CVE-2020-0688 | Microsoft Exchange Validation Key Remote Code Execution Vulnerability

Published: 02/11/2020 | Last Updated : 02/11/2020
MITRE CVE-2020-0688

“A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time.

Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM.

The security update addresses the vulnerability by correcting how Microsoft Exchange creates the keys during install.”

Zero Day Initiative recently published a write-up about this vulnerability, and some key points to know is “Instead of having randomly-generated keys on a per-installation basis, all installations of Microsoft Exchange Server have the same validationKey and decryptionKey values in web.config. These keys are used to provide security for ViewState.” and “Due to the use of static keys, an authenticated attacker can trick the server into deserializing maliciously crafted ViewState data. With the help of YSoSerial.net, an attacker can execute arbitrary .NET code on the server in the context of the Exchange Control Panel web application, which runs as SYSTEM.”

So this is bad. On the bright side it requires an authenticated user, but considering the amount of leaked credentials these days it could be better.

We agree with Zero Day Initiative when they say “if you’re an Exchange Server administrator, you should treat this as a Critical-rated patch and deploy it as soon as your testing is complete. Microsoft lists this with an Exploit Index of 1, which means they expect to see exploits within 30 days of the patch release. As demonstrated, that certainly seems likely.”

Update 2020-03-04: Exploit for this vulnerability is now a part of the metasploit framework and exploitation is very easy, just needs any domain user.

Internally Basefarm is tracking this as BF-VLN-1994667.

CVE-2020-1938 – Apache Tomcat AJP Request Injection and potential Remote Code Execution

Published by Apache: 2020-02-24
MITRE CVE-2020-3158

“When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising.”

There is not enough details available yet, but the vulnerability has at least a CVSS Base score of 8.1, High. This depends on how hard it is to exploit, etc.

There is proof of concept published, but as of writing no known public exploitation of this vulnerability.

Basefarm customers will be upgraded as part of normal patching routines.

Basefarm security news

This blog post is a short summary of this week’s Information Security News put together by SecOps team.

Basefarm have started to publish vulnerability bulletin in the blog posts, feel free to share this with our customers:

https://blog.basefarm.com/blog/category/security-blog/vuln-bullet/feed/

 

Top 3 Security News:

CVE-2020-0618 | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

Critical Cisco Bug Opens Software Licencing Manager to Remote Attack

You are never secure with a WordPress

CVE-2020-1938: Apache Tomcat AJP Connector Remote Code Execution Vulnerability Alert

 

 

 

CVE-2020-3158 – Cisco Smart Software Manager On-Prem Static Default Credential Vulnerability

Published by Cisco: 2020-02-19
MITRE CVE-2020-3158

“A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account.”

The vulnerability has a CVSS Base score of 9.8, Critical.

Basefarm has triaged this vulnerability and found that we are not using the Cisco Smart Software Manager On-Prem software. Basefarm will not track this vulnerability further.

VMSA-2020-0003 vRealize Operations for Horizon Adapter updates address multiple security vulnerabilities (CVE-2020-3943, CVE-2020-3944, CVE-2020-3945)

Published by VMware: 2020-02-18
MITRE CVE-2020-3943

“vRealize Operations for Horizon Adapter uses a JMX RMI service which is not securely configured. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.0.”

“vRealize Operations for Horizon Adapter has an improper trust store configuration leading to authentication bypass. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.6.”

“vRealize Operations for Horizon Adapter contains an information disclosure vulnerability due to incorrect pairing implementation between the vRealize Operations for Horizon Adapter and Horizon View. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.”

The issue has been evaluated by our VMware technicians and Basefarm has concluded that we do not use Horizon Adapter and our systems are therefor not affected by these vulnerabilities.

ThemeREX Addons – Remote Code Execution (0day, Being Exploited)

Published by Wordfence: 2020-02-18
No known CVE

“This flaw allows attackers to remotely execute code on a site with the plugin installed, including the ability to execute code that can inject administrative user accounts.
This vulnerability has not yet been patched. We are only trying to get the word out so people can remove the plugin temporarily as the vulnerability is being actively exploited. ”

Basefarm considers this a Base CVSS Score: 9.8 (Critical) – there is no fix and it is currently being actively exploited.

Basefarm has done some initial investigations regarding the use of this WordPress Theme, but has not identified any customers or internal usage. Basefarm has decided not to track this vulnerability further internally, but want to make it visible by posting this vulnerability bulletin.

CVE-2020-0618 | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability

Published by Microsoft: 02/11/2020
MITRE CVE-2020-0618

“A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests. An attacker who successfully exploited this vulnerability could execute code in the context of the Report Server service account.”

There exists a proof of concept and write-up.

Basefarm considers this a Base CVSS Score: 9.8 (Critical) – but there exists an official fix from Microsoft, bringing the Temporal CVSS Score down to a 9.4 (Critical).

And we consider most of our users do not expose Microsoft SQL Server Reporting Service directly to the internet, so this CVSS Environmental Score can be lowered down to a 7.6 (High).

Per Basefarm Vulnerability process we still consider this a priority 1 (of 3) issue, and we will not wait until normal patch window to mitigate this issue. Internally we are tracking this progress in BF-VLN-1990987, registered 2020-02-18.

Cloud security is voodoo?

“Researchers detail the process of finding two flaws in the Azure Stack architecture and Azure App Service, both of which have been patched.”

“Check Point Research analysts who discovered two vulnerabilities in the Microsoft Azure cloud infrastructure have published the details of how these flaws were found and how attackers could potentially use them.”

Read more at darkreading.com

 Top 5 Security News

 

 

(Blogpost image by Animesh Bhattarai on Unsplash)

Vulnerable Citrix Appliances

On December 17, Citrix disclosed a vulnerability in their ADC, Gateway and SD-WAN product lines. Some patches were delivered around January 10, but these patches were not that efficient. A proper patch was not released before January 19 to January 24, depending on the appliance and release train.

Unfortunately, the nature of the vulnerability makes it extremely simple to exploit. That, combined with the fact that these appliances are usually directly connected to the Internet, makes this a serious threat to the overall Internet health. Exploit code has been generally available since about January 11 and there are now multiple, automated scanners deployed that is targeting unpatched appliances. When compromised, the malware is collecting config files and potentially SSL certificates and keys. There has also been attempts at using compromised appliances as stepping stones to move further into the infrastructure.

Basefarm recommend that all such appliances are checked and verified OK as soon as possible. FireEye has released a tool to aid in the verification. This tool can be found on Github. If a box is believed to be compromised, Basefarm recommends that the appliance is disconnected from the Internet immediately and fully replaced with a freshly installed one with all necessary patches in place before the appliance is exposed to the Internet again. All credentials and SSL keys stored on the appliance should be rotated.

The State of Breach Protection 2020

This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT).

“What are the key considerations security decision makers should take into account when designing their 2020 breach protection?”
1,536 cybersecurity professionals has been asked that question and many other security related questions in Cynet’s “The State of Breach Protection 2020″ survey.
The survey report will give a great insight into common practices, prioritizations and preferences of organization today in how their are protecting themselves from breaches.

Download the full survey report here

 

Top 5 Security News

EU privacy fines near £100m, but regulators are hungry for more

Iran-Linked PupyRAT backdoor used in recent attacks on European energy sector

250 Million Microsoft Customer Support Records Exposed Online

NIST’s new privacy rules – what you need to know

Cisco Warns of Critical Network Security Tool Flaw