Security Vulnerability of the Week 04/07/22

Jenkins massive plugins issue , zoho, Exchange backdoors, Edge high vuln

Previous Issues of vulnerability Weekly

This week we deep dive into Jenkins massive plugins issue, zoho, Exchange backdoors, Edge high vuln



12 Best Zoho Products: Reviews of the Most Popular Services -

CVE-2022-28219 affecting ZOHO managed engine

On July 1st security researchers published a proof-of-concept exploit code for CVE-2022-28219, a critical vulnerability in the Zoho ManageEngine ADAudit Plus tool for monitoring activities in the Active Directory. published a blog post explaining the technical aspects behind CVE-2022-28219 along with proof-of-concept exploit code that demonstrates the findings.

The vulnerability consists of three issues, untrusted Java deserialization, path traversal, and a blind XML External Entities (XXE) injection, that ultimately lead to remote code execution without authentication.

“This is the same vulnerable endpoint from CVE-2020-10189, reported by @steventseeley against ManageEngine Desktop Central. The FileStorage class in this library was abused for remote code execution via untrusted Java deserialization” – Naveen Sunkavally

The vulnerability once triggered enables the bypass of authentication and stealing credentials

Once Sunkavally found a way to execute code remotely, he started to look for methods to upload files without authentication and found that some ADAudit Plus endpoints used by agents running on the machine to upload security events did not require authentication.

“This gave us a large attack surface to work with because there’s a lot of business logic that was written to process these events” – Naveen Sunkavally

The researcher then found a way to trigger a blind XXE vulnerability in the ProcessTrackingListener class in charge of managing events with Windows scheduled task XML content.

For more details: To show the validity of these findings, published code that exploits CVE-2022-28219 in ManageEngine ADAudit Plus builds before 7060 to execute the calculator app in Windows.

Jenkins dozens of zero-days bugs

Jenkins security team announced 34 security vulnerabilities affecting 29 plugins for the Jenkins open source automation server, 29 of the bugs being zero-days still waiting to be patched.

Jenkins is a highly popular platform (with support for over 1,700 plugins) used by enterprises worldwide for building, testing, and deploying software.

As per shodan there are currently 155 K jenkins servers

While there is a long list of vulnerable plugins the major one are:

While the Jenkins team has patched four of the plugins (i.e., GitLab, requests-plugin, TestNG Results, XebiaLabs XL Release), there’s still a long list of vulnerable ones, including:

  • Build Notifications Plugin up to and including 1.5.0
  • build-metrics Plugin up to and including 1.3
  • Cisco Spark Plugin up to and including 1.1.1
  • Deployment Dashboard Plugin up to and including 1.0.10
  • Elasticsearch Query Plugin up to and including 1.2
  • eXtreme Feedback Panel Plugin up to and including 2.0.1
  • Failed Job Deactivator Plugin up to and including 1.2.1
  • GitLab Plugin up to and including 1.5.34
  • HPE Network Virtualization Plugin up to and including 1.0
  • Jigomerge Plugin up to and including 0.9
  • Matrix Reloaded Plugin up to and including 1.1.3
  • OpsGenie Plugin up to and including 1.9
  • Plot Plugin up to and including 2.1.10
  • Project Inheritance Plugin up to and including 21.04.03
  • Recipe Plugin up to and including 1.2
  • Request Rename Or Delete Plugin up to and including 1.1.0
  • requests-plugin Plugin up to and including 2.2.16
  • Rich Text Publisher Plugin up to and including 1.4
  • RocketChat Notifier Plugin up to and including 1.5.2
  • RQM Plugin up to and including 2.8
  • Skype notifier Plugin up to and including 1.1.0
  • TestNG Results Plugin up to and including 554.va4a552116332
  • Validating Email Parameter Plugin up to and including 1.10
  • XebiaLabs XL Release Plugin up to and including 22.0.0
  • XPath Configuration Viewer Plugin up to and including 1.1.1


Microsoft Edge

Several Vulnerabilities have been discovered with medium-> high criticality CVE 7-8.3 CVE-2022-33638, CVE-2022-33639.

A vulnerability CVE-2022-30192 was found in Microsoft Edge 103.0.1264.37 and classified as critical. This issue affects an unknown code. The manipulation with an unknown input leads to a remote code execution vulnerability. Impacted is confidentiality, integrity, and availability.

Exhcange with backdoors

Credit praetorian

Security researchers have recently discovered a new focus on exchange vulnerability and backdoored government-owned Servers

Microsoft addressed four zero-days (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) exploited in the wild and three other vulnerabilities (CVE-2021-27078, CVE-2021-26854, and CVE-2021-26412).

The malware, dubbed SessionManager by security researchers at Kaspersky, discovered the module for Microsoft’s Internet Information Services (IIS) web server software.

The threat actors had a considerable number of potential victims to target, seeing that the Dutch Institute for Vulnerability Disclosure (DIVD) found 46,000 servers unpatched against the ProxyLogon flaws one week after Microsoft patched them.

SessionManager’s capabilities include, among other features:

  • Uploading and executing arbitrary files on compromised servers
  • RCE – remote command execution on backdoored devices
  • Connecting to local networks, lateral movement and 

Eset researchers have identified a number of groups targeting the vulnerability

After Microsoft’s initial report that the vulnerabilities were actively exploited by a Chinese APT group named Hafnium, Slovak internet security firm ESET shared info on at least three other Chinese-backed hacking groups abusing the ProxyLogon flaws in ongoing attacks.

Besides those three (APT27, Bronze Butler aka Tick, and Calypso), ESET also said that it also identified several “additional yet-unclassified clusters.”

Countries were web shells were deployed on Exchange during the attacks

Webshell detections by country (ESET)

ESET has now published a new report saying that unpatched Exchange servers are currently hunted down by “at least 10 APT groups.”

Detailed info on the servers compromised by these hacking groups and the threat actors behind the not yet attributed malicious activity, including indicators of compromise, can be found in ESET’s report.

ProxyLogon attacks timeline

ProxyLogon attacks timeline (ESET)

Previous Issues of vulnerability Weekly

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Phoenix Security, the next-gen leader in Application Security Posture Management and Unified Vulnerability Management, welcomes Lee Vorthman, Ciso of ORACLE advertising to the advisory board
Francesco Cipollone
Owasp top 10 has been a pillar over the years; sister to CWE – Common Weakness Enumeration we provide an overview of the top software vulnerabilities and web application security risks with a data-driven approach focused on helping identify what risk to fix first.
Francesco Cipollone
The Cloud Security and AppSec teams at Phoenix Security are pleased to bring you another set of new Phoenix Security features and improvements for vulnerability management across application and cloud security engines. This release builds on top of previous releases with key additions and progress across multiple areas of the platform. Asset and Vulnerability Management – Associate assets with multiple Applications and Environments – Mapping of vulnerabilities to Installed Software – Find Assets/Vulns by Scanner – Detailed findings Location information Risk-based Posture Management – Risk and Risk Magnitude for Assets – Filter assets and vulnerabilities by source scanner Integrations – BurpSuite XML Import – Assessment Import API Other Improvements – Improved multi-selection in filters – New CVSS Score column in Vulnerabilities
Alfonso Eusebio

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

x Logo: ShieldPRO
This Site Is Protected By