Notable Recent Security Issues
Public exploit code worsens Atlassian Confluence vulnerability scenario
Description: Threat actors continue to target unpatched versions of Atlassian Confluence with public exploits. The vulnerability, CVE-2022-26134, initially arrived as a zero-day last week that affects all versions of the popular collaboration tool. If exploited, the attacker could completely take over the host and execute remote code on the targeted machine. The vulnerability itself appears to be an OGNL injection vulnerability specifically impacting the web server and can be exploited via an HTTP request. It appears that all HTTP methods are vulnerable as well. The exploitation appears to be relatively straightforward and should be resolved immediately either through patching or other mitigations. Although a patch is publicly available, many instances of the software remain unpatched.
Snort SIDs: 59925-59934
ChinaChopper web shell pops up again on backs of Atlassian bugs
Description: The ChinaChopper web shell is being spread as part of the attacks exploiting the zero-day vulnerability in Atlassian Confluence. Attackers exploiting CVE-2022-26134 install ChinaChopper but rarely access it, leading researchers to believe that it’s being used as a source of backup access. The nearly 11-year-old malware allows attackers to retain access to an infected system using a client-side application that contains all the logic required to control the target. Cisco Talos has documented several instances of different threat groups using China Chopper. This web shell is widely available, so almost any threat actor can use. This also means it’s nearly impossible to attribute attacks to a particular group using only presence of China Chopper as an indicator.
References:
Snort SIDs: 59928, 59931
Interesting News from Around The Security Community
- Law enforcement officials are developing new ways to track and recover stolen cryptocurrency.
The AlphV ransomware group recently attacked systems belonging to the city of Alexandria, Louisiana. As of Tuesday, June 7, there was no information on how widespread the effects were.
The U.S. enlisted the help of an unnamed European country to help secretly manage the encrypted phone company Anom.
Security researchers from Proofpoint say a single state-sponsored actor is behind a phishing campaign that is targeting European and local US government entities.
Microsoft has yet to release a patch for Follina, although security researchers say the vulnerability is relatively easy to exploit.
The city of Palermo, Italy took its online services completely offline Tuesday in response to a cyber attack.
Recent Vulnerabilities with Available Exploits
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2022-1292
Command injection vulnerability in Open SSL
Description: The c_rehash script does not properly sanitize shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. The use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool. The vulnerability is fixed in OpenSSL 3.0.3, OpenSSL 1.1.1o, and OpenSSL 1.0.2ze.
CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
ID: CVE-2020-16209
Stack-based overflow vulnerability in Fieldcomm Group HART-IP
Description: The HART-IP server component hipserver takes HART-IP messages from its clients and transports the embedded HART messages to various HART application programs. An unchecked memory transfer in the IP interface would potentially allow an internal buffer to overflow. A malicious user could exploit this interface by constructing HART-IP messages with payloads sufficiently large to overflow the internal buffer and crash the device or obtain control of the device.
CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
ID: CVE-2021-34111
Command injection vulnerability in Thecus N4800Eco Nas Server Control Panel
Description: Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.
CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Most Prevalent Malware Files
June 2-9, 2022
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
MD5: 93fefc3e88ffb78abb36365fa5cf857c
VirusTotal:
Typical Filename: Wextract
Claimed Product: Internet Explorer
Detection Name: PUA.Win.Trojan.Generic::
SHA 256: e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c
MD5: a087b2e6ec57b08c0d0750c60f96a74c
VirusTotal:
Typical Filename: AAct.exe
Claimed Product: N/A
Detection Name: PUA.Win.Tool.Kmsauto::1201
SHA 256: 125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645
MD5: 2c8ea737a232fd03ab80db672d50a17a
VirusTotal:
Typical Filename: LwssPlayer.scr
Claimed Product: ?????????
Detection Name: Auto.125E12.241442.in02
SHA 256: b2ef49a10d07df6db483e86516d2dfaaaa2f30f4a93dd152fa85f09f891cd049
MD5: 067f9a24d630670f543d95a98cc199df
VirusTotal:
Typical Filename: RzxDivert32.sys
Claimed Product: WinDivert 1.4 driver
Detection Name:
SHA 256: c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0
MD5: 8c69830a50fb85d8a794fa46643493b2
VirusTotal:
Typical Filename: AAct.exe
Claimed Product: N/A
Detection Name: PUA.Win.Dropper.Generic::1201
@ The information contained in this newsletter, including any external links, is provided “AS IS,” with no express or implied warranty, for informational purposes only. Original Info come from SANS.
