VULNERA Pulse

CVE-2022-4135

CRITICAL CVSS 9.60

CISA Known Exploited Actively Exploited

Published: Nov. 25, 2022

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Vendors Impacted: Google, Microsoft

Products Impacted: Edge Chromium, Edge, Chrome

Quotes

• Remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page - infosecurity-magazine.com
• Google is aware that an exploit for CVE-2022-4135 exists in the wild - Security Affairs
• Aware that an exploit for CVE-2022-4135 exists in the wild - Forbes - Channel Feed
• Heap buffer overflow in GPU - Latest news

Headlines

• Nov. 25, 2022 - Update Chrome ASAP: Google patches new zero-day exploit
• Nov. 25, 2022 - A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution
• Nov. 25, 2022 - Google issues urgent warning to all Chrome users – you must act right now
• Nov. 25, 2022 - Google releases patch for zero-day Chrome vulnerability
• Nov. 25, 2022 - Google Releases Chrome Patch to Fix New Zero-Day Vulnerability
• Nov. 25, 2022 - Security experts urge Chrome users to patch new zero-day exploit immediately
• Nov. 25, 2022 - Apply This Emergency Google Chrome Zero-Day Patch Before You Shop Black Friday Deals
• Nov. 25, 2022 - Google fixed the eighth actively exploited #Chrome #zeroday this year
• Nov. 25, 2022 - Update Chrome Browser Now to Patch New Actively Exploited Zero-Day Flaw
• Nov. 25, 2022 - Google Issues Emergency Chrome Security Update For All Users
• Nov. 25, 2022 - Google rushes out Chrome browser fix for new zero-day flaw

CVE-2022-43782

CRITICAL CVSS 9.80

Risk Context N/A

Published: Nov. 17, 2022

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3

Quotes

• ADMIN or SYS_ADMIN authenticated users still have the ability to exploit the vulnerability when public signup is disabled. For this reason, this mitigation should be treated as a temporary step and customers are recommended to upgrade to a fixed version as soon as possible - iTnews - Security
• Disabling public signup would change the attack vector from an unauthenticated attack to an authenticated one which would reduce the risk of exploitation - The Hacker News

Headlines

• Nov. 20, 2022 - Atlassian patches critical bugs in Bitbucket, Crowd
• Nov. 19, 2022 - Atlassian Releases Patches for Critical Flaws Affecting Crowd and Bitbucket Products

CVE-2022-43781

CRITICAL CVSS 9.80

Risk Context N/A

Published: Nov. 17, 2022

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Vendor Impacted: Atlassian

Product Impacted: Bitbucket

Quotes

• ADMIN or SYS_ADMIN authenticated users still have the ability to exploit the vulnerability when public signup is disabled. For this reason, this mitigation should be treated as a temporary step and customers are recommended to upgrade to a fixed version as soon as possible - iTnews - Security
• Disabling public signup would change the attack vector from an unauthenticated attack to an authenticated one which would reduce the risk of exploitation - The Hacker News

Headlines

• Nov. 20, 2022 - Atlassian patches critical bugs in Bitbucket, Crowd
• Nov. 19, 2022 - Atlassian Releases Patches for Critical Flaws Affecting Crowd and Bitbucket Products

CVE-2022-37966

HIGH CVSS 8.10

Risk Context N/A

Published: Nov. 9, 2022

Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2008, Windows Server 2016, Windows Server 2012, Windows Server 2022, Windows Server 2019

Quotes

• An unauthenticated attacker could conduct an attack that could leverage cryptographic protocol vulnerabilities in RFC 4757 (Kerberos encryption type RC4-HMAC-MD5) and MS-PAC (Privilege Attribute Certificate Data Structure specification) to bypass security features in a Windows AD environment - Security Affairs
• This issue might affect any Kerberos authentication in your environment - The Register - Security

Headlines

• Nov. 24, 2022 - Threat actors exploit discontinues Boa web servers to target critical infrastructure
• Nov. 23, 2022 - Microsoft releases out-of-band update to fix Kerberos auth issues caused by a patch for CVE-2022-37966
• Nov. 22, 2022 - Microsoft Releases Out-of-Band Update After Security Patch Causes Kerberos Issues
• Nov. 21, 2022 - Microsoft's attempts to harden Kerberos authentication broke it on Windows Servers

CVE-2022-41040

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

• Used by Outlook and EAS [Exchange ActiveSync] clients to find and connect to mailboxes in Exchange - Naked Security - Sophos
• Because we are aware of active exploits of related vulnerabilities (limited targeted attacks), our recommendation is to install these updates immediately to be protected against these attacks - Security Affairs

Headlines

• Nov. 22, 2022 - How to hack an unpatched Exchange server with rogue PowerShell code
• Nov. 20, 2022 - PoC exploit code for ProxyNotShell Microsoft Exchange bugs released online

CVE-2022-36449

MEDIUM CVSS 6.50

Risk Context N/A

Published: Sept. 1, 2022

An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory, write a limited amount outside of buffer bounds, or to disclose details of memory mappings. This affects Midgard r4p0 through r32p0, Bifrost r0p0 through r38p0 and r39p0 before r38p1, and Valhall r19p0 through r38p0 and r39p0 before r38p1.

Vendor Impacted: Arm

Products Impacted: Bifrost, Valhall, Midgard

Quotes

• Update from Android and Pixel, wrote GPZ researcher, Tim Willis, on Tuesday in all five bug reports - Latest news
• These fixes have not yet made it downstream to affected Android devices (including Pixel, Samsung, Xiaomi, Oppo, and others) - The Hacker News

Headlines

• Nov. 25, 2022 - Google says a months-old security vulnerability still hasn’t been patched on Pixel, Samsung
• Nov. 25, 2022 - Google warns: Android 'patch gap' is leaving these smartphones vulnerable to attack
• Nov. 25, 2022 - Google Researchers Warn Million of Android Smartphones Prone to Hacking Due to Bug in One of Graphics - LatestLY
• Nov. 24, 2022 - Millions of Android Devices Still Don't Have Patches for Mali GPU Flaws

CVE-2022-33917

MEDIUM CVSS 5.50

Risk Context N/A

Published: Aug. 2, 2022

An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0). A non-privileged user can make improper GPU processing operations to gain access to already freed memory.

Vendor Impacted: Arm

Product Impacted: Valhall Gpu Kernel Driver

Quotes

• Update from Android and Pixel, wrote GPZ researcher, Tim Willis, on Tuesday in all five bug reports - Latest news
• These fixes have not yet made it downstream to affected Android devices (including Pixel, Samsung, Xiaomi, Oppo, and others) - The Hacker News

Headlines

• Nov. 25, 2022 - Google says a months-old security vulnerability still hasn’t been patched on Pixel, Samsung
• Nov. 25, 2022 - Google warns: Android 'patch gap' is leaving these smartphones vulnerable to attack
• Nov. 25, 2022 - Unfixed ARM Mali GPU Security Gaps Leaves Millions Of Android Users Vulnerable - Lowyat.NET
• Nov. 24, 2022 - Millions of Android devices at risk of attack due to Arm Mali GPU driver flaws
• Nov. 24, 2022 - Millions of Android Devices Still Don't Have Patches for Mali GPU Flaws

CVE-2021-35395

CRITICAL CVSS 9.80

CISA Known Exploited

Published: Aug. 16, 2021

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affected by these vulnerabilities. Specifically, these binaries are vulnerable to the following issues: - stack buffer overflow in formRebootCheck due to unsafe copy of submit-url parameter - stack buffer overflow in formWsc due to unsafe copy of submit-url parameter - stack buffer overflow in formWlanMultipleAP due to unsafe copy of submit-url parameter - stack buffer overflow in formWlSiteSurvey due to unsafe copy of ifname parameter - stack buffer overflow in formStaticDHCP due to unsafe copy of hostname parameter - stack buffer overflow in formWsc due to unsafe copy of 'peerPin' parameter - arbitrary command execution in formSysCmd via the sysCmd parameter - arbitrary command injection in formWsc via the 'peerPin' parameter Exploitability of identified issues will differ based on what the end vendor/manufacturer did with the Realtek SDK webserver. Some vendors use it as-is, others add their own authentication implementation, some kept all the features from the server, some remove some of them, some inserted their own set of features. However, given that Realtek SDK implementation is full of insecure calls and that developers tends to re-use those examples in their custom code, any binary based on Realtek SDK webserver will probably contains its own set of issues on top of the Realtek ones (if kept). Successful exploitation of these issues allows remote attackers to gain arbitrary code execution on the device.

Vendor Impacted: Realtek

Product Impacted: Jungle Software Development Kit (Sdk)

Quotes

• Without developers managing the Boa Web server, its known vulnerabilities could allow attackers to silently gain access to networks by collecting information from files - Dark Reading
• Vulnerable component on all the IP addresses published as IOCs - Latest news

Headlines

• Nov. 23, 2022 - Microsoft: Popular IoT SDKs Leave Critical Infrastructure Wide Open to Cyberattack
• Nov. 23, 2022 - Microsoft warns: This forgotten open-source web server could let hackers 'silently' gain access to your system

CVE-2021-33558

HIGH CVSS 7.50

Actively Exploited Public Exploits Available

Published: May 27, 2021

Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js.

Vendor Impacted: Boa

Product Impacted: Boa

Quotes

• Investigating the headers further indicated that over 10% of all active IP addresses returning the headers were related to critical industries, such as the petroleum industry and associated fleet services, with many of the IP addresses associated to IoT devices, such as routers, with unpatched critical vulnerabilities, highlighting an accessible attack vector for malware operators - Security Affairs
• Found evidence of a supply chain risk that may affect millions of organizations and devices - The Register - Security
• Without developers managing the Boa Web server, its known vulnerabilities could allow attackers to silently gain access to networks by collecting information from files - Dark Reading
• Vulnerable component on all the IP addresses published as IOCs - Latest news
• Microsoft assesses that Boa servers were running on the IP addresses on the list of IOCs published by Recorded Future at the time of the report's release and that the electrical grid attack targeted exposed IoT devices running Boa - SecurityWeek
• Supply chain risk that may affect millions of organizations and devices - The Hacker News

Headlines

• Nov. 24, 2022 - Threat actors exploit discontinues Boa web servers to target critical infrastructure
• Nov. 24, 2022 - Hackers attacking energy sector using decades-old software, says Microsoft - TechCircle
• Nov. 24, 2022 - Microsoft Says Attackers Are Hacking Energy Grids By Exploiting Decades-Old Software
• Nov. 23, 2022 - Microsoft Says Attackers Are Hacking Energy Grids By Exploiting Old Software
• Nov. 23, 2022 - Still using a discontinued Boa web server? Microsoft warns of supply chain attacks
• Nov. 23, 2022 - Microsoft Claims Hackers Use Obsolete Boa Software to Hijack Electrical Infrastructure
• Nov. 23, 2022 - Microsoft: Popular IoT SDKs Leave Critical Infrastructure Wide Open to Cyberattack
• Nov. 23, 2022 - Microsoft says attackers are hacking energy grids by exploiting decades-old software - TechCrunch
• Nov. 23, 2022 - Energy firms hacked via flaws in discontinued server
• Nov. 23, 2022 - Microsoft warns: This forgotten open-source web server could let hackers 'silently' gain access to your system
• Nov. 23, 2022 - Microsoft Warns of Boa Web Server Risks After Hackers Target It in Power Grid Attacks
• Nov. 23, 2022 - Hackers Exploiting Abandoned Boa Web Servers to Target Critical Industries
• Nov. 22, 2022 - Discontinued Web Server Poses IoT Security Risks - Duo Security

CVE-2017-9833

HIGH CVSS 7.80

Actively Exploited

Published: June 24, 2017

/cgi-bin/wapopen in BOA Webserver 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges.

Vendor Impacted: Boa

Product Impacted: Boa

Quotes

• Investigating the headers further indicated that over 10% of all active IP addresses returning the headers were related to critical industries, such as the petroleum industry and associated fleet services, with many of the IP addresses associated to IoT devices, such as routers, with unpatched critical vulnerabilities, highlighting an accessible attack vector for malware operators - Security Affairs
• Found evidence of a supply chain risk that may affect millions of organizations and devices - The Register - Security
• Without developers managing the Boa Web server, its known vulnerabilities could allow attackers to silently gain access to networks by collecting information from files - Dark Reading
• Vulnerable component on all the IP addresses published as IOCs - Latest news
• Microsoft assesses that Boa servers were running on the IP addresses on the list of IOCs published by Recorded Future at the time of the report's release and that the electrical grid attack targeted exposed IoT devices running Boa - SecurityWeek
• Supply chain risk that may affect millions of organizations and devices - The Hacker News

Headlines

• Nov. 24, 2022 - Threat actors exploit discontinues Boa web servers to target critical infrastructure
• Nov. 24, 2022 - Hackers attacking energy sector using decades-old software, says Microsoft - TechCircle
• Nov. 23, 2022 - Still using a discontinued Boa web server? Microsoft warns of supply chain attacks
• Nov. 23, 2022 - Microsoft Claims Hackers Use Obsolete Boa Software to Hijack Electrical Infrastructure
• Nov. 23, 2022 - Microsoft: Popular IoT SDKs Leave Critical Infrastructure Wide Open to Cyberattack
• Nov. 23, 2022 - Microsoft says attackers are hacking energy grids by exploiting decades-old software - TechCrunch
• Nov. 23, 2022 - Energy firms hacked via flaws in discontinued server
• Nov. 23, 2022 - Microsoft warns: This forgotten open-source web server could let hackers 'silently' gain access to your system
• Nov. 23, 2022 - Microsoft Warns of Boa Web Server Risks After Hackers Target It in Power Grid Attacks
• Nov. 23, 2022 - Hackers Exploiting Abandoned Boa Web Servers to Target Critical Industries
• Nov. 22, 2022 - Discontinued Web Server Poses IoT Security Risks - Duo Security