Matthias Held

A newly disclosed remote code execution (RCE) vulnerability in PHP for Windows, tracked as CVE-2024-4577, has been identified by Devcore Principal Security Researcher Orange Tsai. Discovered on May 7, 2024, this flaw impacts all PHP releases since version 5.x, potentially affecting a massive number of servers globally. 📢 The vulnerability stems from an oversight in handling character encoding conversions, particularly the 'Best-Fit' feature on Windows when PHP operates in CGI mode. This flaw allows unauthenticated attackers to bypass protections from the previous CVE-2012-1823 by leveraging specific character sequences, enabling the execution of arbitrary code on remote PHP servers through argument injection attacks. 🚨 Even systems not configured in CGI mode may still be at risk if the PHP executables (e.g., php.exe or php-cgi.exe) are accessible by the web server. As all Windows versions of PHP, including PHP 8.0, PHP 7.x, and PHP 5.x, are vulnerable, it is critical for users to either upgrade to a newer version or apply the recommended mitigations. 🔐 Devcore also advises system administrators to transition from CGI to more secure alternatives such as FastCGI, PHP-FPM, and Mod-PHP to enhance security and mitigate potential exploits. 🛡️ Read more 🔎>> Link in the comments  #CyberSecurity #InfoSec #PHP #Vulnerability #RCE 

2

1 Kommentar

🚨 WordPress Plugin Alert: Credit Card Skimming 💳 Unknown threat actors are exploiting WordPress code snippet plugins to inject malicious PHP code into sites, stealing credit card data. Plugin in Focus 🔍 - Affected Plugin: Dessky Snippets - Active Installations: Over 200 - First Observed: May 11, 2024, by Sucuri Attack Method ⚙️ The attackers leverage vulnerabilities in WordPress plugins or use easily guessable credentials to gain admin access. They then insert a server-side PHP credit card skimmer into the Dessky Snippets plugin, targeting WooCommerce checkout processes. How It Works 🛠️ The malicious code, saved in the dnsp_settings option of the WordPress wp_options table, modifies the billing form to capture credit card details: - Data Captured: Names, addresses, credit card numbers, expiry dates, and CVV numbers - Data Exfiltration URL: hxxps://2of[.]cc/wp-content/ - Form Manipulation: Adds new fields and disables the autocomplete feature to avoid browser warnings and ensure fields appear necessary. Previous Similar Attacks 🗂️ This isn't the first time code snippet plugins have been abused: WPCode Plugin: Used to inject malicious JavaScript and redirect visitors to VexTrio domains. Simple Custom CSS and JS Plugin: Used in the Sign1 malware campaign, redirecting users from over 39,000 sites to scam pages. Top Tips 🛡️ - Update Regularly: Keep WordPress sites and plugins up-to-date. - Strong Passwords: Use robust passwords to prevent brute-force attacks. - Regular Audits: Check sites frequently for malware or unauthorised changes. Stay vigilant and secure your WordPress sites against these evolving threats! 👉 To read more phishy articles, please visit www.gonephishing.xyz - and sign up to our newsletter to never miss a story! #Newsletter #CyberSecurity #Hacking #Technology #Hacker

1

Unknown threat actors have been found abusing a lesser-known WordPress plugin called Dessky Snippets to insert malicious PHP code on victim sites. The plugin allows users to add custom PHP code and has over 200 active installations. Sucuri has observed this campaign on May 11, 2024. The PHP code inserted in the plugin is capable of harvesting credit card data, making it a significant threat to website owners. These attacks are known to exploit known flaws in WordPress plugins or easily guessable credentials to gain administrator access and install other plugins (legitimate or otherwise) for post-exploitation. Sucuri has warned that the Dessky Snippets plugin is being used to insert a server-side PHP credit card skimming malware on compromised sites, leading to the theft of financial data. Website owners should be aware of this threat and take necessary measures to secure their sites.

2

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Kommentare

⚠️ A new vulnerability has been disclosed affecting PHP on Windows. The CVE-2024-4577 PHP-CGI Argument Injection vulnerability allows the attacker to inject command-line options to PHP when running in a CGI-based setup. Detect and block malicious IPs attempting to exploit CVE-2024-4577: - Install the AppSec Component for the Security Engine and install the dedicated protection rule. - Install the http-cve-probing scenario to your Security Engine and take advantage of the new CVE-2024-4577 detection rule. - Subscribe to the free blocklist containing IPs most aggressively probing for this vulnerability. Read our article to learn more >> https://lnkd.in/egPXrB36 #php #phpcgi #CVE20244577 #exploit #cybersecurity #CrowdSec

34

𝐏𝐇𝐏 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐄𝐱𝐩𝐨𝐬𝐞𝐬 𝐖𝐢𝐧𝐝𝐨𝐰𝐬 𝐒𝐞𝐫𝐯𝐞𝐫𝐬 𝐭𝐨 𝐑𝐞𝐦𝐨𝐭𝐞 𝐂𝐨𝐝𝐞 𝐄𝐱𝐞𝐜𝐮𝐭𝐢𝐨𝐧 A new critical security flaw in PHP, tracked as CVE-2024-4577, has been discovered, potentially allowing remote code execution on Windows servers. This CGI argument injection vulnerability affects all versions of PHP installed on the Windows operating system. This vulnerability can bypass protections previously established for CVE-2012-1823. The PHP implementation team overlooked the "Best-Fit" feature of encoding conversion in Windows, which enables unauthenticated attackers to bypass existing safeguards using specific character sequences. This oversight allows arbitrary code execution on remote PHP servers through the argument injection attack. This significant vulnerability highlights the importance of maintaining up-to-date security measures and monitoring for new threats. Stay vigilant and ensure your systems are protected. #php #cyberthreat #cybersecurity #cybersecurity #cyber #cybersecuritynews #cybersecurityawareness #PHPnews #phpchallenge #PHPCommunity #phpdeveloper #phpdevelopment #phpprogramming

3

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-35185 Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server. The REST ingester allows users to interact with REST endpoints to fetch data for rule evaluation. When fetching data with the REST ingester, Minder sends a request to an endpoint and will use the data from the body of the response as the data to evaluate against a certain rule. If the response is sufficiently large, it can drain memory on the machine and crash the Minder server. The attacker can control the remote REST endpoints that Minder sends requests to, and they can configure the remote REST endpoints to return responses with large bodies. They would then instruct Minder to send a request to their configured endpoint that would return the large response which would crash the Minder server. Version 0.0.49 fixes this issue. CVSSv3.1 Base Score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #minder #apisecurity #owasp https://lnkd.in/d4mq84Rc

8

Security 101: Never hardcode your passwords and/or cert keys into your devices. Lock control maker Chirp might have missed that introduction to security class since they hardcoded their passwords and private keys (no pun, well sort of a pun) into their applications. Chirp made CISA so mad they they were issued their own advisory (see below), as well as earning a "Exploitable remotely/low attack complexity" on CISA's executive summary. "Low attack complexity" means even your grandmother could attack these locks, remotely too. If you are one of the 50,000 households that use Chirp, well, sit by your front door with a loaded shotgun until Chirp fixes this issue. If you aren't a fan of loaded weapons, take a look at the newest Nerf Blasters. If you aren't a fan of Nerf, get yourself a wonderful mastiff dog (or two, very family friendly and protective, just cowards during lightening storms). https://lnkd.in/gQKWQE9t

8

Windows PHP server owners patch now - PHP ADDRESSED CRITICAL RCE FLAW POTENTIALLY IMPACTING MILLIONS OF SERVERS Researchers at cybersecurity firm DEVCORE discovered a critical remote code execution (RCE) vulnerability, tracked as CVE-2024-4577, in the PHP programming language. An unauthenticated attacker can exploit the flaw to take full control of affected servers. https://lnkd.in/gq3VMaQp (Thanks Critical Insight for the reminder)

13

5 Kommentare

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-34701 CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there. Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings. As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm. CVSSv3.1 Base Score: 5.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #CreateWiki #MediaWiki #apisecurity #owasp https://lnkd.in/dwCZs8Pd

5

🚨 Critical Security Flaws in Ivanti Endpoint Manager (EPM) 🚨 Ivanti has rolled out fixes for multiple critical security flaws in Endpoint Manager (EPM) that could lead to remote code execution. 🔒 Key Vulnerabilities: - SQL Injection Flaws (CVE-2024-29822 to CVE-2024-29827): Allow unauthenticated attackers within the same network to execute arbitrary code (CVSS score: 9.6). - Authenticated Attacks (CVE-2024-29828 to CVE-2024-29830, CVE-2024-29846): Require attacker authentication for execution (CVSS score: 8.4). - Avalanche Vulnerability (CVE-2024-29848): High-severity flaw allowing remote code execution by uploading a crafted file (CVSS score: 7.2). - Neurons for ITSM: SQL injection (CVE-2024-22059) and unrestricted file upload bug (CVE-2024-22060). - Connect Secure: CRLF injection flaw (CVE-2023-38551). - Secure Access Client: Local privilege escalation issues on Windows (CVE-2023-38042) and Linux (CVE-2023-46810). The underlying issue originates from the design of Genie's REST API, wherein it permits the inclusion of a user-supplied filename as part of the request. This vulnerability enables a malicious actor to strategically manipulate the filename, potentially compromising the default attachment storage path. At BastionX, we specialize in safeguarding your business from critical security threats. Our comprehensive assessments identify and address vulnerabilities before they can be exploited. We keep all systems updated with the latest security patches, reducing opportunities for attackers. Our real-time monitoring tools detect and respond to suspicious activities, minimizing breach impacts. We help you develop robust incident response plans and educate your staff on cybersecurity best practices to prevent threats like phishing and social engineering attacks. Our commitment is to ensure the security and resilience of your networks. Don’t wait for a breach. Contact BastionX today for a consultation and turn cybersecurity challenges into opportunities for improved defenses. #CyberSecurity #Tech #DataSecurity #RemoteCodeExecution #PatchManagement #ThreatDetection #MSP #MSSP #IT #CyberResilience #ITSecurity

6

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-2440 A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.9.13, 3.10.10, 3.11.8 and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. CVSSv3.1 Base Score: 5.5(CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #github #apisecurity #owasp https://lnkd.in/dkaNBe46

5

A new critical security flaw in PHP, tracked as CVE-2024-4577, has been discovered, potentially allowing remote code execution on Windows servers. This CGI argument injection vulnerability affects all versions of PHP installed on the Windows operating system. This vulnerability can bypass protections previously established for CVE-2012-1823. The PHP implementation team overlooked the "Best-Fit" feature of encoding conversion in Windows, which enables unauthenticated attackers to bypass existing safeguards using specific character sequences. This oversight allows arbitrary code execution on remote PHP servers through the argument injection attack. This significant vulnerability highlights the importance of maintaining up-to-date security measures and monitoring for new threats. Stay vigilant and ensure your systems are protected. #php #cyberthreat #cybersecurity

3