VULNERA Pulse

Apache — RocketMQ

CVE-2023-33246 / Added: Sept. 6, 2023

CRITICAL CVSS 9.80 EPSS Score 97.15 EPSS Percentile 99.70

Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.

Headlines

• Sept. 9, 2023 - US CISA added critical Apache RocketMQ flaw to its Known Exploited Vulnerabilities catalog
• Sept. 8, 2023 - CISA Adds Critical RocketMQ Bug to Must-Patch List
• Aug. 31, 2023 - Adversaries Ride RocketMQ Bug to DreamBus Bot Resurgence
• Aug. 30, 2023 - Alert: Juniper Firewalls, Openfire, and Apache RocketMQ Under Attack from New Exploits
• Aug. 30, 2023 - DreamBus Botnet Exploiting RocketMQ Vulnerability to Delivery Cryptocurrency Miner
• Aug. 30, 2023 - RocketMQ Vulnerability Exploited by DreamBus Malware
• Aug. 28, 2023 - DreamBus Botnet Resurfaces, Targets RocketMQ vulnerability | Official Blogs
• June 22, 2023 - CVE-2023-33246 Apache RocketMQ Remote Code Execution

Back to top ↑

CVE-2023-20238

CRITICAL CVSS 10.00 EPSS Score 0.05 EPSS Percentile 12.75

Actively Exploited

Published: Sept. 6, 2023

A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account. If that account is an Administrator account, the attacker would have the ability to view confidential information, modify customer settings, or modify settings for other users. To exploit this vulnerability, the attacker would need a valid user ID that is associated with an affected Cisco BroadWorks system.

Quotes

• This vulnerability is due to the method used to validate SSO (single sign-on) tokens
• Could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system
• This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account

Headlines

• Sept. 8, 2023 - Critical Security Bug Opens Cisco BroadWorks to Complete Takeover
• Sept. 8, 2023 - Cisco Issues Urgent Fix for Authentication Bypass Bug Affecting BroadWorks Platform
• Sept. 7, 2023 - Cisco BroadWorks impacted by critical authentication bypass flaw
• Sept. 7, 2023 - Cisco Patches Critical Vulnerability in BroadWorks Platform
• Sept. 7, 2023 - CVE-2023-20238 (CVSS score of 10): Cisco BroadWorks Authentication Bypass Vulnerability
• Sept. 7, 2023 - Cisco SSO authentication bug patched

CVE-2022-47966

CRITICAL CVSS 9.80 EPSS Score 97.44 EPSS Percentile 99.92

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Jan. 18, 2023

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections.

Vendors Impacted: Zoho, Zohocorp

Products Impacted: Manageengine Remote Access Plus, Manageengine Key Manager Plus, Manageengine Os Deployer, Manageengine, Manageengine Adaudit Plus, Manageengine Admanager Plus, Manageengine Servicedesk Plus Msp, Manageengine Analytics Plus, Manageengine Desktop Central, Manageengine Supportcenter Plus, Manageengine Endpoint Dlp Plus, Manageengine Vulnerability Manager P, Manageengine Pam360, Manageengine Servicedesk Plus, Manageengine Patch Manager Plus, Manageengine Access Manager Plus, Manageengine Device Control Plus, Manageengine Assetexplorer, Application Control Plus, Manageengine Password Manager Pro, Manageengine Browser Security Plus, Manageengine Ad360, Manageengine Rmm Central, Manageengine Adselfservice Plus

Quotes

• This vulnerability allows an unauthenticated adversary to execute arbitrary code when the above SAML SSO criteria is met
• CISA and co-sealers assess that beginning as early as January 2023, multiple nation-state APT actors were present on the organization’s network via at least two initial access vectors
• Nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network
• CISA, FBI, and CNMF confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network

Headlines

• Sept. 8, 2023 - Nation-state actors exploit Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus, CISA warns
• Sept. 8, 2023 - US Aeronautical Organization Hacked via Zoho, Fortinet Vulnerabilities
• Sept. 8, 2023 - CISA Warning: Nation-State Hackers Exploit Fortinet and Zoho Vulnerabilities
• Sept. 7, 2023 - Iranian hackers breach US aviation org via ManageEngine, Fortinet bugs
• Sept. 7, 2023 - Iranian hackers breach US aviation org via Zoho, Fortinet bugs
• Sept. 7, 2023 - CISA, FBI, and CNMF Release Advisory on Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475 | CISA

CVE-2022-42475

CRITICAL CVSS 9.80 EPSS Score 46.04 EPSS Percentile 96.95

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 2, 2023

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Vendor Impacted: Fortinet

Products Impacted: Fortigate-6500f, Fortigate-6501f, Fortigate-6500f-Dc, Fortigate-7030e, Fim-7901e, Fpm-7630e, Fim-7921f, Fpm-7620f, Fortiproxy, Fortigate-6501f-Dc, Fim-7920e, Fortigate-7060e, Fim-7941f, Fortigate-6300f-Dc, Fortigate-6300f, Fim-7910e, Fortigate-6601f, Fortigate-6601f-Dc, Fortigate-7121f, Fpm-7620e, Fortigate-7040e, Fortios, Fim-7904e

Quotes

• This vulnerability allows an unauthenticated adversary to execute arbitrary code when the above SAML SSO criteria is met
• CISA and co-sealers assess that beginning as early as January 2023, multiple nation-state APT actors were present on the organization’s network via at least two initial access vectors

Headlines

• Sept. 8, 2023 - Nation-state actors exploit Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus, CISA warns
• Sept. 8, 2023 - US Aeronautical Organization Hacked via Zoho, Fortinet Vulnerabilities
• Sept. 8, 2023 - CISA Warning: Nation-State Hackers Exploit Fortinet and Zoho Vulnerabilities
• Sept. 7, 2023 - Iranian hackers breach US aviation org via ManageEngine, Fortinet bugs
• Sept. 7, 2023 - Iranian hackers breach US aviation org via Zoho, Fortinet bugs
• Sept. 7, 2023 - CISA, FBI, and CNMF Release Advisory on Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475 | CISA

CVE-2023-28581

CRITICAL CVSS 9.80 EPSS Score 0.10 EPSS Percentile 39.43

Risk Context N/A

Published: Sept. 5, 2023

Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.

Headlines

• Sept. 6, 2023 - Google addressed an actively exploited zero-day in Android
• Sept. 6, 2023 - September Android updates fix zero-day exploited in attacks
• Sept. 6, 2023 - Two RCE (CVE-2023-28562 and CVE-2023-28581) Bugs in Qualcomm Chips Expose Billions of Devices to Attacks
• Sept. 6, 2023 - Android September security updates fix a actively exploited flaw (CVE-2023-35674)

CVE-2023-28434

HIGH CVSS 8.80 EPSS Score 0.06 EPSS Percentile 22.63

Public Exploits Available

Published: March 22, 2023

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

Quotes

• As a result of their continued lack of execution against their commitments
• This endpoint functions as a built-in backdoor, granting unauthorized individuals the ability to execute commands on the host running the application
• Possess the potential to expose sensitive information present within the compromised installation and facilitate remote code execution (RCE) on the host where the MinIO application is operational
• The specific exploit chain we stumbled into was not observed in the wild before, or at least documented, making this the first instance of evidence showcasing such non-native solutions are being adopted by attackers
• The chain of vulnerabilities observed by our team during an attack we’ve investigated presents a worrisome situation where attackers can potentially gain the ability to remotely execute code and take full control over systems running vulnerable versions of the high-performance and distributed object storage system called MinIO

Headlines

• Sept. 8, 2023 - In Other News: LastPass Vault Hacking, Russia Targets Ukraine Energy Facility, NXP Breach
• Sept. 6, 2023 - MinIO Attack Showcases Fresh Corporate Cloud Attack Vector
• Sept. 4, 2023 - Hackers exploit MinIO storage system to breach corporate networks
• Sept. 4, 2023 - Evil_MinIO exploit used in attacks on MinIO Storage Systems
• Sept. 4, 2023 - Hackers Exploit MinIO Storage System Vulnerabilities to Compromise Servers

CVE-2023-28432

HIGH CVSS 7.50 EPSS Score 50.56 EPSS Percentile 97.10

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 22, 2023

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

Vendor Impacted: Minio

Product Impacted: Minio

Quotes

• As a result of their continued lack of execution against their commitments
• This endpoint functions as a built-in backdoor, granting unauthorized individuals the ability to execute commands on the host running the application
• Possess the potential to expose sensitive information present within the compromised installation and facilitate remote code execution (RCE) on the host where the MinIO application is operational
• The specific exploit chain we stumbled into was not observed in the wild before, or at least documented, making this the first instance of evidence showcasing such non-native solutions are being adopted by attackers
• The chain of vulnerabilities observed by our team during an attack we’ve investigated presents a worrisome situation where attackers can potentially gain the ability to remotely execute code and take full control over systems running vulnerable versions of the high-performance and distributed object storage system called MinIO

Headlines

• Sept. 8, 2023 - In Other News: LastPass Vault Hacking, Russia Targets Ukraine Energy Facility, NXP Breach
• Sept. 6, 2023 - MinIO Attack Showcases Fresh Corporate Cloud Attack Vector
• Sept. 4, 2023 - Hackers exploit MinIO storage system to breach corporate networks
• Sept. 4, 2023 - Evil_MinIO exploit used in attacks on MinIO Storage Systems
• Sept. 4, 2023 - Hackers Exploit MinIO Storage System Vulnerabilities to Compromise Servers

CVE-2023-20269

MEDIUM CVSS 5.00 EPSS Score 0.05 EPSS Percentile 16.19

Actively Exploited Remote Code Execution Used In Ransomware

Published: Sept. 6, 2023

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.

Quotes

• This vulnerability was found during the resolution of a Cisco TAC support case
• The defendants charged in these three indictments across three different jurisdictions allegedly used their cyber knowledge and capabilities to victimize people and businesses around the world without regard for the damage they caused
• This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials

Headlines

• Sept. 8, 2023 - The Week in Ransomware - September 8th 2023 - Conti Indictments
• Sept. 8, 2023 - Zero-day in Cisco ASA and FTD is actively exploited in ransomware attacks
• Sept. 8, 2023 - Cisco warns of VPN zero-day exploited by ransomware gangs
• Sept. 8, 2023 - Cisco ASA Zero-Day Exploited in Akira Ransomware Attacks
• Sept. 8, 2023 - Unpatched Cisco ASA flaw exploited by attackers (CVE-2023-20269)
• Sept. 7, 2023 - Cisco fix the zero-day CVE-2023-20269 flaw in its VPN products

CVE-2023-41064

CVSS Not Assigned EPSS Score 0.09 EPSS Percentile 36.81

CISA Known Exploited

Published: Sept. 7, 2023

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.5.2, iOS 16.6.1 and iPadOS 16.6.1. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor Impacted: Apple

Product Impacted: Ios, Ipados, And Macos

Quotes

• An individual employed by a Washington DC-based civil society organization with international offices
• Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited
• We commend Apple for their rapid investigative response and patch cycle, and we acknowledge the victim and their organization for their collaboration and assistance
• We refer to the exploit chain as BLASTPASS. The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim
• Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware

Headlines

• Sept. 8, 2023 - Apple races to patch the latest zero-day iPhone exploit
• Sept. 8, 2023 - Apple Rushes to Patch Zero-Day Flaws Exploited for Pegasus Spyware on iPhones
• Sept. 8, 2023 - Apple patches two zero-days under attack (CVE-2023-41064, CVE-2023-41061)
• Sept. 8, 2023 - Apple Patches Two Zero-Days Exploited in Pegasus Attacks
• Sept. 8, 2023 - iOS 16.6.1—Update Now Warning Issued To All iPhone Users
• Sept. 8, 2023 - Zero-days fixed by Apple were used to deliver Pegasus spyware
• Sept. 7, 2023 - Apple discloses 2 actively exploited zero-days in iPhones, Macs
• Sept. 7, 2023 - Apple Hit By 2 No-Click Zero-Days in Blastpass Exploit Chain
• Sept. 7, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Sept. 7, 2023 - Apple zero-click iMessage exploit used to infect iPhones with spyware
• Sept. 7, 2023 - Apple Fixes Two New 0-Day CVE-2023-41064 & CVE-2023-41061 Bugs
• Sept. 7, 2023 - Apple discloses 2 new zero-days exploited to attack iPhones, Macs

CVE-2023-41061

CVSS Not Assigned EPSS Score 0.06 EPSS Percentile 24.56

CISA Known Exploited

Published: Sept. 7, 2023

A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor Impacted: Apple

Product Impacted: Ios, Ipados, And Watchos

Quotes

• An individual employed by a Washington DC-based civil society organization with international offices
• Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited
• We commend Apple for their rapid investigative response and patch cycle, and we acknowledge the victim and their organization for their collaboration and assistance
• We refer to the exploit chain as BLASTPASS. The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim
• Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware

Headlines

• Sept. 8, 2023 - Apple races to patch the latest zero-day iPhone exploit
• Sept. 8, 2023 - Apple Rushes to Patch Zero-Day Flaws Exploited for Pegasus Spyware on iPhones
• Sept. 8, 2023 - Apple patches two zero-days under attack (CVE-2023-41064, CVE-2023-41061)
• Sept. 8, 2023 - Apple Patches Two Zero-Days Exploited in Pegasus Attacks
• Sept. 8, 2023 - iOS 16.6.1—Update Now Warning Issued To All iPhone Users
• Sept. 8, 2023 - Zero-days fixed by Apple were used to deliver Pegasus spyware
• Sept. 7, 2023 - Apple discloses 2 actively exploited zero-days in iPhones, Macs
• Sept. 7, 2023 - Apple Hit By 2 No-Click Zero-Days in Blastpass Exploit Chain
• Sept. 7, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Sept. 7, 2023 - Apple zero-click iMessage exploit used to infect iPhones with spyware
• Sept. 7, 2023 - Apple Fixes Two New 0-Day CVE-2023-41064 & CVE-2023-41061 Bugs
• Sept. 7, 2023 - Apple discloses 2 new zero-days exploited to attack iPhones, Macs