new Microsoft Exchange exploit to breach servers

CVE-2022-38023

HIGH CVSS 8.10

Public Exploits Available

Published: Nov. 9, 2022

Netlogon RPC Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2016, Windows Server 2019, Windows Server 2012, Windows Server 2008, Windows Server 2022

Quotes

• An unauthenticated attacker could conduct an attack that could leverage cryptographic protocol vulnerabilities in RFC 4757 (Kerberos encryption type RC4-HMAC-MD5) and MS-PAC (Privilege Attribute Certificate Data Structure specification) to bypass security features in a Windows AD environment - The Hacker News

Headlines

• Dec. 17, 2022 - Samba addressed multiple high-severity vulnerabilities
• Dec. 17, 2022 - Samba Issues Security Updates to Patch Multiple High-Severity Vulnerabilities

CVE-2016-20017

CRITICAL CVSS 9.80

Risk Context N/A

Published: Oct. 19, 2022

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

Vendor Impacted: Dlink

Products Impacted: Dsl-2750b, Dsl-2750b Firmware

Quotes

• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs

Headlines

• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

CVE-2022-41082

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Remote Code Execution Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

• CrowdStrike recently discovered a new exploit method (called OWASSRF) consisting of CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution (RCE) through Outlook Web Access (OWA). The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint provided by Microsoft in response to ProxyNotShell - Security Affairs
• Previously undocumented way to reach the PowerShell remoting service through the OWA frontend endpoint, instead of leveraging the Autodiscover endpoint - Dark Reading
• CVE-2022-41080, has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022-41040 used in the ProxyNotShell exploit chain, and it has been marked 'exploitation more likely'. Based on these findings, CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022-41080 - SecurityWeek
• The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint - The Hacker News
• In each case, CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022-41040 for initial access - BleepingComputer

Headlines

• Dec. 22, 2022 - New Microsoft Exchange exploit being used to breach servers
• Dec. 21, 2022 - Play ransomware attacks use a new exploit to bypass ProxyNotShell mitigations on Exchange servers
• Dec. 21, 2022 - Ransomware Attackers Bypass Microsoft's ProxyNotShell Mitigations With Fresh Exploit
• Dec. 21, 2022 - A new Microsoft Exchange flaw is being used to attack servers
• Dec. 21, 2022 - The Top Security Vulnerabilities of 2022 and Their Workarounds
• Dec. 21, 2022 - Ransomware Uses New Exploit to Bypass ProxyNotShell Mitigations
• Dec. 21, 2022 - Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations
• Dec. 20, 2022 - Ransomware gang uses new Microsoft Exchange exploit to breach servers
• Dec. 19, 2022 - CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

CVE-2022-41040

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

• Previously undocumented way to reach the PowerShell remoting service through the OWA frontend endpoint, instead of leveraging the Autodiscover endpoint - Dark Reading
• CVE-2022-41080, has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022-41040 used in the ProxyNotShell exploit chain, and it has been marked 'exploitation more likely'. Based on these findings, CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022-41080 - SecurityWeek
• The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint - The Hacker News
• In each case, CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022-41040 for initial access - BleepingComputer

Headlines

• Dec. 21, 2022 - Play ransomware attacks use a new exploit to bypass ProxyNotShell mitigations on Exchange servers
• Dec. 21, 2022 - Researchers find new 'ProxyNotShell' Exchange exploit
• Dec. 21, 2022 - Ransomware Attackers Bypass Microsoft's ProxyNotShell Mitigations With Fresh Exploit
• Dec. 21, 2022 - The Top Security Vulnerabilities of 2022 and Their Workarounds
• Dec. 21, 2022 - Ransomware Uses New Exploit to Bypass ProxyNotShell Mitigations
• Dec. 21, 2022 - Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations
• Dec. 20, 2022 - Ransomware gang uses new Microsoft Exchange exploit to breach servers
• Dec. 19, 2022 - CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

CVE-2022-37958

HIGH CVSS 7.50

Remote Code Execution Public Exploits Available

Published: Sept. 13, 2022

SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Information Disclosure Vulnerability.

Quotes

• Do Not Sell My Personal Information - Security Intelligence
• Do I really want to hold on to this? - Security Intelligence
• Place it on the shelf - Security Intelligence

Headlines

• Dec. 23, 2022 - How the CCPA is Shaping Other State’s Data Privacy
• Dec. 22, 2022 - What Can We Learn From Recent Cyber History?
• Dec. 22, 2022 - Critical Microsoft Code-Execution Vulnerability
• Dec. 21, 2022 - Beware of What Is Lurking in the Shadows of Your IT
• Dec. 21, 2022 - When Logs Are Out, Enhanced Analytics Stay In
• Dec. 21, 2022 - Don’t Wait to Embrace CISA’s Vulnerability Management Rules
• Dec. 20, 2022 - This critical Windows security flaw could be as serious as WannaCry, experts claim
• Dec. 20, 2022 - Another critical, EternalBlue-like vulnerability threatens Windows machines worldwide
• Dec. 20, 2022 - 4 Most Common Cyberattack Patterns from 2022
• Dec. 19, 2022 - Critical Windows code-execution vulnerability went undetected until now

CVE-2022-33891

HIGH CVSS 8.80

Public Exploits Available

Published: July 18, 2022

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Vendor Impacted: Apache

Product Impacted: Spark

Quotes

• Upon gaining device access, Zerobot injects a malicious payload, which may be a generic script called zero.sh that downloads and attempts to execute Zerobot, or a script that downloads the Zerobot binary of a specific architecture - infosecurity-magazine.com
• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs
• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files - SecurityWeek
• The most recent distribution of Zerobot includes additional capabilities, such as exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and CVE-2022-33891 respectively), and new DDoS attack capabilities - The Hacker News

Headlines

• Dec. 23, 2022 - Zerobot Botnet Devs Add New Functionality
• Dec. 23, 2022 - Zerobot botnet upgrade targets unpatched Apache servers
• Dec. 22, 2022 - Zerobot botnet expands to start exploiting Apache flaws
• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 22, 2022 - Zerobot IoT Botnet Adds More Exploits, DDoS Capabilities
• Dec. 22, 2022 - Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

CVE-2022-30023

HIGH CVSS 8.80

Remote Code Execution Public Exploits Available

Published: June 16, 2022

Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.

Vendor Impacted: Tenda

Products Impacted: Hg9 Firmware, Hg9

Quotes

• Zerobot 1.1 increases its capabilities with the inclusion of new attack methods and new exploits for supported architectures, expanding the malware's reach to different types of devices - The Register - Security
• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs
• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files - SecurityWeek
• Successful DDoS attacks may be used by threat actors to extort ransom payments, distract from other malicious activities, or disrupt operations - Dark Reading
• The most recent distribution of Zerobot includes additional capabilities, such as exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and CVE-2022-33891 respectively), and new DDoS attack capabilities - The Hacker News
• Microsoft researchers have also found new evidence that Zerobot propagates by compromising devices with known vulnerabilities that are not included in the malware binary, such as CVE-2022-30023, a command injection vulnerability in Tenda GPON AC1200 routers - BleepingComputer

Headlines

• Dec. 22, 2022 - Zerobot malware now shooting for Apache systems
• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 22, 2022 - Zerobot IoT Botnet Adds More Exploits, DDoS Capabilities
• Dec. 22, 2022 - Zerobot Adds Brute Force, DDoS to Its IoT Attack Arsenal
• Dec. 22, 2022 - Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities
• Dec. 21, 2022 - Zerobot malware now spreads by exploiting Apache vulnerabilities
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

CVE-2021-44228

CRITICAL CVSS 10.00

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Dec. 10, 2021

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Vendors Impacted: Percussion, Siemens, Snowsoftware, Debian, Cisco, Apache, Intel, Netapp, Bentley, Fedoraproject

Products Impacted: Cx Cloud Agent, Firepower 1140, Unified Contact Center Express, Spectrum Power 4, Logo\! Soft Comfort, Navigator, Firepower 2130, Nexus Dashboard, Siveillance Command, Cyber Vision, Snow Commander, Cloudcenter Workload Manager, Data Center Network Manager, Vm Access Proxy, Prime Service Catalog, Crosswork Network Controller, Identity Services Engine, Workload Optimization Manager, Firepower 1010, Contact Center Management Portal, Crosswork Optimization Engine, System Studio, Unified Communications Manager Im \&, Oneapi Sample Browser, Advanced Malware Protection Virtual , Paging Server, Head-End System Universal Device Int, Desigo Cc Info Center, Firepower 4140, Mindsphere, Xpedition Enterprise, Video Surveillance Operations Manage, Siguard Dsa, Siveillance Viewpoint, Ucs Central Software, Video Surveillance Manager, Unified Customer Voice Portal, Cloud Insights, Connected Analytics For Network Depl, Log4j2, Firepower Threat Defense, Cloud Manager, E-Car Operation Center, Firepower 4112, Sppa-T3000 Ses3000 Firmware, Dna Spaces Connector, Solid Edge Cam Pro, Active Iq Unified Manager, Energyip, Oncommand Insight, Packaged Contact Center Enterprise, Sppa-T3000 Ses3000, Crosswork Network Automation, Contact Center Domain Manager, Unified Sip Proxy, Firepower 4110, Emergency Responder, Genomics Kernel Library, Unified Communications Manager, Fog Director, Operation Scheduler, Industrial Edge Management Hub, Network Assurance Engine, Firepower 4125, Opcenter Intelligence, Iot Operations Dashboard, Rhythmyx, Xpedition Package Integrator, Network Dashboard Fabric Controller, Dna Spaces\, Snapcenter, Intersight Virtual Appliance, Cloudcenter Cost Optimizer, Cloudcenter Suite Admin, Crosswork Zero Touch Provisioning, Firepower 2120, Integrated Management Controller Sup, Virtual Topology System, Unified Communications Manager Im An, Crosswork Data Gateway, Ucs Director, Smart Phy, Firepower 1120, Teamcenter, Unified Contact Center Management Po, Siveillance Vantage, Firepower 4120, Webex Meetings Server, Nexus Insights, Ontap Tools, Business Process Automation, Cyber Vision Sensor Management Exten, Sensor Solution Firmware Development, Energyip Prepay, Virtualized Voice Browser, Connected Mobile Experiences, Fxos, Wan Automation Engine, Comos, Cloudcenter Suite, Network Insights For Data Center, Cloudcenter, Siveillance Identity, Cloud Secure Agent, Firepower 2140, Unity Connection, Unified Computing System, Siveillance Control Pro, Gma-Manager, Unified Contact Center Enterprise, Debian Linux, Firepower 2110, Unified Workforce Optimization, Vesys, Automated Subsea Tuning, Enterprise Chat And Email, Mobility Services Engine, Cloud Connect, Ucs Central, Virtualized Infrastructure Manager, Sentron Powermanager, Spectrum Power 7, Firepower 1150, Common Services Platform Collector, Data Center Manager, Log4j, Network Services Orchestrator, Nx, Industrial Edge Management, Solid Edge Harness Design, Fedora, Crosswork Platform Infrastructure, Synchro, Optical Network Controller, Synchro 4d, Broadworks, Audio Development Kit, Secure Device Onboard, Dna Center, Firepower 4145, Customer Experience Cloud Agent, Sipass Integrated, Computer Vision Annotation Tool, Unified Intelligence Center, Dna Spaces, Captial, Finesse, Mendix, Evolved Programmable Network Manager, Sd-Wan Vmanage, Desigo Cc Advanced Reports, Firepower 9300, System Debugger, Energy Engage, Firepower 4115, Firepower 4150

Quotes

• Existing tools take from months to years to deploy traditional agent tooling and still result in blind spots and a lack of visibility into the environment - The Register - Security

Headlines

• Dec. 22, 2022 - It’s time to fill those cloud security gaps
• Dec. 17, 2022 - Software Supply Chain Security Checklist

CVE-2021-42013

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 7, 2021

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Vendors Impacted: Apache, Oracle

Products Impacted: Http Server, Secure Backup

Quotes

• Upon gaining device access, Zerobot injects a malicious payload, which may be a generic script called zero.sh that downloads and attempts to execute Zerobot, or a script that downloads the Zerobot binary of a specific architecture - infosecurity-magazine.com
• Zerobot 1.1 increases its capabilities with the inclusion of new attack methods and new exploits for supported architectures, expanding the malware's reach to different types of devices - The Register - Security
• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs
• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files - SecurityWeek
• The most recent distribution of Zerobot includes additional capabilities, such as exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and CVE-2022-33891 respectively), and new DDoS attack capabilities - The Hacker News

Headlines

• Dec. 23, 2022 - Zerobot Botnet Devs Add New Functionality
• Dec. 23, 2022 - Zerobot botnet upgrade targets unpatched Apache servers
• Dec. 22, 2022 - Zerobot malware now shooting for Apache systems
• Dec. 22, 2022 - Zerobot botnet expands to start exploiting Apache flaws
• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 22, 2022 - Zerobot IoT Botnet Adds More Exploits, DDoS Capabilities
• Dec. 22, 2022 - Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

CVE-2021-34523

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution

Published: July 14, 2021

Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470.

Vendor Impacted: Microsoft

Products Impacted: Microsoft Exchange Server, Exchange Server

Quotes

• If a firm is deemed to have a sufficient market size, the pentester leaves a comment for the admin on how the server connection can be used, how long the attack can last, and how far it can go - BleepingComputer

Headlines

• Dec. 22, 2022 - FIN7 hackers create auto-attack platform to breach Exchange servers
• Dec. 19, 2022 - CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

CVE-2021-34473

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: July 14, 2021

Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206.

Vendor Impacted: Microsoft

Product Impacted: Microsoft Exchange Server

Quotes

• If a firm is deemed to have a sufficient market size, the pentester leaves a comment for the admin on how the server connection can be used, how long the attack can last, and how far it can go - BleepingComputer
• The DarkTortilla malware is highly sophisticated .NET-based malware that targets users in the wild - Dark Reading

Headlines

• Dec. 22, 2022 - FIN7 hackers create auto-attack platform to breach Exchange servers
• Dec. 20, 2022 - How to protect corporate network during the holiday season
• Dec. 19, 2022 - Sophisticated DarkTortilla Malware Serves Imposter Cisco, Grammarly Pages
• Dec. 19, 2022 - CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

CVE-2021-31207

HIGH CVSS 7.20

CISA Known Exploited Actively Exploited

Published: May 11, 2021

Microsoft Exchange Server Security Feature Bypass Vulnerability

Vendor Impacted: Microsoft

Product Impacted: Microsoft Exchange Server

Quotes

• If a firm is deemed to have a sufficient market size, the pentester leaves a comment for the admin on how the server connection can be used, how long the attack can last, and how far it can go - BleepingComputer

Headlines

• Dec. 22, 2022 - FIN7 hackers create auto-attack platform to breach Exchange servers
• Dec. 19, 2022 - CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

CVE-2018-20057

HIGH CVSS 9.00

Risk Context N/A

Published: Dec. 11, 2018

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.

Quotes

• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs

Headlines

• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

CVE-2018-12613

HIGH CVSS 8.80

Public Exploits Available

Published: June 21, 2018

An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).

Quotes

• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs
• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files - SecurityWeek

Headlines

• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 22, 2022 - Zerobot IoT Botnet Adds More Exploits, DDoS Capabilities
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

CVE-2018-10561

HIGH CVSS 7.50

CISA Known Exploited

Published: May 4, 2018

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Vendors Impacted: Dasan, Dasannetworks

Products Impacted: Gigabit Passive Optical Network (Gpon) Routers, Gpon Router Firmware, Gpon Router

Quotes

• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs

Headlines

• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

CVE-2017-17106

HIGH CVSS 10.00

Risk Context N/A

Published: Dec. 19, 2017

Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages.

Quotes

• Since the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Microsoft researchers have also identified that previous reports have used the vulnerability ID - Security Affairs

Headlines

• Dec. 22, 2022 - A new Zerobot variant spreads by exploiting Apache flaws
• Dec. 21, 2022 - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog