VULNERA Pulse

Atlassian — Bitbucket Server and Data Center

CVE-2022-36804 / Added: Sept. 30, 2022

HIGH CVSS 8.80

Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

Headlines

• Oct. 5, 2022 - Atlassian is being actively exploited to compromise corporate networks
• Oct. 4, 2022 - Atlassian, Microsoft bugs on CISA’s must-patch list after exploitation spree
• Oct. 1, 2022 - CISA Warns of Hackers Exploiting Critical Atlassian Bitbucket Server Vulnerability
• Sept. 4, 2022 - Week in review: CISOs' earnings per year, Atlassian Bitbucket Server and Data Center flaw
• Aug. 29, 2022 - Critical hole in Atlassian Bitbucket allows any miscreant to hijack servers
• Aug. 29, 2022 - Patch critical flaw in Atlassian Bitbucket Server and Data Center! (CVE-2022-36804)
• Aug. 26, 2022 - Critical command injection vulnerability discovered in Bitbucket Server and Data Center

Back to top ↑

Microsoft — Exchange Server

CVE-2022-41082 / Added: Sept. 30, 2022

HIGH CVSS 8.80

Microsoft Exchange Server contains an unspecified vulnerability which allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.

Headlines

• Nov. 9, 2022 - Microsoft Patch Tuesday updates fix 6 actively exploited zero-days
• Nov. 9, 2022 - Microsoft squashes six security bugs already exploited in the wild
• Oct. 4, 2022 - Reducing zero-day vulnerability in Microsoft Exchange Server with Citrix Web App Firewall
• Oct. 4, 2022 - Hackers can easily bypass mitigation for Microsoft Exchange security vulnerabilities
• Oct. 3, 2022 - Two Microsoft Exchange zero-days exploited in the wild. - The CyberWire

Back to top ↑

Microsoft — Exchange Server

CVE-2022-41040 / Added: Sept. 30, 2022

HIGH CVSS 8.80

Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.

Headlines

• Nov. 22, 2022 - How to hack an unpatched Exchange server with rogue PowerShell code
• Nov. 20, 2022 - PoC exploit code for ProxyNotShell Microsoft Exchange bugs released online
• Nov. 15, 2022 - What are Dating Apps Doing to Protect Their Users?
• Nov. 11, 2022 - Why CVE Management as a Primary Strategy Doesn't Work
• Nov. 9, 2022 - Exchange 0-days fixed (at last) – plus 4 brand new Patch Tuesday 0-days!
• Nov. 9, 2022 - Microsoft just released a whole host of security fixes, so patch now
• Nov. 9, 2022 - Microsoft Patches Six Zero-Day Bugs this Month
• Nov. 9, 2022 - Windows Security: Users Urged To Update As 4 New Zero-Day Attacks Confirmed
• Nov. 9, 2022 - Patches for 6 zero-days under active exploit are now available from Microsoft
• Oct. 24, 2022 - IoT Fingerprinting Helps Authenticate and Secure All Those Devices
• Oct. 17, 2022 - Microsoft Edge now warns when your typos can lead to being phished
• Oct. 14, 2022 - Microsoft 365 Message Encryption Can Leak Sensitive Info
• Oct. 12, 2022 - Microsoft adds new RSS feed for security update notifications
• Oct. 12, 2022 - Microsoft October 2022 Patch Tuesday Fixes 84 Flaws, Including Zero-Day
• Oct. 12, 2022 - LockBit Ransomware Deployed via Windows Exchange Server Hack - MUO - MakeUseOf
• Oct. 11, 2022 - It’s Patch Tuesday and still no fix for ProxyNotShell Microsoft Exchange holes
• Oct. 9, 2022 - Week in review: 7 cybersecurity audiobooks to read, Patch Tuesday forecast
• Oct. 8, 2022 - Microsoft Issues Improved Mitigations for Unpatched Exchange Server Vulnerabilities
• Oct. 7, 2022 - GreenboneOS: New zero-day exploit in Microsoft Exchange Server
• Oct. 5, 2022 - Microsoft updates mitigation for ProxyNotShell Exchange zero days
• Oct. 5, 2022 - Mitigation for Exchange Zero-Days Bypassed! Microsoft Issues New Workarounds
• Oct. 4, 2022 - Microsoft Updates Mitigation for Exchange Server Zero-Days
• Oct. 4, 2022 - ProxyNotShell – the New Proxy Hell?
• Oct. 4, 2022 - Microsoft mitigations for recently disclosed Exchange zero-days can be easily bypassed
• Oct. 4, 2022 - Microsoft Exchange Serverに複数の脆弱性
• Oct. 4, 2022 - This dangerous vulnerability tricks researchers by mimicking old threats
• Oct. 3, 2022 - VU#915563: Microsoft Exchange vulnerable to server-side request forgery and remote code execution.
• Oct. 3, 2022 - Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub
• Oct. 3, 2022 - Microsoft mitigation for new Exchange Server zero-day exploits can be bypassed
• Oct. 3, 2022 - There’s good and bad news about the Microsoft Exchange server zero-day exploit
• Oct. 3, 2022 - Microsoft confirms hackers are actively exploiting Exchange zero-day flaws
• Oct. 1, 2022 - Microsoft Says Fix For Two Exchange Zero Days On Accelerated Timeline
• Oct. 1, 2022 - S3 Ep102.5: “ProxyNotShell” Exchange bugs – an expert speaks [Audio + Text]
• Oct. 1, 2022 - New Microsoft Security Alert: Exchange 0-Days Confirmed, State-Sponsored Attacks Underway
• Oct. 1, 2022 - Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082
• Sept. 30, 2022 - URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”
• Sept. 30, 2022 - CISA: Hackers exploit critical Bitbucket Server flaw in attacks
• Sept. 30, 2022 - Microsoft: Two New 0-Day Flaws in Exchange Server
• Sept. 30, 2022 - Microsoft confirms zero-day bugs actively targeted zero-day exploits in Exchange
• Sept. 30, 2022 - Microsoft confirms attackers actively targeting vulnerabilities in Exchange
• Sept. 30, 2022 - Microsoft Releases Guidance on Zero-Day Vulnerabilities in Microsoft Exchange Server
• Sept. 30, 2022 - Microsoft Confirms Pair of Blindsiding Exchange Zero-Days, No Patch Yet
• Sept. 30, 2022 - Microsoft Warns About New Zero-Day Vulnerabilities in Exchange Server
• Sept. 30, 2022 - New Exchange Server zero-day vulnerabilities are being used in cyberattacks: Protect your network now
• Sept. 30, 2022 - Microsoft Confirms Two Exchange Zero-Day Vulnerabilities
• Sept. 30, 2022 - Microsoft issues advisory about two 0-day vulnerabilities in Exchange Server, no fix yet
• Sept. 30, 2022 - Microsoft Confirms Exploitation of Two Exchange Server Zero-Days
• Sept. 30, 2022 - New Exchange Server zero-day vulnerabilities are being used in cyberattacks: Protect your network now
• Sept. 30, 2022 - Microsoft confirms two actively exploited zero-day vulnerabilities in Exchange Server
• Sept. 30, 2022 - Microsoft confirms Exchange zero-day flaws actively exploited in the wild
• Sept. 30, 2022 - Two Microsoft Exchange zero-days exploited by attackers (CVE-2022-41040, CVE-2022-41082)
• Sept. 30, 2022 - Microsoft Confirms 2 New Exchange Zero-Day Flaws Being Used in the Wild
• Sept. 30, 2022 - Microsoft confirms new Exchange zero-days are used in attacks
• Sept. 30, 2022 - Microsoft says new Exchange zero-days are actively exploited
• Sept. 30, 2022 - Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server

Back to top ↑

CVE-2022-32910

HIGH CVSS 7.50

Risk Context N/A

Published: Nov. 1, 2022

A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5, Security Update 2022-005 Catalina. An archive may be able to bypass Gatekeeper.

Vendor Impacted: Apple

Products Impacted: Macos, Mac Os X

Quotes

• Although our testing was done with Apple Archives, the same bypass can be achieved with other archive formats such as .ZIP archives, in which case the .ZIP file could be created while within the app directory - Dark Reading
• Install Security Responses & System Files - AppleInsider
• When it comes to application bundles -- Gatekeeper only cares if the app directory itself has a quarantine attribute set and disregards recursive files within the app bundle. Therefore, we can bypass Gatekeeper by ensuring that our non-quarantined folder is an application - TechRadar
• Could lead to the execution of an unsigned and unnotarized application without displaying security prompts to the user, by using a specially crafted archive - The Hacker News

Headlines

• Oct. 7, 2022 - New macOS Archive Utility Vulnerability Allows Malware to Bypass Gatekeeper Security, But An Update Patches the Hole
• Oct. 6, 2022 - macOS Archive Utility Bug Lets Malicious Apps Bypass Security Checks
• Oct. 6, 2022 - Flaw in macOS Archive Utility could let attackers bypass Gatekeeper
• Oct. 6, 2022 - Nasty macOS bug could have let hackers dance past security protections
• Oct. 6, 2022 - Details Released for Recently Patched new macOS Archive Utility Vulnerability

CVE-2022-41082

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Remote Code Execution Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

• May also share location information with our partners, such as Cuebiq and its Partners, for tailored advertising, attribution, analytics, research and other purposes - Cisco Talos Blog
• Unnecessarily precise, and therefore insufficient - The Hacker News
• The '@' in the Microsoft-recommended - Dark Reading
• The URL pattern to detect/prevent the Exchange 0day provided in MSRC's blog post can easily be bypassed - BetaNews
• At this time, Microsoft is aware of limited targeted attacks using the two vulnerabilities to get into users' systems. In these attacks, CVE-2022-41040 can enable an authenticated attacker to remotely trigger CVE-2022-41082. It should be noted that authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either of the two vulnerabilities - Security Affairs
• Could allow an attacker the ability to perform remote code execution on affected Microsoft Exchange servers - Digital Trends
• There has been strong interest in the vulnerability from researchers and exploit brokers, and there are now multiple public exploits available - Theregister.com
• Microsoft observed these attacks in fewer than 10 organizations globally. MSTIC assesses with medium confidence that the single activity group is likely to be a state-sponsored organization - BleepingComputer
• It should be noted that authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either vulnerability - CSO Online
• Aware of limited targeted attacks - BleepingComputer
• A small number of targeted attacks - The Daily Swig | Cybersecurity news and views
• Small number of targeted attacks - Latest news
• Exchange is a juicy target for threat actors to exploit for two primary reasons - VentureBeat
• An attacker with access to a public Bitbucket repository or with read permissions to a private one can execute arbitrary code by sending a malicious HTTP request - SecurityWeek
• Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019. The first one, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, and the second one, identified as CVE-2022-41082, allows Remote Code Execution (RCE) when PowerShell is accessible to the attacker - Thecyberwire.com
• They don't appear to be widespread, yet there are a lot of Exchange servers out there that could be targeted - SC Magazine
• Hands-on-keyboard access, which the attackers used to perform Active Directory reconnaissance and data exfiltration - Forbes

Headlines

• Oct. 7, 2022 - GreenboneOS: New zero-day exploit in Microsoft Exchange Server
• Oct. 6, 2022 - Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
• Oct. 5, 2022 - Microsoft updates mitigation for ProxyNotShell Exchange zero days
• Oct. 5, 2022 - Mitigation for Exchange Zero-Days Bypassed! Microsoft Issues New Workarounds
• Oct. 4, 2022 - Reducing zero-day vulnerability in Microsoft Exchange Server with Citrix Web App Firewall
• Oct. 4, 2022 - Microsoft Updates Mitigation for Exchange Server Zero-Days
• Oct. 4, 2022 - Hackers can easily bypass mitigation for Microsoft Exchange security vulnerabilities
• Oct. 4, 2022 - ProxyNotShell – the New Proxy Hell?
• Oct. 4, 2022 - Microsoft mitigations for recently disclosed Exchange zero-days can be easily bypassed
• Oct. 4, 2022 - Microsoft Exchange Serverに複数の脆弱性
• Oct. 4, 2022 - This dangerous vulnerability tricks researchers by mimicking old threats
• Oct. 4, 2022 - Atlassian, Microsoft bugs on CISA’s must-patch list after exploitation spree
• Oct. 3, 2022 - Two Exchange Server vulns veer dangerously close to ProxyShell
• Oct. 3, 2022 - VU#915563: Microsoft Exchange vulnerable to server-side request forgery and remote code execution.
• Oct. 3, 2022 - Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub
• Oct. 3, 2022 - Microsoft mitigation for new Exchange Server zero-day exploits can be bypassed
• Oct. 3, 2022 - There’s good and bad news about the Microsoft Exchange server zero-day exploit
• Oct. 3, 2022 - Microsoft Exchange server zero-day mitigation can be bypassed
• Oct. 3, 2022 - Microsoft confirms zero-day exploits against Exchange Server in ‘limited’ attacks
• Oct. 3, 2022 - Microsoft: New Exchange Server zero-days already used in attacks, expect more to come
• Oct. 3, 2022 - Microsoft confirms hackers are actively exploiting Exchange zero-day flaws
• Oct. 3, 2022 - CISA Warns of Attacks Exploiting Recent Atlassian Bitbucket Vulnerability
• Oct. 3, 2022 - Two Microsoft Exchange zero-days exploited in the wild. - The CyberWire
• Oct. 1, 2022 - Microsoft Says Fix For Two Exchange Zero Days On Accelerated Timeline
• Oct. 1, 2022 - New Microsoft Security Alert: Exchange 0-Days Confirmed, State-Sponsored Attacks Underway
• Oct. 1, 2022 - Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082

CVE-2022-41040

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

• May also share location information with our partners, such as Cuebiq and its Partners, for tailored advertising, attribution, analytics, research and other purposes - Cisco Talos Blog
• Unnecessarily precise, and therefore insufficient - The Hacker News
• The '@' in the Microsoft-recommended - Dark Reading
• The URL pattern to detect/prevent the Exchange 0day provided in MSRC's blog post can easily be bypassed - BetaNews
• At this time, Microsoft is aware of limited targeted attacks using the two vulnerabilities to get into users' systems. In these attacks, CVE-2022-41040 can enable an authenticated attacker to remotely trigger CVE-2022-41082. It should be noted that authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either of the two vulnerabilities - Security Affairs
• Could allow an attacker the ability to perform remote code execution on affected Microsoft Exchange servers - Digital Trends
• There has been strong interest in the vulnerability from researchers and exploit brokers, and there are now multiple public exploits available - Theregister.com
• Microsoft observed these attacks in fewer than 10 organizations globally. MSTIC assesses with medium confidence that the single activity group is likely to be a state-sponsored organization - BleepingComputer
• It should be noted that authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either vulnerability - Csoonline.com
• Aware of limited targeted attacks - BleepingComputer
• A small number of targeted attacks - The Daily Swig | Cybersecurity news and views
• Small number of targeted attacks - Latest news
• Exchange is a juicy target for threat actors to exploit for two primary reasons - VentureBeat
• An attacker with access to a public Bitbucket repository or with read permissions to a private one can execute arbitrary code by sending a malicious HTTP request - SecurityWeek
• Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019. The first one, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, and the second one, identified as CVE-2022-41082, allows Remote Code Execution (RCE) when PowerShell is accessible to the attacker - Thecyberwire.com
• They don't appear to be widespread, yet there are a lot of Exchange servers out there that could be targeted - SC Magazine
• Oh, it's month-end, it's quarter-end, it's a frantic time...but tomorrow everyone gets a reset to $0 - Naked Security - Sophos
• Hands-on-keyboard access, which the attackers used to perform Active Directory reconnaissance and data exfiltration - Forbes

Headlines

• Oct. 7, 2022 - GreenboneOS: New zero-day exploit in Microsoft Exchange Server
• Oct. 6, 2022 - Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
• Oct. 5, 2022 - Microsoft updates mitigation for ProxyNotShell Exchange zero days
• Oct. 5, 2022 - Mitigation for Exchange Zero-Days Bypassed! Microsoft Issues New Workarounds
• Oct. 4, 2022 - Reducing zero-day vulnerability in Microsoft Exchange Server with Citrix Web App Firewall
• Oct. 4, 2022 - Microsoft Updates Mitigation for Exchange Server Zero-Days
• Oct. 4, 2022 - Hackers can easily bypass mitigation for Microsoft Exchange security vulnerabilities
• Oct. 4, 2022 - ProxyNotShell – the New Proxy Hell?
• Oct. 4, 2022 - Microsoft mitigations for recently disclosed Exchange zero-days can be easily bypassed
• Oct. 4, 2022 - Microsoft Exchange Serverに複数の脆弱性
• Oct. 4, 2022 - This dangerous vulnerability tricks researchers by mimicking old threats
• Oct. 4, 2022 - Atlassian, Microsoft bugs on CISA’s must-patch list after exploitation spree
• Oct. 3, 2022 - Two Exchange Server vulns veer dangerously close to ProxyShell
• Oct. 3, 2022 - VU#915563: Microsoft Exchange vulnerable to server-side request forgery and remote code execution.
• Oct. 3, 2022 - Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub
• Oct. 3, 2022 - Microsoft mitigation for new Exchange Server zero-day exploits can be bypassed
• Oct. 3, 2022 - There’s good and bad news about the Microsoft Exchange server zero-day exploit
• Oct. 3, 2022 - Microsoft Exchange server zero-day mitigation can be bypassed
• Oct. 3, 2022 - Microsoft confirms zero-day exploits against Exchange Server in ‘limited’ attacks
• Oct. 3, 2022 - Microsoft: New Exchange Server zero-days already used in attacks, expect more to come
• Oct. 3, 2022 - Microsoft confirms hackers are actively exploiting Exchange zero-day flaws
• Oct. 3, 2022 - CISA Warns of Attacks Exploiting Recent Atlassian Bitbucket Vulnerability
• Oct. 3, 2022 - Two Microsoft Exchange zero-days exploited in the wild. - The CyberWire
• Oct. 1, 2022 - Microsoft Says Fix For Two Exchange Zero Days On Accelerated Timeline
• Oct. 1, 2022 - S3 Ep102.5: “ProxyNotShell” Exchange bugs – an expert speaks [Audio + Text]
• Oct. 1, 2022 - New Microsoft Security Alert: Exchange 0-Days Confirmed, State-Sponsored Attacks Underway
• Oct. 1, 2022 - Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082

CVE-2022-36804

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Public Exploits Available

Published: Aug. 25, 2022

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Vendor Impacted: Atlassian

Products Impacted: Bitbucket Server And Data Center, Bitbucket

Quotes

• Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass - TechRadar
• There has been strong interest in the vulnerability from researchers and exploit brokers, and there are now multiple public exploits available - Theregister.com
• An attacker with access to a public Bitbucket repository or with read permissions to a private one can execute arbitrary code by sending a malicious HTTP request - SecurityWeek
• All versions of Bitbucket Server and Datacenter released after 6.10.17 including 7.0.0 and newer are affected, this means that all instances that are running any versions between 7.0.0 and 8.3.0 inclusive are affected by this vulnerability - The Hacker News

Headlines

• Oct. 5, 2022 - Atlassian is being actively exploited to compromise corporate networks
• Oct. 4, 2022 - Atlassian, Microsoft bugs on CISA’s must-patch list after exploitation spree
• Oct. 3, 2022 - CISA Warns of Attacks Exploiting Recent Atlassian Bitbucket Vulnerability
• Oct. 1, 2022 - CISA Warns of Hackers Exploiting Critical Atlassian Bitbucket Server Vulnerability

CVE-2021-21551

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Public Exploits Available

Published: May 4, 2021

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.

Vendor Impacted: Dell

Products Impacted: Dbutil 2 3.sys, Dbutil Driver

Quotes

• For the first time in the wild, the attackers were able to leverage CVE-2021-21551 for turning off the monitoring of all security solutions - News ≈ Packet Storm
• The most notable tool delivered by the attackers was a user-mode module that gained the ability to read and write kernel memory due to the CVE-2021-21551 vulnerability in a legitimate Dell driver - CSO Online
• The attackers then used their kernel memory write access to disable seven mechanisms the Windows operating system offers to monitor its actions, like registry, file system, process creation, event tracing etc., basically blinding security solutions in a very generic and robust way - Security Affairs
• The campaign started with spear-phishing emails containing malicious Amazon-themed documents and targeted an employee of an aerospace company in the Netherlands, and a political journalist in Belgium - The Hacker News
• The monitoring of all security solutions on compromised machines - SecurityWeek

Headlines

• Oct. 6, 2022 - No Fix In Sight For Loophole Plaguing a Key Windows Defense
• Oct. 5, 2022 - No fix in sight for mile-wide loophole plaguing a key Windows defense for years
• Oct. 5, 2022 - North Korea’s Lazarus group uses vulnerable Dell driver to blind security solutions
• Oct. 4, 2022 - Lazarus APT employed an exploit in a Dell firmware driver in recent attacks
• Oct. 3, 2022 - Hackers Exploiting Dell Driver Vulnerability to Deploy Rootkit on Targeted Computers
• Oct. 3, 2022 - Lazarus hackers target Dell drivers with new rootkit
• Oct. 3, 2022 - North Korean Hackers Exploit Dell Driver Vulnerability to Disable Windows Security
• Oct. 1, 2022 - Lazarus hackers abuse Dell driver bug using new FudModule rootkit

CVE-2021-27065

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 3, 2021

Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27078.

Vendor Impacted: Microsoft

Products Impacted: Microsoft Exchange Server, Exchange Server

Quotes

• NSA, CISA, and FBI continue to assess [People's Republic of China] PRC state-sponsored cyber activities as being one of the largest and most dynamic threats to U.S. government and civilian networks - ZDNet
• Target web-facing applications to establish initial access - iTnews - Security
• Protect against Russian-state sponsored malicious cyber activity - The Register - Security
• Although rarely used by attackers, if successfully executed, steganography can be leveraged to disguise malicious code in seemingly innocuous-looking image files - The Register - Security

Headlines

• Oct. 7, 2022 - NSA, FBI warning: Beware these 20 software flaws most used by hackers
• Oct. 7, 2022 - CISA to infosec: here’s China’s hit-list, why haven’t you patched?
• Oct. 5, 2022 - Cyber-snoops broke into US military contractor, stole data, hid for months
• Oct. 3, 2022 - Two Exchange Server vulns veer dangerously close to ProxyShell
• Oct. 3, 2022 - Windows Logo Weaponized By State-Backed Chinese APT10 Spies In Ongoing Attacks
• Oct. 2, 2022 - Steganography alert: Backdoor spyware stashed in Microsoft logo
• Oct. 2, 2022 - Stenography alert: Backdoor spyware stashed in Microsoft logo

CVE-2021-26858

HIGH CVSS 7.80

CISA Known Exploited Remote Code Execution

Published: March 3, 2021

Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-27065, CVE-2021-27078.

Vendor Impacted: Microsoft

Product Impacted: Microsoft Exchange Server

Quotes

• NSA, CISA, and FBI continue to assess [People's Republic of China] PRC state-sponsored cyber activities as being one of the largest and most dynamic threats to U.S. government and civilian networks - Latest news
• Target web-facing applications to establish initial access - iTnews - Security
• Protect against Russian-state sponsored malicious cyber activity - Theregister.com

Headlines

• Oct. 7, 2022 - NSA, FBI warning: Beware these 20 software flaws most used by hackers
• Oct. 7, 2022 - CISA to infosec: here’s China’s hit-list, why haven’t you patched?
• Oct. 5, 2022 - Cyber-snoops broke into US military contractor, stole data, hid for months
• Oct. 3, 2022 - Two Exchange Server vulns veer dangerously close to ProxyShell

CVE-2021-26857

HIGH CVSS 7.80

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: March 3, 2021

Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.

Vendor Impacted: Microsoft

Product Impacted: Microsoft Exchange Server

Quotes

• NSA, CISA, and FBI continue to assess [People's Republic of China] PRC state-sponsored cyber activities as being one of the largest and most dynamic threats to U.S. government and civilian networks - Latest news
• Target web-facing applications to establish initial access - iTnews - Security
• Protect against Russian-state sponsored malicious cyber activity - Theregister.com

Headlines

• Oct. 7, 2022 - NSA, FBI warning: Beware these 20 software flaws most used by hackers
• Oct. 7, 2022 - CISA to infosec: here’s China’s hit-list, why haven’t you patched?
• Oct. 5, 2022 - Cyber-snoops broke into US military contractor, stole data, hid for months
• Oct. 3, 2022 - Two Exchange Server vulns veer dangerously close to ProxyShell

CVE-2021-26855

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 3, 2021

Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.

Vendor Impacted: Microsoft

Products Impacted: Microsoft Exchange Server, Exchange Server

Quotes

• NSA, CISA, and FBI continue to assess [People's Republic of China] PRC state-sponsored cyber activities as being one of the largest and most dynamic threats to U.S. government and civilian networks - ZDNet
• Target web-facing applications to establish initial access - iTnews - Security
• Protect against Russian-state sponsored malicious cyber activity - The Register - Security
• Although rarely used by attackers, if successfully executed, steganography can be leveraged to disguise malicious code in seemingly innocuous-looking image files - The Register - Security

Headlines

• Oct. 7, 2022 - NSA, FBI warning: Beware these 20 software flaws most used by hackers
• Oct. 7, 2022 - CISA to infosec: here’s China’s hit-list, why haven’t you patched?
• Oct. 5, 2022 - Cyber-snoops broke into US military contractor, stole data, hid for months
• Oct. 3, 2022 - Two Exchange Server vulns veer dangerously close to ProxyShell
• Oct. 3, 2022 - Windows Logo Weaponized By State-Backed Chinese APT10 Spies In Ongoing Attacks
• Oct. 2, 2022 - Steganography alert: Backdoor spyware stashed in Microsoft logo
• Oct. 2, 2022 - Stenography alert: Backdoor spyware stashed in Microsoft logo

CVE-2019-16098

HIGH CVSS 7.80

Actively Exploited Used In Ransomware Public Exploits Available

Published: Sept. 11, 2019

The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.

Vendor Impacted: Msi

Product Impacted: Afterburner

Quotes

• Particular MSI drivers to an active blocklist - Tech Times
• The evasion technique supports disabling a whopping list of over 1,000 drivers on which security products rely to provide protection - The Hacker News
• Chances are good that they will continue abusing legitimate drivers to bypass security products - TechRadar
• The I/O control codes in RTCore64.sys are directly accessible by user-mode processes - SecurityWeek
• If you think of computers as a fortress, for many EDR providers, ETW is the guard at the front gate. If the guard goes down, then that leaves the rest of the system extremely vulnerable. And, because ETW is used by so many different providers, BlackByte's pool of potential targets for deploying this EDR bypass is enormous - Latest news
• Bring Your Own Vulnerable Driver - BleepingComputer
• That provides logs about the use of commonly maliciously abused API calls such as NtReadVirtualMemory to inject into another process's memory - Infosecurity Magazine
• Bring Your Own [Vulnerable] Driver - Sophos News

Headlines

• Oct. 7, 2022 - New Hacker Technique Lets Attackers Disable Antivirus Solutions and Infect the Users Device Anyway
• Oct. 7, 2022 - BlackByte Ransomware Abuses Vulnerable Windows Driver to Disable Security Solutions
• Oct. 6, 2022 - This devious malware is able to disable your antivirus
• Oct. 6, 2022 - BlackByte Ransomware Abuses Legitimate Driver to Disable Security Protections
• Oct. 6, 2022 - This sneaky ransomware attack tries to switch off your security software
• Oct. 5, 2022 - BlackByte ransomware abuses legit driver to disable security products
• Oct. 5, 2022 - Ransomware Group Bypasses "Enormous" Range of EDR Tools
• Oct. 4, 2022 - Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse