The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.
rubygem-pdfkit-0.8.7-1.fc35
Update to 0.8.7. This new release fixes CVE-2022-25765.
rubygem-pdfkit-0.8.7-1.fc36
Update to 0.8.7. This new release fixes CVE-2022-25765.
rubygem-pdfkit-0.8.7-1.fc37
Update to 0.8.7. This new release fixes CVE-2022-25765.
FortiGuard Labs is aware of a report that Microsoft Exchange servers are actively being scanned to determine which ones are prone to ProxyShell. ProxyShell is an exploit attack chain involving three Microsoft exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207. When used in chain on a vulnerable Microsoft Exchange server, the attack allows the attacker to remotely run malicious code on the targeted system as a result. Microsoft patched all three vulnerabilities as part of Microsoft Patch Tuesday in April and May 2021.When was the Issue Disclosed?Security researcher Orange Tsai presented ProxyShell at the recent BlackHat, DefFon and the Pwn2Own contest.Were CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207 Disclosed as Part of the ProxyShell presentation?No, Microsoft disclosed CVE-2021-31207 in May and CVE-2021-34473 and CVE-2021-34523 in July as part of Patch Tuesday.How Significant is ProxyShell?MEDIUM-HIGH. While ProxyShell allows remote code execution on the compromised machine, patches are available for all three vulnerabilities, which lower the severity. According to security researcher Kevin Beaumont in relation to CVE-2021-34473, “about 50% of internet exposed boxes aren’t patched yet,” which somewhat raises severity.What is the Workflow of ProxyShell?In simple workflow, the attacker first exploits CVE-2021-34473 (Microsoft Exchange Server Remote Code Execution Vulnerability) on the vulnerable Microsoft Exchange server to gain Exchange backend access. Then CVE-2021-34523 (Microsoft Exchange Server Elevation of Privilege Vulnerability) is used to gain admin privilege, then CVE-2021-31207 (Microsoft Exchange Server Security Feature Bypass Vulnerability) is used to perform remote code execution.Has Microsoft released a patch for the vulnerabilities?Yes. Microsoft released a patch for CVE-2021-31207 in May.While CVE-2021-34473 and CVE-2021-34523 were disclosed in July 2021, Microsoft released a patch in April 2021 without disclosing them.Has any Malware been Deployed as a Result of the ProxyShell Exploit Attack Chain?FortiGuard Labs is not aware of any malware being deployed to the affected servers. However, earlier in the year, DearCry ransomware was delivered to the machines that were compromised using another Microsoft Exchange server exploit chain “ProxyLogon”. As such, ransomware payload off ProxyShell is always a possibility. FortiGuard Labs is closely monitoring the situation and will update this Threat Signal when actual payload becomes available.What is the Status of Coverage?FortiGuard Labs provides the following IPS coverage against CVE-2021-34473:MS.Exchange.Server.Autodiscover.Remote.Code.ExecutionFortiEDR detects and blocks ProxyShell attacks out of the box without any prior knowledge or special configuration beforehand. Currently, there is not enough information available for us to develop protection for CVE-2021-31207 and CVE-2021-34523. FortiGuard Labs is closely monitoring the situation and will update this Threat Signal when additional coverage becomes available.Any Other Suggested Mitigation?Disconnect vulnerable Exchange servers from the internet until a patch can be applied.Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.
FortiGuard Labs is aware of reports that previously unseen ransomware “LockFile” is being distributed using ProxyShell and PetitPotam. The attacker gains a foothold into the victim’s network using ProxyShell, then uses PetitPotam to gain access to the domain controller which then enables them to deploy the LockFile ransomware onto the network.What is The Issue?A new ransomware dubbed LockFile is being distributed using ProxyShell and PetitPotam, which Microsoft recently released fixes for. Proof-of-Concept code for ProxyShell is publicly available as such attacks are getting increasingly popular.How does the Attack Work?The attacker gains a foothold into the victim’s network using ProxyShell, then uses PetitPotam to gain access to the domain controller, which then enables the release of the LockFile ransomware onto the network.What is ProxyShell and PetitPotam?ProxyShell is a name for a Microsoft Exchange exploit chain (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) that allows the attacker to bypass ACL controls, elevate privileges and execute remote code on the compromised system.PetitPotam (CVE-2021-36942) is a NTLM (NT LAN Manager) relay attack that allows the attacker to take control of a Windows domain with the Active Directory Certificate Service (AD CS) running.FortiGuard Labs previously posted Threat Signals on ProxyShell and PetitPotam. See the Appendix for the links to the relevant Threat Signals.Are the Patches Available for ProxyShell and PetitPotam?Three vulnerabilities that consists ProxyShell are already patched as the following: CVE-2021-34473 and CVE-2021-34523: Microsoft released a patch as part of April 2021 MS Tuesday.CVE-2021-31207: Microsoft released a patch as part of May 2021 MS Tuesday.CVE-2021-36942 is dubbed PetitPotam and is patched by Microsoft as part of August 2021 MS Tuesday.Microsoft has also provided mitigation for PetitPotam. See the Appendix for a link to “KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services”.What is LockFile ransomware?LockFile is a previously unseen ransomware that first appeared in late July, 2021.Just like any other ransomware, LockFile encrypts files on the compromised system, asks the victim to access the attacker’s onion site and demands ransom in order to recover the encrypted files.What is the Status of Coverage?FortiGuard Labs have the following AV coverage against the attack:W64/KillProc.M!trW32/Agent.QH!exploitW32/PetitPotam.A!exploitRiskware/KernelDrUtil.ERiskware/KDUFortiGuard Labs have the following IPS coverage against ProxyShell and PetitPotam:MS.Exchange.Server.Autodiscover.Remote.Code.ExecutionMS.Windows.Server.NTLM.Relay.Spoofing (initial action is set to “pass”)FortiEDR detects and blocks Proxyshell attacks out of the box without any prior knowledge or special configuration beforehand. All known network IOC’s are blocked by the FortiGuard WebFiltering Client.Any Other Suggested Mitigation?Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.
