Latest data breach and vulnerability Weekly Latest Security Vulnerability of the Week 16/01/23 – UK Royal Mail, Symantec data breach, Azure SSRF, Lock bit ransomware

Latest Vulnerability Weekly - 16-1-22 - UK Royal Mail, Symantec data breach, Azure SSRF, Lockbit ransomware

Latest Vulnerability Weekly - 16-1-22 - UK Royal Mail, Symantec data breach, Azure SSRF, Lockbit ransomware
Latest Vulnerability Weekly – 16-1-22 – UK Royal Mail, Symantec data breach, Azure SSRF, Lockbit ransomware

Previous Issues of vulnerability Weekly


This week we deep dive into UK Royal Mail security incident, Symantec password storage data breach, Azure SSRF, Lockbit ransomware cisco retired systems, circle ci latest updates, python libraries 

Application Security

Python PyPi rogue packages

Another incident related to Python repository. Vulnerabilities were found in several packages from PyPi repository 

PyPI is a repository of open-source packages that software developers use to pick the building blocks of their Python-based projects or share their work with the community.

PyPI is usually quick to respond to reports of malicious packages on the platform

The community is voicing frustration as there’s no real vetting before submission, so dangerous packages may lurk there for a while.

Phoenix Security partner Sonatype has identified the following  packages as malicious:

  • loglib-modules
  • pyg-modules
  • pygrata
  • pygrata-utils
  • hkg-sol-utils

Code snippet pertaining to the data-stealing functionalityCode snippet pertaining to the data-stealing functionality (Sonatype)

The stolen data is stored in TXT files and uploaded to a PyGrata[.]com domain. However, the endpoint isn’t properly secured, so the analysts could peek into what the threat actors had stolen.

One of the sampled TXT files containing stolen AWS credentials (Sonatype)

Those atacks were not leveraging the usual typosquatting, they’re not randomly targeting developers who mistyped a character but users looking for specific tools for their projects.


Cisco Out of support devices get a Vulnerability PoC

Cisco has warned of two security vulnerabilities affecting end-of-life (EoL) Small Business RV016, RV042, RV042G, and RV082 routers that it said will not be fixed, even as it acknowledged the public availability of proof-of-concept (PoC) exploit

The most severe of the two is CVE-2023-20025 (CVSS score: 9.0), which is the result of improper validation of user input within incoming HTTP packets.

A threat actor could exploit it remotely by sending a specially crafted HTTP request to vulnerable routers’ web-based management interface to bypass authentication and obtain elevated permissions.

The lack of adequate validation is also the reason behind the second flaw tracked as CVE-2023-20026 (CVSS score: 6.5), permitting an attacker with valid admin credentials to achieve root-level privileges and access unauthorized data.

Work around:

As workarounds, administrators are recommended to disable remote management and block access to ports 443 and 60443. That said, Cisco is cautioning users to “determine the applicability and effectiveness [of the mitigation] in their own environment and under their own use conditions.”

Cloud Security

Azure identifies and resolves 4 different incidents

Four different Microsoft Azure services have been found vulnerable to server-side request forgery (SSRF) attacks that could be exploited to gain unauthorized access to cloud resources.

“The discovered Azure SSRF vulnerabilities allowed an attacker to scan local ports, find new services, endpoints, and sensitive files – providing valuable information on possibly vulnerable servers and services to exploit for initial entry and the location of sensitive information to target,” Orca researcher By Lidor Ben Shitrit said in a report 

Three of the flaws are rated Important in severity, while the SSRF flaw impacting Azure Machine Learning is rated Low in severity. All the weaknesses can be leveraged to manipulate a server to mount further attacks against a susceptible target.

A brief summary of the four vulnerabilities is as follow –

  • Unauthenticated SSRF on Azure Digital Twins Explorer via a flaw in the /proxy/blob endpoint that could be exploited to get a response from any service that’s suffixed with “[.]net”
  • Unauthenticated SSRF on Azure Functions that could be exploited to enumerate local ports and access internal endpoints
  • Authenticated SSRF on Azure API Management service that could be exploited to list internal ports, including one associated with a source code management service that could then be used to access sensitive files
  • Authenticated SSRF on Azure Machine Learning service via the /datacall/streamcontent endpoint that could be exploited to fetch content from arbitrary endpoints

Christophe Parisel has also updated the piercing index for azure and aws vulnerabilities as High

AWS Elastic Container Vulnerability

AWS Elastic Container Service (ECS) Key Components

A vulnerability in Elastic Container Registry (ECR) Public could have allowed a malicious actor to delete, update, or create ECR Public images, layers, or tags in registries and repositories belonging to any other AWS account, by abusing undocumented API calls. A malicious actor could have exploited this to delete any or all images in the Amazon ECR Public Gallery or update the content of any existing image to inject malicious code on any machine that would pull and run it.

The vulnerability is marked as critical as Gafnit Amiga from lightspin:

By exploiting this vulnerability, a malicious actor could delete all images in the Amazon ECR Public Gallery or update the image contents to inject malicious code

Some additional Details:

Latest Data Breaches & Security Incidents

Royal Mail Lockbit

Royal Mail – Apps on Google Play

LockBit ransomware cartel is suspected of being behind an ongoing cyber security incident at the UK’s Royal Mail, the system is still offline today and international mail can’t be sent or delivered. 

A Russia-linked ransomware gang was behind the Royal Mail cyber attack that forced it to suspend international postal deliveries leaving more than half a million parcels and letters stuck in limbo

“Guys, you can calm down, I found the advert who made them, this advert is in the top ten adverts, decryptor and deletion of stolen data after paying the ransom to be,” LockBitSupp said in a translated posted to a hacking forum.

Post from LockBitsupp on a hacking forum

Post from LockBitsupp on a hacking forum

Source: BleepingComputer

While the LockBit representative implies that data was stolen in the cyberattack again Royal Mail, there is information on how much data was stolen and what it contains.

While originally NCSC classified this as a security incident, later confirmed as lock bit encryption

The gang behind the ransomware was not vocal about this. In fact, as per Bleeping Computer’s latest investigation 

In September, the LockBit 3.0 ransomware builder was leaked on Twitter. This allowed other threat actors to launch ransomware operations based on the LockBit’s encryptor.

Previous Issues of vulnerability Weekly

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Phoenix Security, the next-gen leader in Application Security Posture Management and Unified Vulnerability Management, welcomes Lee Vorthman, Ciso of ORACLE advertising to the advisory board
Francesco Cipollone
Owasp top 10 has been a pillar over the years; sister to CWE – Common Weakness Enumeration we provide an overview of the top software vulnerabilities and web application security risks with a data-driven approach focused on helping identify what risk to fix first.
Francesco Cipollone
The Cloud Security and AppSec teams at Phoenix Security are pleased to bring you another set of new Phoenix Security features and improvements for vulnerability management across application and cloud security engines. This release builds on top of previous releases with key additions and progress across multiple areas of the platform. Asset and Vulnerability Management – Associate assets with multiple Applications and Environments – Mapping of vulnerabilities to Installed Software – Find Assets/Vulns by Scanner – Detailed findings Location information Risk-based Posture Management – Risk and Risk Magnitude for Assets – Filter assets and vulnerabilities by source scanner Integrations – BurpSuite XML Import – Assessment Import API Other Improvements – Improved multi-selection in filters – New CVSS Score column in Vulnerabilities
Alfonso Eusebio

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

x Logo: ShieldPRO
This Site Is Protected By