Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters.
Tenable.sc leverages third-party software to help provide underlying functionality. Two of the third-party components (Apache and OpenSSL) were found to contain vulnerabilities, and updated versions have been made available by the providers.
Out of caution, and in line with best practice, Tenable has upgraded the bundled components to address the potential impact of these issues. Tenable.sc Patch 202204.1 updates OpenSSL to version 1.1.1n and Apache to version 2.4.53 to address the identified vulnerabilities.
Multiple vulnerabilities have been discovered in Mozilla Firefox and Firefox Extended Support Release (ESR), the most severe of which could allow for remote code execution.
Mozilla Firefox is a web browser used to access the Internet.
Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations.
Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system’s shell via specifically crafted HTTP requests.
An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests.
FortiGuard Labs is aware of a new campaign from the APT10/Cicada threat actors. Reported by researchers at Symantec, this latest campaign highlights the various tools and custom malware used by Cicada to perform espionage activity, which we covered in our blog post from 2019, which used different TTPs. APT 10 is also referred to as:CicadaCVNXHOGFISH menuPassPOTASSIUM Stone Panda Red Apollo This group focuses specifically on the following verticals:GovernmentLegalPharmaceuticalReligiousTelecomNon-Governmental Organizations (NGOs)and targets multiple countries around the world, including in Europe, Asia, and North America. First seen attacking Japanese interests, Cicada has been observed targeting various managed service providers globally as well. Campaigns have been attributed to the government of China.As part of our membership with the Cyber Threat Alliance, all indicators of compromise (IOCs) were provided to us in advance before publication to ensure Fortinet protections were in place during the time of announcement.What are the Technical Details of Cicada?Cicada has been observed to use a custom loader and malware to perform their attacks. Various activities observed included attacks on Microsoft Exchange Servers. The report suggested that potential zero day exploits were likely used to gain access. Once inside, the attackers would deploy a loader and a custom backdoor known as Sodamaster.Sodamaster is fileless and evades sandbox detection, and enumerates various operating system parameters such as username, hostname, and OS of the targeted systems. It can also download and execute additional payloads. According to the report, the TTPs (Tactics, Techniques and Procedures) used by Cicada were in operation since 2020.Various tools used by Cicada are Mimikatz, rar archiving (file compression), system/network discovery (to determine what systems and services are running) , WMIExec (cmd line to execute commands remotely), and NBTscan (open source for network reconnaissance) tools. Other observations were the usage of VLCplayer that was exploited to act as a custom loader, and WinVnc for remote control of compromised machines.How Widespread is this?This is limited to targeted attacks.Who is Behind this Attack?This has been attributed to APT10 and is state sponsored. For further details on APT10, please refer to “Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information” in the APPENDIX.What Operating Systems are Affected?Windows Operating Systems.What is the Status of Coverage?FortiGuard Labs has coverage in place for publicly available samples as:Riskware/MimikatzW64/HUILOADER.ZYJB!trW64/Ecipekac.M!trAll network IOCs are blocked by the WebFiltering client.
Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code, information disclosure or spoofing.
