The Ontario Court of Justice sentenced Vachon-Desjardins to six years and eight months in prison

Read More

Google Cloud’s API security is getting a facelift, the company announced Thursday— a new Advanced API Security framework will help users identify potential threats, weed out bot traffic and identify data breaches caused by API misconfigurations or attacks.

Advanced API Security is an outgrowth of the company’s 2016 acquisition of Apigee, which became part of Google in a $625 million deal. According to Google, the new system allows users to dig more deeply into API traffic to detect unusual patterns, which may be signs of an exploit in progress.

To read this article in full, please click here

Read More

CVE-2022-28219: Proof-of-Concept Published for Unauthenticated RCE in Zoho ManageEngine ADAudit Plus

New information and technical details, including a proof-of-concept have been published for a remote code execution flaw in Zoho ManageEngine ADAudit Plus that was patched last month.

Background

On June 29, researchers at Horizon3.ai published a blog post about a recently disclosed vulnerability in Zoho ManageEngine ADAudit Plus, a compliance tool that monitors Active Directory (AD).

*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on June 30 and reflects VPR at that time.

The vulnerability, CVE-2022-28219, was patched on March 30. Approximately three months later, the researchers who discovered it have shared a proof-of-concept (PoC) script that automates the steps to pivot from a XML external entity (XXE) flaw to remote code execution (RCE).

Analysis

CVE-2022-28219 is an unauthenticated RCE caused by underlying Java deserialization, blind XXE injection and path traversal vulnerabilities. This chain of flaws could be exploited to not only achieve RCE, but also compromise domain administrator accounts. This effect of the flaw will make it very attractive to ransomware groups and initial access brokers.

Previousvulnerabilities in Zoho products have been leveraged by advanced persistent threat actors against a variety of targets including academic institutions, defense contractors and critical infrastructure. In late 2021, three vulnerabilities in separate Zoho ManageEngine products were being actively exploited by threat actors. Based on this history, organizations should prioritize patching CVE-2022-28219 immediately.

Solution

This vulnerability impacts all versions of ADAudit Plus builds below 7060. Organizations should ensure they are running the fixed or later version of ADAudit Plus.

Identifying affected systems

A list of Tenable plugins covering CVE-2022-28219 can be found here. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released.

Get more information

Zoho ManageEngine ADAudit Plus advisory for CVE-2022-28219
Horizon3.ai technical write up
Identifying XML External Entity: How Tenable.io Web Application Scanning Can Help

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Read More

Elliptic used Tornado demixing techniques to trace the stolen funds to new Ethereum wallets

Read More

The primary objective of the attack was reportedly to get back at the Indian Government

Read More