Previous Issues of vulnerability Weekly

•  Security Vulnerability of the Week 20/06/22 – PiPy leaking AWS credentials, illumina healthcare vulnerability, Sharepoint RCE, QNAP PHP Vuln 
• Security Vulnerability of the Week 20/06/22 – Couchbase, Splunk, CISCO, Azure Synapse, Oracle Cloud
• Security Vulnerability of the Week 13/06/22 – Atlassian Confluence, Follina & Weaponization, 
• Security Vulnerability of the Week 30/05/22 – GIT
• Security Vulnerability of the Week 22/05/22 – Pwn2Own

This week we deep dive into Jenkins massive plugins issue, zoho, Exchange backdoors, Edge high vuln

Appsec

Zoho

CVE-2022-28219 affecting ZOHO managed engine

On July 1st security researchers published a proof-of-concept exploit code for CVE-2022-28219, a critical vulnerability in the Zoho ManageEngine ADAudit Plus tool for monitoring activities in the Active Directory.

Horizon3.ai published a blog post explaining the technical aspects behind CVE-2022-28219 along with proof-of-concept exploit code that demonstrates the findings.

The vulnerability consists of three issues, untrusted Java deserialization, path traversal, and a blind XML External Entities (XXE) injection, that ultimately lead to remote code execution without authentication.

“This is the same vulnerable endpoint from CVE-2020-10189, reported by @steventseeley against ManageEngine Desktop Central. The FileStorage class in this library was abused for remote code execution via untrusted Java deserialization” – Naveen Sunkavally

The vulnerability once triggered enables the bypass of authentication and stealing credentials

Once Sunkavally found a way to execute code remotely, he started to look for methods to upload files without authentication and found that some ADAudit Plus endpoints used by agents running on the machine to upload security events did not require authentication.

“This gave us a large attack surface to work with because there’s a lot of business logic that was written to process these events” – Naveen Sunkavally

The researcher then found a way to trigger a blind XXE vulnerability in the ProcessTrackingListener class in charge of managing events with Windows scheduled task XML content.

For more details: To show the validity of these findings, Horizon3.ai published code that exploits CVE-2022-28219 in ManageEngine ADAudit Plus builds before 7060 to execute the calculator app in Windows.

Jenkins dozens of zero-days bugs

Jenkins security team announced 34 security vulnerabilities affecting 29 plugins for the Jenkins open source automation server, 29 of the bugs being zero-days still waiting to be patched.

Jenkins is a highly popular platform (with support for over 1,700 plugins) used by enterprises worldwide for building, testing, and deploying software.

As per shodan there are currently 155 K jenkins servers

While there is a long list of vulnerable plugins the major one are:

While the Jenkins team has patched four of the plugins (i.e., GitLab, requests-plugin, TestNG Results, XebiaLabs XL Release), there’s still a long list of vulnerable ones, including:

• Build Notifications Plugin up to and including 1.5.0
• build-metrics Plugin up to and including 1.3
• Cisco Spark Plugin up to and including 1.1.1
• Deployment Dashboard Plugin up to and including 1.0.10
• Elasticsearch Query Plugin up to and including 1.2
• eXtreme Feedback Panel Plugin up to and including 2.0.1
• Failed Job Deactivator Plugin up to and including 1.2.1
• GitLab Plugin up to and including 1.5.34
• HPE Network Virtualization Plugin up to and including 1.0
• Jigomerge Plugin up to and including 0.9
• Matrix Reloaded Plugin up to and including 1.1.3
• OpsGenie Plugin up to and including 1.9
• Plot Plugin up to and including 2.1.10
• Project Inheritance Plugin up to and including 21.04.03
• Recipe Plugin up to and including 1.2
• Request Rename Or Delete Plugin up to and including 1.1.0
• requests-plugin Plugin up to and including 2.2.16
• Rich Text Publisher Plugin up to and including 1.4
• RocketChat Notifier Plugin up to and including 1.5.2
• RQM Plugin up to and including 2.8
• Skype notifier Plugin up to and including 1.1.0
• TestNG Results Plugin up to and including 554.va4a552116332
• Validating Email Parameter Plugin up to and including 1.10
• XebiaLabs XL Release Plugin up to and including 22.0.0
• XPath Configuration Viewer Plugin up to and including 1.1.1

INFRA/Network

Microsoft Edge

Several Vulnerabilities have been discovered with medium-> high criticality CVE 7-8.3 CVE-2022-33638, CVE-2022-33639.

A vulnerability CVE-2022-30192 was found in Microsoft Edge 103.0.1264.37 and classified as critical. This issue affects an unknown code. The manipulation with an unknown input leads to a remote code execution vulnerability. Impacted is confidentiality, integrity, and availability.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30192

Exhcange with backdoors

Credit praetorian

Security researchers have recently discovered a new focus on exchange vulnerability and backdoored government-owned Servers

Microsoft addressed four zero-days (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) exploited in the wild and three other vulnerabilities (CVE-2021-27078, CVE-2021-26854, and CVE-2021-26412).

The malware, dubbed SessionManager by security researchers at Kaspersky, discovered the module for Microsoft’s Internet Information Services (IIS) web server software.

The threat actors had a considerable number of potential victims to target, seeing that the Dutch Institute for Vulnerability Disclosure (DIVD) found 46,000 servers unpatched against the ProxyLogon flaws one week after Microsoft patched them.

SessionManager’s capabilities include, among other features:

• Uploading and executing arbitrary files on compromised servers
• RCE – remote command execution on backdoored devices
• Connecting to local networks, lateral movement and 

Eset researchers have identified a number of groups targeting the vulnerability

After Microsoft’s initial report that the vulnerabilities were actively exploited by a Chinese APT group named Hafnium, Slovak internet security firm ESET shared info on at least three other Chinese-backed hacking groups abusing the ProxyLogon flaws in ongoing attacks.

Besides those three (APT27, Bronze Butler aka Tick, and Calypso), ESET also said that it also identified several “additional yet-unclassified clusters.”

Webshell detections by country (ESET)

ESET has now published a new report saying that unpatched Exchange servers are currently hunted down by “at least 10 APT groups.”

Detailed info on the servers compromised by these hacking groups and the threat actors behind the not yet attributed malicious activity, including indicators of compromise, can be found in ESET’s report.

ProxyLogon attacks timeline (ESET)

Previous Issues of vulnerability Weekly

•  Security Vulnerability of the Week 20/06/22 – PiPy leaking AWS credentials, illumina healthcare vulnerability, Sharepoint RCE, QNAP PHP Vuln 
• Security Vulnerability of the Week 20/06/22 – Couchbase, Splunk, CISCO, Azure Synapse, Oracle Cloud
• Security Vulnerability of the Week 13/06/22 – Atlassian Confluence, Follina & Weaponization, 
• Security Vulnerability of the Week 30/05/22 – GIT
• Security Vulnerability of the Week 22/05/22 – Pwn2Own
• Security Vulnerability of the Week 16/05/22 – NVIDIA