Previous Issues of vulnerability Weekly

• Latest data breach and vulnerability Weekly Latest Security Vulnerability of the Week 6/01/23 – Microsoft Exchange and OWASSRF, Rackspace Hack, Last pass data breach updates 
• Latest Security Vulnerability of the Week 24/10/22 
• Security Vulnerability of the Week 3/10/22 – Application Security – Cloud – Vulnerability – Exchange Zero Day & Mitigations, bitbucket, cobalt stike
• Security Vulnerability of the Week 12/09/22 – Application Security – Cloud Security – Linux Malware, Windows patched 64 vulns with zero-day, Uber Hack Timeline, GTA 6/Rockstar Hack – This week we deep dive into Linux Malware, Windows patched 64 vuln with zero day, Uber Hack Timeline, GTA 6/Rockstar Hack
• Security Vulnerability of the Week 12/09/22 – Application Security – Uber Hack Timeline – Special Focus on Uber latest news on hack
• Security Vulnerability Weekly 22/08/22 – Apple Vulnerability, Android Bugdrop Vulnerability, WordPress, CISA, and recent Hacks to Mailchimp and Twilio –  Apple Vulnerability, CISA new vulnerability for September, Bugdrop new android vulnerabilities, recent hacks to twilio exposing digital ocaean clients and Mailchimp hack
• Security Vulnerability of the Week 08/08/22 – Atlassian Hardcoded Credentials, Sonicwall GSM, Cisco Nexus, Microsoft Macro, Vmware Fix, Mac OS spotlight vulnerability and more

Intro

This week we deep dive into UK Royal Mail security incident, Symantec password storage data breach, Azure SSRF, Lockbit ransomware cisco retired systems, circle ci latest updates, python libraries 

Application Security

Python PyPi rogue packages

Another incident related to Python repository. Vulnerabilities were found in several packages from PyPi repository 

PyPI is a repository of open-source packages that software developers use to pick the building blocks of their Python-based projects or share their work with the community.

PyPI is usually quick to respond to reports of malicious packages on the platform

The community is voicing frustration as there’s no real vetting before submission, so dangerous packages may lurk there for a while.

Phoenix Security partner Sonatype has identified the following  packages as malicious:

• loglib-modules
• pyg-modules
• pygrata
• pygrata-utils
• hkg-sol-utils

Code snippet pertaining to the data-stealing functionality (Sonatype)

The stolen data is stored in TXT files and uploaded to a PyGrata[.]com domain. However, the endpoint isn’t properly secured, so the analysts could peek into what the threat actors had stolen.

One of the sampled TXT files containing stolen AWS credentials (Sonatype)

Those atacks were not leveraging the usual typosquatting, they’re not randomly targeting developers who mistyped a character but users looking for specific tools for their projects.

INFRA/Network

Cisco Out of support devices get a Vulnerability PoC

Cisco has warned of two security vulnerabilities affecting end-of-life (EoL) Small Business RV016, RV042, RV042G, and RV082 routers that it said will not be fixed, even as it acknowledged the public availability of proof-of-concept (PoC) exploit

The most severe of the two is CVE-2023-20025 (CVSS score: 9.0), which is the result of improper validation of user input within incoming HTTP packets.

A threat actor could exploit it remotely by sending a specially crafted HTTP request to vulnerable routers’ web-based management interface to bypass authentication and obtain elevated permissions.

The lack of adequate validation is also the reason behind the second flaw tracked as CVE-2023-20026 (CVSS score: 6.5), permitting an attacker with valid admin credentials to achieve root-level privileges and access unauthorized data.

Work around:

As workarounds, administrators are recommended to disable remote management and block access to ports 443 and 60443. That said, Cisco is cautioning users to “determine the applicability and effectiveness [of the mitigation] in their own environment and under their own use conditions.”

Cloud Security

Azure identifies and resolves 4 different incidents

Four different Microsoft Azure services have been found vulnerable to server-side request forgery (SSRF) attacks that could be exploited to gain unauthorized access to cloud resources.

“The discovered Azure SSRF vulnerabilities allowed an attacker to scan local ports, find new services, endpoints, and sensitive files – providing valuable information on possibly vulnerable servers and services to exploit for initial entry and the location of sensitive information to target,” Orca researcher By Lidor Ben Shitrit said in a report 

Three of the flaws are rated Important in severity, while the SSRF flaw impacting Azure Machine Learning is rated Low in severity. All the weaknesses can be leveraged to manipulate a server to mount further attacks against a susceptible target.

A brief summary of the four vulnerabilities is as follow –

• Unauthenticated SSRF on Azure Digital Twins Explorer via a flaw in the /proxy/blob endpoint that could be exploited to get a response from any service that’s suffixed with “blob.core.windows[.]net”
• Unauthenticated SSRF on Azure Functions that could be exploited to enumerate local ports and access internal endpoints
• Authenticated SSRF on Azure API Management service that could be exploited to list internal ports, including one associated with a source code management service that could then be used to access sensitive files
• Authenticated SSRF on Azure Machine Learning service via the /datacall/streamcontent endpoint that could be exploited to fetch content from arbitrary endpoints

Christophe Parisel has also updated the piercing index for azure and aws vulnerabilities as High

AWS Elastic Container Vulnerability

A vulnerability in Elastic Container Registry (ECR) Public could have allowed a malicious actor to delete, update, or create ECR Public images, layers, or tags in registries and repositories belonging to any other AWS account, by abusing undocumented API calls. A malicious actor could have exploited this to delete any or all images in the Amazon ECR Public Gallery or update the content of any existing image to inject malicious code on any machine that would pull and run it.

The vulnerability is marked as critical as Gafnit Amiga from lightspin:

By exploiting this vulnerability, a malicious actor could delete all images in the Amazon ECR Public Gallery or update the image contents to inject malicious code

Some additional Details:

https://blog.lightspin.io/aws-ecr-public-vulnerability

https://aws.amazon.com/security/security-bulletins/AWS-2022-010/

Latest Data Breaches & Security Incidents

Royal Mail Lockbit

LockBit ransomware cartel is suspected of being behind an ongoing cyber security incident at the UK’s Royal Mail, the system is still offline today and international mail can’t be sent or delivered. 

A Russia-linked ransomware gang was behind the Royal Mail cyber attack that forced it to suspend international postal deliveries leaving more than half a million parcels and letters stuck in limbo

“Guys, you can calm down, I found the advert who made them, this advert is in the top ten adverts, decryptor and deletion of stolen data after paying the ransom to be,” LockBitSupp said in a translated posted to a hacking forum.

Post from LockBitsupp on a hacking forum

Source: BleepingComputer

While the LockBit representative implies that data was stolen in the cyberattack again Royal Mail, there is information on how much data was stolen and what it contains.

While originally NCSC classified this as a security incident, later confirmed as lock bit encryption

https://www.ncsc.gov.uk/news/royal-mail-incident

The gang behind the ransomware was not vocal about this. In fact, as per Bleeping Computer’s latest investigation 

In September, the LockBit 3.0 ransomware builder was leaked on Twitter. This allowed other threat actors to launch ransomware operations based on the LockBit’s encryptor.

Previous Issues of vulnerability Weekly

• Latest Security Vulnerability of the Week 24/10/22 
• Security Vulnerability of the Week 3/10/22 – Application Security – Cloud – Vulnerability – Exchange Zero Day & Mitigations, bitbucket, cobalt stike
• Security Vulnerability of the Week 12/09/22 – Application Security – Cloud Security – Linux Malware, Windows patched 64 vulns with zero-day, Uber Hack Timeline, GTA 6/Rockstar Hack – This week we deep dive into Linux Malware, Windows patched 64 vuln with zero day, Uber Hack Timeline, GTA 6/Rockstar Hack
• Security Vulnerability of the Week 12/09/22 – Application Security – Uber Hack Timeline – Special Focus on Uber latest news on hack
• Security Vulnerability Weekly 22/08/22 – Apple Vulnerability, Android Bugdrop Vulnerability, WordPress, CISA, and recent Hacks to Mailchimp and Twilio –  Apple Vulnerability, CISA new vulnerability for September, Bugdrop new android vulnerabilities, recent hacks to twilio exposing digital ocaean clients and Mailchimp hack
• Security Vulnerability of the Week 08/08/22 – Atlassian Hardcoded Credentials, Sonicwall GSM, Cisco Nexus, Microsoft Macro, Vmware Fix, Mac OS spotlight vulnerability and more