VULNERA Pulse

Rejetto — HTTP File Server

CVE-2024-23692 / Added: July 9, 2024

CRITICAL CVSS 9.80 EPSS Score 95.43 EPSS Percentile 99.40

Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.

Headlines

• July 10, 2024 - U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog
• July 7, 2024 - newsletter Round 479 by Pierluigi Paganini – INTERNATIONAL EDITION
• July 6, 2024 - CVE-2024-39943 (CVSS 9.9): Critical Vulnerability in HTTP File Server Exposes Systems to RCE
• July 4, 2024 - Hackers attack HFS servers to drop malware and Monero miners
• July 4, 2024 - Microsoft Uncovers Critical Flaws in Rockwell Automation PanelView Plus
• July 4, 2024 - Urgent Security Alert: HFS Servers Under Attack, Patch Now!
• June 10, 2024 - CVE-2024-23692: Unauthenticated RCE Flaw in Rejetto HTTP File Server, PoC Published

Back to top ↑

Microsoft — Windows

CVE-2024-38080 / Added: July 9, 2024

HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 9.80

Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

Headlines

• July 10, 2024 - Attackers Have Been Leveraging Microsoft Zero-Day for 18 Months
• July 10, 2024 - Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
• July 10, 2024 - Microsoft Patch Tuesday for July 2024 fixed 2 actively exploited zero-days
• July 10, 2024 - U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 10, 2024 - CVE-2024-38021: Zero-Click Vulnerability Discovered in Microsoft Outlook
• July 10, 2024 - Check Point Research Details 0-Day Flaw (CVE-2024-38112), Threatens Windows Users
• July 9, 2024 - Attackers Already Exploiting Flaws in Microsoft's July Security Update
• July 9, 2024 - Microsoft Patch Tuesday, July 2024 Edition –
• July 9, 2024 - Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
• July 9, 2024 - July Patch Tuesday Unleashes a Torrent of Updates
• July 9, 2024 - Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
• July 9, 2024 - Microsoft July 2024 Patch Tuesday fixes 142 flaws, 4 zero-days

Back to top ↑

Microsoft — Windows

CVE-2024-38112 / Added: July 9, 2024

HIGH CVSS 7.50 EPSS Score 1.61 EPSS Percentile 87.60

Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.

Headlines

• July 15, 2024 - ZDI shames Microsoft for coordinated vuln disclosure snafu
• July 14, 2024 - Malware Newsletter - Round 2
• July 14, 2024 - Week in review: RADIUS protocol critical vuln, Microsoft 0-day exploited for a year, AT&T breach
• July 10, 2024 - Attackers Have Been Leveraging Microsoft Zero-Day for 18 Months
• July 10, 2024 - Windows MSHTML zero-day used in malware attacks for over a year
• July 10, 2024 - Zero-day patched by Microsoft has been exploited by attackers for over a year (CVE-2024-38112)
• July 10, 2024 - Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
• July 10, 2024 - Microsoft Patch Tuesday for July 2024 fixed 2 actively exploited zero-days
• July 10, 2024 - Resurrecting Internet Explorer -- the nasty threat impacting potentially millions of Windows 10 and 11 users
• July 10, 2024 - U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 10, 2024 - CVE-2024-38021: Zero-Click Vulnerability Discovered in Microsoft Outlook
• July 10, 2024 - Check Point Research Details 0-Day Flaw (CVE-2024-38112), Threatens Windows Users
• July 9, 2024 - Attackers Already Exploiting Flaws in Microsoft's July Security Update
• July 9, 2024 - Microsoft Patch Tuesday, July 2024 Edition –
• July 9, 2024 - Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
• July 9, 2024 - Microsoft July 2024 Patch Tuesday fixes 142 flaws, 4 zero-days

Back to top ↑

CVE-2024-38077

CRITICAL CVSS 9.80 EPSS Score 0.14 EPSS Percentile 50.58

Remote Code Execution

Published: July 9, 2024

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2022 23h2, Windows Server 2012, Windows Server 2008, Windows Server 2016, Windows Server 2022, Windows Server 2019

Quotes

• An attacker who successfully exploited this vulnerability could gain system privileges
• Threat hunters would benefit from additional details, so that they can determine if they have already been compromised by this vulnerability
• Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment
• While not specifically stated by Microsoft, let’s assume the worst-case scenario and say that an authorized user could be on a guest OS. Microsoft also does not state how widespread the exploitation is, but this exploit would prove quite useful for ransomware
• [It] could allow an authenticated attacker with site owner permissions or higher to upload a specially crafted file to a SharePoint Server, then craft malicious API requests to trigger deserialisation of the file's parameters, thus enabling them to achieve remote code execution in the context of the SharePoint server

Headlines

• July 10, 2024 - Microsoft Fixes Four Zero-Days in July Patch Tuesday
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 9, 2024 - Attackers Already Exploiting Flaws in Microsoft's July Security Update
• July 9, 2024 - Microsoft Patch Tuesday, July 2024 Edition –
• July 9, 2024 - Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
• July 9, 2024 - Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities

CVE-2024-38076

CRITICAL CVSS 9.80 EPSS Score 0.14 EPSS Percentile 50.58

Remote Code Execution

Published: July 9, 2024

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2016, Windows Server 2022, Windows Server 2019, Windows Server 2022 23h2

Quotes

• An attacker who successfully exploited this vulnerability could gain system privileges
• Threat hunters would benefit from additional details, so that they can determine if they have already been compromised by this vulnerability
• Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment
• While not specifically stated by Microsoft, let’s assume the worst-case scenario and say that an authorized user could be on a guest OS. Microsoft also does not state how widespread the exploitation is, but this exploit would prove quite useful for ransomware
• [It] could allow an authenticated attacker with site owner permissions or higher to upload a specially crafted file to a SharePoint Server, then craft malicious API requests to trigger deserialisation of the file's parameters, thus enabling them to achieve remote code execution in the context of the SharePoint server

Headlines

• July 10, 2024 - Microsoft Fixes Four Zero-Days in July Patch Tuesday
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 9, 2024 - Attackers Already Exploiting Flaws in Microsoft's July Security Update
• July 9, 2024 - Microsoft Patch Tuesday, July 2024 Edition –
• July 9, 2024 - Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
• July 9, 2024 - Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities

CVE-2024-6387

HIGH CVSS 8.10 EPSS Score 36.87 EPSS Percentile 97.22

Remote Code Execution Public Exploits Available

Published: July 1, 2024

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Vendors Impacted: Openbsd, Freebsd, Netbsd, Redhat, Debian, Canonical, Suse, Netapp, Amazon

Products Impacted: Linux Enterprise Micro, Openshift Container Platform, Ontap Tools, Enterprise Linux For Ibm Z Systems Eus, Enterprise Linux Server Aus, Enterprise Linux For Arm 64 Eus, Ubuntu Linux, Ontap Select Deploy Administration Utility, Openssh, Freebsd, Netbsd, Linux 2023, Debian Linux, Enterprise Linux For Arm 64, Enterprise Linux For Ibm Z Systems, Enterprise Linux For Power Little Endian Eus, Enterprise Linux, Enterprise Linux For Power Little Endian, E-Series Santricity Os Controller, Enterprise Linux Eus

Quotes

• The main difference from CVE-2024-6387 is that the race condition and RCE potential are triggered in the privsep child process, which runs with reduced privileges compared to the parent server process
• A signal handler race condition vulnerability was found in OpenSSH’s server (sshd) in Red Hat Enterprise Linux 9, where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd’s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). This issue leaves it vulnerable to a signal handler race condition on the cleanup_exit() function, which introduces the same vulnerability as CVE-2024-6387 in the unprivileged child of the SSHD server. As a consequence of a successful attack, in the worst case scenario, the attacker may be able to perform a remote code execution (RCE) within unprivileged user running the sshd server

Headlines

• July 12, 2024 - Cloud Software Group Confirms CVE-2024-6387 Exposure in NetScaler
• July 11, 2024 - OpenSSH bug leaves RHEL 9 and the RHELatives vulnerable
• July 10, 2024 - Cloud Software Group Security Advisory for CVE-2024-6387
• July 10, 2024 - A new flaw in OpenSSH can lead to remote code execution
• July 10, 2024 - New OpenSSH Vulnerability Discovered: Potential Remote Code Execution Risk
• July 9, 2024 - CVE-2024-6409: New Remote Code Execution Vulnerability in OpenSSH
• July 8, 2024 - Cisco Warns regreSSHion Vulnerability Impacts Multiple Products
• July 8, 2024 - Cisco Confirms Critical OpenSSH regreSSHion (CVE-2024-6387) Flaw in Multiple Products

CVE-2024-35264

HIGH CVSS 8.10 EPSS Score 0.09 EPSS Percentile 39.40

Remote Code Execution

Published: July 9, 2024

.NET and Visual Studio Remote Code Execution Vulnerability

Quotes

• An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
• Threat hunters would benefit from additional details, so that they can determine if they have already been compromised by this vulnerability
• Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment
• While not specifically stated by Microsoft, let’s assume the worst-case scenario and say that an authorized user could be on a guest OS. Microsoft also does not state how widespread the exploitation is, but this exploit would prove quite useful for ransomware

Headlines

• July 10, 2024 - Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 10, 2024 - CVE-2024-38021: Zero-Click Vulnerability Discovered in Microsoft Outlook
• July 10, 2024 - Check Point Research Details 0-Day Flaw (CVE-2024-38112), Threatens Windows Users
• July 9, 2024 - Attackers Already Exploiting Flaws in Microsoft's July Security Update
• July 9, 2024 - Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
• July 9, 2024 - Microsoft July 2024 Patch Tuesday fixes 142 flaws, 4 zero-days

CVE-2024-38080

HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 9.80

CISA Known Exploited

Published: July 9, 2024

Windows Hyper-V Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 11 23h2, Windows Server 2022, Windows 11 22h2, Windows Server 2022 23h2, Windows , Windows 11 21h2

Quotes

• An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
• Threat hunters would benefit from additional details, so that they can determine if they have already been compromised by this vulnerability
• Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment
• To summarize the attacks from the exploitation perspective: The first technique used in these campaigns is [a] trick, which allows the attacker to call IE instead of the more secure Chrome/Edge
• While not specifically stated by Microsoft, let’s assume the worst-case scenario and say that an authorized user could be on a guest OS. Microsoft also does not state how widespread the exploitation is, but this exploit would prove quite useful for ransomware

Headlines

• July 10, 2024 - Attackers Have Been Leveraging Microsoft Zero-Day for 18 Months
• July 10, 2024 - Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
• July 10, 2024 - Microsoft Patch Tuesday for July 2024 fixed 2 actively exploited zero-days
• July 10, 2024 - U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 10, 2024 - CVE-2024-38021: Zero-Click Vulnerability Discovered in Microsoft Outlook
• July 10, 2024 - Check Point Research Details 0-Day Flaw (CVE-2024-38112), Threatens Windows Users
• July 9, 2024 - Attackers Already Exploiting Flaws in Microsoft's July Security Update
• July 9, 2024 - Microsoft Patch Tuesday, July 2024 Edition –
• July 9, 2024 - Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
• July 9, 2024 - July Patch Tuesday Unleashes a Torrent of Updates
• July 9, 2024 - Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
• July 9, 2024 - Microsoft July 2024 Patch Tuesday fixes 142 flaws, 4 zero-days

CVE-2024-38112

HIGH CVSS 7.50 EPSS Score 1.61 EPSS Percentile 87.60

CISA Known Exploited

Published: July 9, 2024

Windows MSHTML Platform Spoofing Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 1507, Windows, Windows Server 2022 23h2, Windows 11 23h2, Windows Server 2008, Windows Server 2012, Windows 10 1607, Windows 10 1809, Windows Server 2016, Windows 10 21h2, Windows Server 2019, Windows Server 2022, Windows 11 22h2, Windows 10 22h2, Windows 11 21h2

Quotes

• First, IE will allow you to download a .HTA file from the internet without warning
• An attacker who successfully exploited this vulnerability could gain SYSTEM privileges
• Threat hunters would benefit from additional details, so that they can determine if they have already been compromised by this vulnerability
• Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment
• To summarize the attacks from the exploitation perspective: The first technique used in these campaigns is [a] trick, which allows the attacker to call IE instead of the more secure Chrome/Edge
• While not specifically stated by Microsoft, let’s assume the worst-case scenario and say that an authorized user could be on a guest OS. Microsoft also does not state how widespread the exploitation is, but this exploit would prove quite useful for ransomware
• Check Point Research recently discovered that threat actors have been using novel (or previously unknown) tricks to lure Windows users for remote code execution. Specifically, the attackers used special Windows Internet Shortcut files (.url extension name), which, when clicked, would call the retired Internet Explorer (IE) to visit the attacker-controlled URL

Headlines

• July 10, 2024 - Attackers Have Been Leveraging Microsoft Zero-Day for 18 Months
• July 10, 2024 - Windows MSHTML zero-day used in malware attacks for over a year
• July 10, 2024 - Zero-day patched by Microsoft has been exploited by attackers for over a year (CVE-2024-38112)
• July 10, 2024 - Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
• July 10, 2024 - Microsoft Patch Tuesday for July 2024 fixed 2 actively exploited zero-days
• July 10, 2024 - Resurrecting Internet Explorer -- the nasty threat impacting potentially millions of Windows 10 and 11 users
• July 10, 2024 - U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog
• July 10, 2024 - Microsoft Windows Hyper-V EoP bug under active exploit
• July 10, 2024 - CVE-2024-38021: Zero-Click Vulnerability Discovered in Microsoft Outlook
• July 10, 2024 - Check Point Research Details 0-Day Flaw (CVE-2024-38112), Threatens Windows Users
• July 9, 2024 - Attackers Already Exploiting Flaws in Microsoft's July Security Update
• July 9, 2024 - Microsoft Patch Tuesday, July 2024 Edition –
• July 9, 2024 - Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
• July 9, 2024 - Microsoft July 2024 Patch Tuesday fixes 142 flaws, 4 zero-days

CVE-2024-6235

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 9.27

Risk Context N/A

Published: July 10, 2024

Sensitive information disclosure in NetScaler Console

Quotes

• Citrix released security updates to address vulnerabilities in multiple Citrix products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system
• An issue was discovered in GitLab CE/EE affecting versions 15.8 prior to 16.11.6, 17.0 prior to 17.0.4, and 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances

Headlines

• July 12, 2024 - NetScaler Console, Agent and SDX (SVM) Security Bulletin for CVE-2024-6235 and CVE-2024-6236
• July 12, 2024 - Cloud Software Group Confirms CVE-2024-6387 Exposure in NetScaler
• July 11, 2024 - GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Jobs
• July 10, 2024 - NetScaler Console, Agent and SDX Security Bulletin for CVE-2024-6235 and CVE-2024-6236
• July 10, 2024 - Citrix fixed critical and high-severity bugs in NetScaler product
• July 10, 2024 - Citrix Issues Critical Security Advisory for NetScaler: CVE-2024-6235 and CVE-2024-6236
• July 9, 2024 - NetScaler Console, Agent and SVM Security Bulletin for CVE-2024-6235 and CVE-2024-6236

CVE-2024-3596

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 15.93

Actively Exploited Remote Code Execution Public Exploits Available

Published: July 9, 2024

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Quotes

• Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment
• Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition
• The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request
• Such access to RADIUS traffic may happen through different mechanisms. Although sending RADIUS/UDP over the open internet is discouraged, this is still known to happen in practice. For internal network traffic, the attacker might initially compromise part of an enterprise network

Headlines

• July 11, 2024 - Palo Alto Networks Patches Critical Flaw in Expedition Migration Tool
• July 11, 2024 - Siemens SCALANCE, RUGGEDCOM, SIPLUS, and SINEC | CISA
• July 11, 2024 - CVE-2024-5910: Critical Vulnerability Threatens Palo Alto Networks' Expedition
• July 10, 2024 - Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
• July 10, 2024 - Blast RADIUS attack can bypass authentication for clients
• July 9, 2024 - New Blast-RADIUS attack bypasses widely-used RADIUS authentication
• July 9, 2024 - July Patch Tuesday Unleashes a Torrent of Updates

CVE-2024-6236

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 9.27

Risk Context N/A

Published: July 10, 2024

Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX

Quotes

• Citrix released security updates to address vulnerabilities in multiple Citrix products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system

Headlines

• July 12, 2024 - NetScaler Console, Agent and SDX (SVM) Security Bulletin for CVE-2024-6235 and CVE-2024-6236
• July 12, 2024 - Cloud Software Group Confirms CVE-2024-6387 Exposure in NetScaler
• July 10, 2024 - NetScaler Console, Agent and SDX Security Bulletin for CVE-2024-6235 and CVE-2024-6236
• July 10, 2024 - Citrix fixed critical and high-severity bugs in NetScaler product
• July 10, 2024 - Citrix Issues Critical Security Advisory for NetScaler: CVE-2024-6235 and CVE-2024-6236
• July 9, 2024 - NetScaler Console, Agent and SVM Security Bulletin for CVE-2024-6235 and CVE-2024-6236