VULNERA Pulse

Linux — Kernel

CVE-2021-3493 / Added: Oct. 20, 2022

HIGH CVSS 7.80

The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

Headlines

• Oct. 21, 2022 - CISA adds Linux kernel flaw CVE-2021-3493 to its Known Exploited Vulnerabilities Catalog
• Sept. 7, 2022 - Next-Gen Linux Malware Takes Over Devices With Unique Toolset
• Sept. 7, 2022 - This stealthy Linux malware starts off small but gradually takes control

Back to top ↑

Zimbra — Collaboration (ZCS)

CVE-2022-41352 / Added: Oct. 20, 2022

CRITICAL CVSS 9.80

Zimbra Collaboration (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

Headlines

• Oct. 17, 2022 - Over 900 servers have been hacked thanks to a Zimbra zero-day
• Oct. 17, 2022 - Zimbra Releases Patch for Actively Exploited Vulnerability in its Collaboration Suite
• Oct. 16, 2022 - Threat actors hacked hundreds of servers by exploiting Zimbra CVE-2022-41352 bug
• Oct. 13, 2022 - CVE-2022-41352 — vulnerability in Zimbra | Kaspersky official blog
• Oct. 13, 2022 - CVE-2022-41352 — vulnerability in Zimbra | Kaspersky official blog
• Oct. 13, 2022 - Ongoing exploitation of CVE-2022-41352 (Zimbra 0-day)
• Oct. 10, 2022 - Zimbra RCE Bug Under Active Attack
• Oct. 8, 2022 - Unpatched remote code execution flaw in Zimbra Collaboration Suite actively exploited
• Oct. 8, 2022 - Hackers Exploiting Unpatched RCE Flaw in Zimbra Collaboration Suite
• Oct. 7, 2022 - Ongoing 0-day attacks backdoor Zimbra servers by sending a malicious email
• Oct. 7, 2022 - Hackers exploiting unpatched RCE bug in Zimbra Collaboration Suite

Back to top ↑

CVE-2022-40684

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

Published: Oct. 18, 2022

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

Vendor Impacted: Fortinet

Products Impacted: Fortiswitchmanager, Fortios, Fortiproxy, Multiple Products

Quotes

• And as critical as Twitter is, we have the exact same dynamic with our privatized water and power companies - who have no plans to make strategic investments in security or anything really - which is why on public calls you can hear them humiliating themselves asking Jen Easterly to absorb the entire costs of their security programs - Open Source Security
• Stream over 90 million songs, all ad-free - Open Source Security
• After multiple notifications from Fortinet over the past week, there are still a significant number of devices that require mitigation, and following the publication by an outside party of POC code, there is active exploitation of this vulnerability. Based on this development, Fortinet again recommends customers and partners take urgent and immediate action as described in the public Advisory - Security Affairs
• After multiple notifications from Fortinet over the past week, there are still a significant number of devices that require mitigation, and following the publication by an outside party of POC code, there is active exploitation of this vulnerability - Securityweek.com

Headlines

• Oct. 19, 2022 - ISIS-3128: CVE-2022-42467: Apache Isis: h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.
• Oct. 18, 2022 - CVE-2022-2602 - Linux kernel io_uring UAF
• Oct. 18, 2022 - Over 17000 Fortinet devices exposed online are very likely vulnerable to CVE-2022-40684
• Oct. 17, 2022 - Fortinet Admits Many Devices Still Unprotected Against Exploited Vulnerability
• Oct. 16, 2022 - APPLE-SA-2022-10-10-1 iOS 16.0.3
• Oct. 15, 2022 - Fortinet urges admins to patch bug with public exploit immediately

CVE-2022-42889

CRITICAL CVSS 9.80

Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 13, 2022

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Vendors Impacted: Apache, Netapp

Products Impacted: Bluexp, Commons Text

Quotes

• The StringSubstitutor when used with the default interpolators (StringSubstitutor.createInterpolator()) will perform string lookups that may lead to arbitrary code execution - Security Affairs
• While the vulnerability itself is similar to last year's vulnerability CVE-2021-44228 in Apache's log4j library, the Apache Commons Text library is far less widely used in an unsafe manner and the likelihood of successful exploitation is significantly lower - Dark Reading
• The vast majority of requests we are seeing are using the DNS prefix and are intended to scan for vulnerable installations - a successful attempt would result in the victim site making a DNS query to the attacker-controlled listener domain - SecurityWeek
• Fortunately, not all users of this library would be affected by this vulnerability - unlike Log4J in the Log4Shell vulnerability, which was vulnerable even in its most basic use-cases - Internet
• ACT provides an API to perform variable interpolation - or substitution - allowing properties to be dynamically evaluated and expanded - Dark Reading
• Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers - BleepingComputer
• And as critical as Twitter is, we have the exact same dynamic with our privatized water and power companies - who have no plans to make strategic investments in security or anything really - which is why on public calls you can hear them humiliating themselves asking Jen Easterly to absorb the entire costs of their security programs - Open Source Security
• The vulnerability is indeed very similar - The Daily Swig | Cybersecurity news and views
• Stream over 90 million songs, all ad-free - Open Source Security
• We don't have any Java-based web servers, because we only use Java in our internal business logic, so we think we're immune to this one - Naked Security - Sophos
• The nature of the vulnerability means that unlike Log4Shell, it will be rare that an application uses the vulnerable component of Commons Text to process untrusted, potentially malicious input - SecurityWeek

Headlines

• Oct. 21, 2022 - Experts warn of CVE-2022-42889 Text4Shell exploit attempts
• Oct. 21, 2022 - Exploit Attempts Underway for Apache Commons Text4Shell Vulnerability
• Oct. 21, 2022 - Text4Shell Vulnerability Exploitation Attempts Started Soon After Disclosure
• Oct. 21, 2022 - Hackers Started Exploiting Critical "Text4Shell" Apache Commons Text Vulnerability
• Oct. 21, 2022 - Apache Commons Text Flaw Not a Repeat of Log4Shell
• Oct. 20, 2022 - Threat Advisory: Monitoring CVE-2022-42889 “Text4Shell” Exploit Attempts
• Oct. 19, 2022 - Text4Shell, a remote code execution bug in Apache Commons Text library
• Oct. 19, 2022 - Apache Commons Vulnerability: Patch but Don't Panic
• Oct. 19, 2022 - Apache Commons Text RCE flaw — Keep calm and patch away
• Oct. 19, 2022 - ISIS-3128: CVE-2022-42467: Apache Isis: h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.
• Oct. 19, 2022 - Apache Commons Text RCE: Resemblance to Log4Shell but exposure risk is ‘much lower’
• Oct. 18, 2022 - Apache Commons Text vulnerability CVE-2022-42889
• Oct. 18, 2022 - CVE-2022-2602 - Linux kernel io_uring UAF
• Oct. 18, 2022 - Dangerous hole in Apache Commons Text – like Log4Shell all over again
• Oct. 18, 2022 - Critical Apache Commons Text Flaw Compared to Log4Shell, But Not as Widespread
• Oct. 17, 2022 - Researchers Keep a Wary Eye on Critical New Vulnerability in Apache Commons Text
• Oct. 16, 2022 - APPLE-SA-2022-10-10-1 iOS 16.0.3

CVE-2022-35829

MEDIUM CVSS 4.80

Risk Context N/A

Published: Oct. 11, 2022

Service Fabric Explorer Spoofing Vulnerability.

Quotes

• We found that a Deployer type user with a single permission to 'Create new Applications' via the dashboard, can use this single permission to create a malicious application name and abuse the Administrator permissions to perform various calls and actions - BleepingComputer
• Many kinds of users in a shared dashboard. For example, a Fabric Cluster that is maintained and controlled by an Administrator from Organization X, can also offer services to its clients from the same organization - Security Affairs
• This includes performing a Cluster Node reset, which erases all customized settings such as passwords and security configurations, allowing an attacker to create new passwords and gain full Administrator permissions - Internet
• Orca is unsure why it has not yet been removed or when [Microsoft] plans to do so - The Register - Security

Headlines

• Oct. 19, 2022 - Microsoft Azure SFX bug let hackers hijack Service Fabric clusters
• Oct. 19, 2022 - Researchers share of FabriXss bug impacting Azure Fabric Explorer
• Oct. 19, 2022 - Microsoft Patches Vulnerability Allowing Full Access to Azure Service Fabric Clusters
• Oct. 19, 2022 - Researchers Detail Azure SFX Flaw That Could've Allowed Attackers to Gain Admin Access
• Oct. 19, 2022 - Tear in Microsoft Azure Service Fabric can give attackers full admin privileges
• Oct. 19, 2022 - Awareness and guidance related to potential Service Fabric Explorer (SFX) v1 web client risk

CVE-2022-41040

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

• And as critical as Twitter is, we have the exact same dynamic with our privatized water and power companies - who have no plans to make strategic investments in security or anything really - which is why on public calls you can hear them humiliating themselves asking Jen Easterly to absorb the entire costs of their security programs - Open Source Security
• Stream over 90 million songs, all ad-free - Open Source Security
• Advertising sites, affiliate links, false products, fake search engine results, or in some cases by redirecting users into parked domains reserved for very short-lived phishing campaigns - Digital Trends

Headlines

• Oct. 19, 2022 - Two Weeks of Monitoring ProxyNotShell (CVE-2022-41040 & CVE-2022-41082) Threat Activity
• Oct. 19, 2022 - ISIS-3128: CVE-2022-42467: Apache Isis: h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.
• Oct. 18, 2022 - CVE-2022-2602 - Linux kernel io_uring UAF
• Oct. 17, 2022 - Microsoft Edge now warns when your typos can lead to being phished
• Oct. 16, 2022 - APPLE-SA-2022-10-10-1 iOS 16.0.3

CVE-2022-41352

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited

Published: Sept. 26, 2022

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavisd automatically prefers it over cpio.

Vendor Impacted: Zimbra

Products Impacted: Collaboration, Collaboration (Zcs)

Quotes

• Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters - SecurityWeek
• An attacker can use cpio package to gain incorrect access to any other user accounts - Internet
• CVE-2022-41352 is an unpatched remote code execution vulnerability in Zimbra Collaboration Suite discovered in the wild due to active exploitation - Security Affairs

Headlines

• Oct. 21, 2022 - CISA adds Linux kernel flaw CVE-2021-3493 to its Known Exploited Vulnerabilities Catalog
• Oct. 17, 2022 - Zimbra Patches Under-Attack Code Execution Bug
• Oct. 17, 2022 - Over 900 servers have been hacked thanks to a Zimbra zero-day
• Oct. 17, 2022 - Zimbra Releases Patch for Actively Exploited Vulnerability in its Collaboration Suite
• Oct. 16, 2022 - Threat actors hacked hundreds of servers by exploiting Zimbra CVE-2022-41352 bug
• Oct. 15, 2022 - Almost 900 servers hacked using Zimbra zero-day flaw

CVE-2022-39197

MEDIUM CVSS 6.10

Public Exploits Available

Published: Sept. 22, 2022

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

Quotes

• Specifies whether XSS validation is performed on selected Beacon metadata - The Daily Swig | Cybersecurity news and views
• Certain components within Java Swing will automatically interpret any text as HTML content if it starts with < html > - infosecurity-magazine.com
• Certain components within Java Swing will automatically interpret any text as HTML content if it starts with . This can be exploited using an object tag, which in turn can load a malicious payload from a webserver, which is then executed by the Cobalt Strike client - Security Affairs
• The XSS vulnerability could be triggered by manipulating some client-side UI input fields, by simulating a Cobalt Strike implant check-in or by hooking a Cobalt Strike implant running on a host - Internet

Headlines

• Oct. 21, 2022 - Failed Cobalt Strike fix with buried RCE exploit now patched
• Oct. 18, 2022 - HelpSystems Patch Falls Short, RCE Vulnerability in Cobalt Strike Remains
• Oct. 18, 2022 - Critical Remote Code Execution issue impacts popular post-exploitation toolkit Cobalt Strike
• Oct. 18, 2022 - Critical RCE Vulnerability Discovered in Popular Cobalt Strike Hacking Software
• Oct. 17, 2022 - Analysis of a Remote Code Execution (RCE) Vulnerability in Cobalt Strike 4.7.1

CVE-2022-22954

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: April 11, 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Vendor Impacted: Vmware

Products Impacted: Workspace One Access And Identity Manager, Vrealize Suite Lifecycle Manager, Vrealize Automation, Cloud Foundation

Quotes

• Although the critical vulnerability CVE-2022-22954 is already patched in April, there are still multiple malware campaigns trying to exploit it - Ars Technica
• The attacker intends to utilize a victim's resources as much as possible, not only to install RAR1Ransom for extortion, but also to spread GuardMiner to collect cryptocurrency - The Hacker News

Headlines

• Oct. 21, 2022 - Ransomware, crypto miner, and botnet malware installed using patched VMware bug
• Oct. 21, 2022 - Hackers exploit critical VMware flaw to drop ransomware, miners
• Oct. 21, 2022 - Multiple Campaigns Exploit VMware Vulnerability to Deploy Crypto Miners and Ransomware
• Oct. 21, 2022 - Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability

CVE-2021-4034

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Public Exploits Available

Published: Jan. 28, 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Vendors Impacted: Suse, Canonical, Oracle, Red Hat, Starwindsoftware, Redhat

Products Impacted: Linux Enterprise High Performance Co, Linux Enterprise Desktop, Enterprise Linux Eus, Starwind Virtual San, Enterprise Linux Workstation, Enterprise Linux Server Tus, Linux Enterprise Workstation Extensi, Enterprise Linux Desktop, Enterprise Linux Server Update Servi, Enterprise Linux For Scientific Comp, Enterprise Linux, Manager Server, Http Server, Enterprise Linux Server Eus, Enterprise Linux For Power Big Endia, Enterprise Linux Server Aus, Starwind Hyperconverged Appliance, Ubuntu Linux, Enterprise Linux For Ibm Z Systems, Enterprise Linux Server, Enterprise Linux For Ibm Z Systems E, Enterprise Storage, Command Center, Zfs Storage Appliance Kit, Linux Enterprise Server, Enterprise Linux For Power Little En, Polkit, Manager Proxy

Quotes

• Threat actors are rapidly adopting off-the-shelf C2 frameworks to carry out their operations - Freerepublic.com

Headlines

• Oct. 21, 2022 - CISA adds Linux kernel flaw CVE-2021-3493 to its Known Exploited Vulnerabilities Catalog
• Oct. 21, 2022 - CISA Tells Organizations to Patch Linux Kernel Vulnerability Exploited by Malware
• Oct. 20, 2022 - Malware Attack Framework “Alchimist” Designed to Exploit Macs
• Oct. 17, 2022 - New Alchimist attack framework hits Windows, Linux and Mac

CVE-2021-44228

CRITICAL CVSS 10.00

CISA Known Exploited Actively Exploited Public Exploits Available

Published: Dec. 10, 2021

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Vendors Impacted: Apache, Intel, Bentley, Snowsoftware, Cisco, Percussion, Netapp, Siemens

Products Impacted: Finesse, Optical Network Controller, Crosswork Data Gateway, Cloudcenter, Iot Operations Dashboard, Sppa-T3000 Ses3000, Evolved Programmable Network Manager, Unified Workforce Optimization, Data Center Network Manager, Emergency Responder, Cloud Connect, Network Insights For Data Center, Crosswork Platform Infrastructure, Contact Center Management Portal, Crosswork Optimization Engine, Unified Communications Manager Im \&, Virtualized Voice Browser, Cloudcenter Suite, Crosswork Network Controller, Unity Connection, Smart Phy, Fxos, Cloudcenter Suite Admin, Sppa-T3000 Ses3000 Firmware, Crosswork Network Automation, Contact Center Domain Manager, Broadworks, Business Process Automation, Vm Access Proxy, Unified Contact Center Express, Enterprise Chat And Email, Connected Analytics For Network Depl, Ucs Central Software, Workload Optimization Manager, Dna Spaces, Rhythmyx, Synchro 4d, Dna Spaces Connector, Connected Mobile Experiences, Firepower Threat Defense, Mobility Services Engine, Cyber Vision Sensor Management Exten, Video Surveillance Manager, Virtual Topology System, Fog Director, Snapcenter, Ucs Central, Unified Sip Proxy, Snow Commander, Prime Service Catalog, Unified Computing System, Ucs Director, Cloudcenter Workload Manager, Advanced Malware Protection Virtual , Identity Services Engine, Cx Cloud Agent, Sd-Wan Vmanage, Log4j2, Unified Contact Center Enterprise, Wan Automation Engine, Intersight Virtual Appliance, Unified Intelligence Center, Nexus Insights, Packaged Contact Center Enterprise, Webex Meetings Server, Common Services Platform Collector, Log4j, Dna Spaces\, Paging Server, Unified Contact Center Management Po, Virtualized Infrastructure Manager, Nexus Dashboard, Data Center Manager, Customer Experience Cloud Agent, Network Dashboard Fabric Controller, Integrated Management Controller Sup, Dna Center, Unified Communications Manager, Cloudcenter Cost Optimizer, Video Surveillance Operations Manage, Network Services Orchestrator, Unified Communications Manager Im An, Cyber Vision, Oneapi Sample Browser, Synchro, Crosswork Zero Touch Provisioning, Ontap Tools, Automated Subsea Tuning, Network Assurance Engine, Unified Customer Voice Portal

Quotes

• While the vulnerability itself is similar to last year's vulnerability CVE-2021-44228 in Apache's log4j library, the Apache Commons Text library is far less widely used in an unsafe manner and the likelihood of successful exploitation is significantly lower - Dark Reading
• The StringSubstitutor when used with the default interpolators (StringSubstitutor.createInterpolator()) will perform string lookups that may lead to arbitrary code execution - Securityaffairs.co

Headlines

• Oct. 21, 2022 - Exploit Attempts Underway for Apache Commons Text4Shell Vulnerability
• Oct. 20, 2022 - Threat Advisory: Monitoring CVE-2022-42889 “Text4Shell” Exploit Attempts
• Oct. 19, 2022 - Text4Shell, a remote code execution bug in Apache Commons Text library