SEC536: Adversarial AI - Penetration Testing AI Systems
SEC536Offensive Operations, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
VOLUME 24ISSUE 07
The Consensus Security Vulnerability Alert
Internet Storm Center Spotlight
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Microsoft February 2024 Patch Tuesday
Published: 2024-02-13
Last Updated: 2024-02-13 18:30:02 UTC
by Renato Marinho (Version: 1)
This month we got patches for 80 vulnerabilities. Of these, 5 are critical, and 2 are being exploited according to Microsoft.
One of the exploited vulnerabilities is the Internet Shortcut Files Security Feature Bypass Vulnerability (CVE-2024-21412). According to the advisory, an unauthenticated attacker could send the targeted user a specially crafted file that is designed to bypass displayed security checks. However, the attacker would have no way to force a user to view the attacker-controlled content. Instead, the attacker would have to convince them to take action by clicking on the file link. The CVSS for this vulnerability is 8.1.
The second exploited vulnerability is the Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2024-21351). According to the advisory, the vulnerability allows a malicious actor to inject code into SmartScreen and potentially gain code execution, which could potentially lead to some data exposure, lack of system availability, or both.
About the critical vulnerabilities, one of them is the Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2024-21410). According to the advisory, an attacker who successfully exploited this vulnerability could relay a user's leaked Net-NTLMv2 hash against a vulnerable Exchange Server and authenticate as the user. The CVSS for this vulnerability is 9.8 – the highest for this month.
A second critical vulnerability worth mentioning is the Microsoft Outlook Remote Code Execution Vulnerability (CVE-2024-21413). Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. An attacker could craft a malicious link that bypasses the Protected View Protocol, which leads to the leaking of local NTLM credential information and remote code execution (RCE). The CVSS for this vulnerability is 9.8 as well.
Read the full entry: https://isc.sans.edu/diary/Microsoft+February+2024+Patch+Tuesday/30646/
Exploit against Unnamed "Bytevalue" router vulnerability included in Mirai Bot
Published: 2024-02-12
Last Updated: 2024-02-12 14:11:55 UTC
by Johannes Ullrich (Version: 1)
Today, I noticed the following URL showing up in our "First Seen" list ...
Initially, our sensors detected requests for just "goform/webRead/open".
URLs containing "goform" are typically associated with the RealTek SDK. Routers built around the RealTek SoC (System on a Chip) usually use the SDK to implement web-based access tools. The RealTek SDK had numerous vulnerabilities in the past. We currently track over 900 unique URLs in our honeypots using a "/goform/" URL. The most popular URL is usually "goform/set_LimitClient_cfg", associated with CVE-2023-26801 in LB-Link routers. But simple password brute force attacks are also common, taking advantage of default passwords.
So far, I have not been able to identify a specific CVE number for vulnerabilities related to "goform/webRead/open". However, a Chinese blog post from November suggests that this is related to a vulnerability in routers made by the Chinese company "BYTEVALUE." I could not find a patch for the vulnerability.
Read the full entry: https://isc.sans.edu/diary/Exploit+against+Unnamed+Bytevalue+router+vulnerability+included+in+Mirai+Bot/30642/
MSIX With Heavily Obfuscated PowerShell Script
Published: 2024-02-09
Last Updated: 2024-02-09 14:11:04 UTC
by Xavier Mertens (Version: 1)
A few months ago, we saw waves of MSIX malicious packages dropping malware once installed on victim's computers. I started to hunt for such files and saw a big decrease in interesting hints. Today, my YARA rule triggered a new sample. Called "Rabby-Wallet.msix", the file has a VT score of 8/58[.
After a quick look, the file appears to implement the same technique to execute a malicious PowerShell payload ...
Read the full entry: https://isc.sans.edu/diary/MSIX+With+Heavily+Obfuscated+PowerShell+Script/30636/
Internet Storm Center Entries
Internet Storm Center Podcast ("Stormcast") 15th Birthday (2024.02.09)
https://isc.sans.edu/diary/Internet+Storm+Center+Podcast+Stormcast+15th+Birthday/30638/
A Python MP3 Player with Builtin Keylogger Capability (2024.02.08)
https://isc.sans.edu/diary/A+Python+MP3+Player+with+Builtin+Keylogger+Capability/30632/
Anybody knows that this URL is about? Maybe Balena API request? (2024.02.07)
https://isc.sans.edu/diary/Anybody+knows+that+this+URL+is+about+Maybe+Balena+API+request/30628/
Recent CVEs
The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.
CVE-2024-21351 - Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2024-21412 - Internet Shortcut Files Security Feature Bypass Vulnerability
CVE-2024-23917 - In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
CVE-2024-21410 - Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2024-21413 - Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-21762 - Fortinet FortiOS Out-of-Bound Write Vulnerability
CVE-2020-12812 - Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
CVE-2024-22024 - Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways are vulnerable to an XML external entity (XXE) flaw, enabling unauthorized access to restricted resources.
CVE-2024-22024 - XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
CVE-2024-21364 - Microsoft Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2024-21376 - Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
CVE-2024-21403 - Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
CVE-2024-21401 - Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
CVE-2023-50387 - MITRE:
CVE-2024-24398 - Stimulsoft Dashboard.JS before v.2024.1.2 allows remote code execution via a crafted fileName parameter in the Save function.
CVE-2023-46359 - Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier allows unauthenticated remote attackers to execute arbitrary commands through OS command injection via the connectivity check feature.
cve-2023-46359 - and-
CVE-2023-6229 through CVE-2023-6234, CVE-2024-0244 - Multiple buffer overflow vulnerablities in Canon printers
CVE-2024-24112 - xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVE-2024-22852 - D-Link Go-RT-AC750 routers are susceptible to a stack-based buffer overflow in genacgi_main, enabling unauthorized access through a manipulated payload.
CVE-2024-22853 - D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, enabling remote root access via telnet.
CVE-2023-33058, CVE-2023-43518 through CVE-2023-43520, CVE-2023-43534 - Multiple Vulnerabilities in Qualcomm Firmware
CVE-2024-22433 - Dell Data Protection Search 19.2.0 and above have an exposed password opportunity in plain text, allowing a remote attacker to take complete control of the system and affect downstream protected devices.
CVE-2024-25140 - RustDesk 1.2.3 on Windows places an unauthorized certificate with code signing capabilities in the Trusted Root Certification Authorities, potentially compromising the security of the private key and allowing arbitrary software to be signed.
CVE-2024-24592 through CVE-2024-24594 - Multiple vulnerabilities in Allegro AI’s ClearML platform
CVE-2024-1251 - Tongda OA 2017 up to 11.10 is vulnerable to a critical SQL injection in the /general/email/outbox/delete.php file due to a manipulation of the DELETE_STR argument (VDB-252990).
CVE-2024-24000 through CVE-2024-24004 - Multiple vulnerabilities in jshERP v3.3
CVE-2024-24013 through CVE-2024-24015, CVE-2024-24017 through CVE-2024-24019, CVE-2024-24021, CVE-2024-24023 through CVE-2024-24026 - Multiple Vulnerabilities in Novel-Plus v4.3.0-RC1 and prior versions.
CVE-2024-1252 - Tongda OA 2017 up to 11.9 is vulnerable to SQL injection in /general/attendance/manage/ask_duty/delete.php (ASK_DUTY_ID parameter), which has been publicly disclosed and can be mitigated by upgrading to version 11.10.
CVE-2023-40545 - The vulnerable product is affected by an authentication bypass vulnerability when using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
CVE-2024-1259 through CVE-2024-1261 - Multiple unrestricted upload vulnerabilities in Juanpao JPShop up to 1.5.02
CVE-2024-1283 - Chromium:
CVE-2024-1284 - Chromium:
CVE-2024-24186, CVE-2024-24188, CVE-2024-24189 - Multiple vulnerabilities in Jsish v3.5.0 (commit 42c694c)
CVE-2024-24811 - SQLAlchemyDA is vulnerable to unauthenticated execution of arbitrary SQL statements before version 2.2, affecting all users, with no available workaround.
CVE-2024-25145 - Liferay Portal versions 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP versions 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions, allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result through stored cross-site scripting (XSS) vulnerability.
CVE-2023-32328 - IBM Security Verify Access 10.0.0.0 through 10.0.6.1 employs insecure protocols, potentially granting network-based attackers control over the server.
CVE-2023-32330 - IBM Security Verify Access 10.0.0.0 through 10.0.6.1 allows network attackers to gain server control due to insecure calls.
CVE-2024-20252, CVE-2024-20254 - Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) are vulnerable to CSRF attacks, enabling unauthorized remote attackers to perform arbitrary actions on affected devices.
CVE-2024-24563 - Vyper, a Pythonic Smart Contract Language for the Ethereum Virtual Machine, allows the usage of signed integers as indexes for arrays which can lead to unpredictable behavior, accessing inaccessible elements, and denial of service.
CVE-2024-1207 - The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection, allowing unauthenticated attackers to extract sensitive information from the database through the 'calendar_request_params[dates_ddmmyy_csv]' parameter.
CVE-2024-0985 - PostgreSQL versions before 15.6, 14.11, 13.14, and 12.18 allow arbitrary SQL function execution by the object creator of a materialized view using REFRESH MATERIALIZED VIEW CONCURRENTLY.
CVE-2024-24495 - The Daily Habit Tracker v.1.0 is vulnerable to SQL Injection, enabling remote attackers to execute arbitrary code with a crafted GET request.
CVE-2024-24496 - Daily Habit Tracker v.1.0 allows remote attackers to manipulate trackers through several PHP components.
CVE-2024-24497 - Employee Management System v.1.0 is vulnerable to SQL Injection, allowing remote attackers to execute arbitrary SQL commands through the txtusername and txtpassword parameters in login.php.
CVE-2024-24498 - Employee Management System 1.0 is vulnerable to an Unrestricted File Upload, allowing remote attackers to execute arbitrary code through the edit-photo.php component.
CVE-2024-24499 - Employee Management System v.1.0 is vulnerable to SQL Injection, enabling remote attackers to execute arbitrary SQL commands through the txtfullname and txtphone parameters in the edit_profile.php component.
CVE-2024-24830 - OpenObserve, an observability platform, has a vulnerability in the "/api/{org_id}/users" endpoint that allows authenticated regular users to add new users with elevated privileges, compromising the application's role-based access control system and posing a risk to data security.
CVE-2024-25106 - OpenObserve is vulnerable to unauthorized user removal, allowing any authenticated user within an organization to remove any other user, regardless of their role, compromising user management integrity and posing critical security and operational risks.
CVE-2024-24825 - DIRAC distributed resource framework allows any user to obtain a token of another user/agent, potentially exposing resources to unauthorized parties, fixed in release version 8.0.37, upgrade advised with no known workarounds.
CVE-2023-46687 - Emerson Rosemount GC370XA, GC700XA, and GC1500XA products allow arbitrary command execution as a root user by an unauthenticated remote user.
CVE-2024-25674 - MISP before 2.4.184 allows insecure organisation logo upload due to missing file extension and MIME type checks.
CVE-2024-25675 - MISP before 2.4.184 allows unauthorized export generation process initiation.
CVE-2023-6677 - Oduyo Financial Technology Online Collection before v.1.0.2 is vulnerable to SQL Injection.
CVE-2024-25302 - Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.
CVE-2024-25307 - Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/booking.php?id=1."
CVE-2024-25314 through CVE-2024-25314 - Multiple SQL Injection vulnerabilities in Code-projects Hotel Management System 1.0
CVE-2024-25100 - Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program. This issue affects Coupon Referral Program: from n/a through 1.7.2.
CVE-2024-24797 - Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On from n/a through 1.3 allows for remote code execution.
CVE-2024-25108 - Pixelfed is an open source photo sharing platform that allows attackers unauthorized access to administrative and moderator functionality, affecting versions v0.10.4 through v0.11.9.
CVE-2024-25110 - The UAMQP library in version `30865c9c` may allow remote code execution due to a use-after-free issue during a call to open_get_offered_capabilities.
CVE-2024-22131 - SAP ABA allows an authenticated attacker to use a vulnerable interface to invoke unauthorized application functions, enabling data manipulation and potential system unavailability.
CVE-2024-23816 - Location Intelligence Perpetual and SUS versions < V4.3 use a hard-coded secret value, allowing unauthenticated remote attackers to gain full administrative access to the application.
CVE-2024-20667 - Azure DevOps Server Remote Code Execution Vulnerability
CVE-2024-20673 - Microsoft Office Remote Code Execution Vulnerability
CVE-2024-21315 - Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
CVE-2024-21327 - Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVE-2024-21328 - Dynamics 365 Sales Spoofing Vulnerability
CVE-2024-21395 - Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerabilities
CVE-2024-21396 - Dynamics 365 Spoofing Vulnerabilities
CVE-2024-21329 - Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-21338 - Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21345 - Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21342 - Windows DNS Client Denial of Service Vulnerability
CVE-2024-21346 - Win32k Elevation of Privilege Vulnerability
CVE-2024-21347 - Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21348 - Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2024-21349 - Microsoft ActiveX Data Objects Remote Code Execution Vulnerability
CVE-2024-21354, CVE-2024-21355 - Microsoft Message Queuing (MSMQ) Multiple Elevation of Privilege Vulnerabilities
CVE-2024-21357 - Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2024-21363 - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-21350, CVE-2024-21352, CVE-2024-21358 through CVE-2024-21361, CVE-2024-21365 through CVE-2024-21370, CVE-2024-21375, CVE-2024-21391, CVE-2024-21420 - Multiple Remote Code Execution Vulnerabilities in Microsoft WDAC OLE DB provider for SQL Server
CVE-2024-21353 - Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability
CVE-2024-21371 - Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21372 - Windows OLE Remote Code Execution Vulnerability
CVE-2024-21377 - Windows DNS Information Disclosure Vulnerability
CVE-2024-21378 - Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-21379 - Microsoft Word Remote Code Execution Vulnerability
CVE-2024-21380 - Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
CVE-2024-21384 - Microsoft Office OneNote Remote Code Execution Vulnerability
CVE-2024-21404 - .NET Denial of Service Vulnerabilities
CVE-2024-21402 - Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2024-21405 - Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
CVE-2024-21406 - Windows Printing Service Spoofing Vulnerability
CVE-2024-1355, CVE-2024-1359, CVE-2024-1369, CVE-2024-1372, CVE-2024-1374, CVE-2024-1378 - Multiple command injection vulnerabilities in GitHub Enterprise
CVE-2024-24691 - Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows allow an unauthenticated user to escalate privileges through network access due to improper input validation.
CVE-2024-21399 - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2024-1060 - Chromium:
CVE-2024-1059 - Chromium:
CVE-2024-1077 - Chromium:
CVE-2024-21626 - Internal file descriptor leak in CLI
CVE-2021-1782 - Apple Multiple Products Race Condition Vulnerability
CVE-2021-34523 - Microsoft Exchange Server Privilege Escalation Vulnerability
CVE-2020-0688 - Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
CVE-2021-21972 - VMware vCenter Server Remote Code Execution Vulnerability
CVE-2014-0196 - Linux Kernel Race Condition Vulnerability
CVE-2024-23222 - Apple Multiple Products Type Confusion Vulnerability
CVE-2023-4762 - Google Chromium V8 Type Confusion Vulnerability
CVE-2023-43770 - Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Sponsors
Zscaler
Sponsored By Zscaler Buyers Guide: How to Secure Egress Traffic from Workloads in the Public Cloud | Tune in on March 12: Dave Shackleford will explore the inherent challenges associated with legacy cloud workload security, and highlight seven critical capabilities to securing egress traffic from workloads in the public cloud. Register now:
Sysdig
Upcoming Free Virtual Event on Thu, February 29 | SOAR Into 2024: Harness the Power of the 5/5/5 Benchmark for Cloud Detection and Response - Tune in as Dave Shackleford and industry experts show you how to keep your cloud-speed business innovation secure from cloud-speed exploitation. Save your seat today:
Apiiro
Upcoming Webcast: Modernizing AppSec with Application Security Posture Management | Join Matt Bromiley and Idan Elor from Apiiro on March 6 at 1PM ET as they discuss how to secure applications, a complex and cumbersome issue many organizations have yet to solve. Register now:
Palo Alto Networks
Upcoming Webcast on Wednesday, February 28 | The Future of Network Security Technology: A SANS Survey - Join Matt Bromiley as we look at spending habits, priorities, and decision-making processes when it comes to security technology. Register now: