PenTales: What It’s Like on the Red Team

At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re sharing some of our favorite tales from the pen test desk and hopefully highlight som...

gitea -- missing permission checks

The Gitea team reports: Fix missing check Do some missing checks By crafting an API request, attackers can access the contents of issues even though the logged-in user does not have access rights to these issues...

Under Siege: Rapid7-Observed Exploitation of Cisco ASA SSL VPNs

Tyler Starks, Christiaan Beek, Robert Knapp, Zach Dayton, and Caitlin Condon contributed to this blog. Rapid7’s managed detection and response MDR teams have observed increased threat activity targeting Cisco ASA SSL VPN appliances physical and virtual dating back to at least March 2023. In some...

CVE-2023-27604 Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged...

CVE-2023-27604 Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged...

FreeBSD : gitea -- information disclosure (36a37c92-44b1-11ee-b091-6162c1274384)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 36a37c92-44b1-11ee-b091-6162c1274384 advisory. - The Gitea team reports: Fix API leaking Usermail if not logged in The API should only return the real...

CVE-2023-32678 Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscribers

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to a private stream and have been removed from it since retain the ability to edit messages/topics, move messages to other streams, and delete messages that the...

Lockbit leak, research opportunities on tools leaked from TAs

Lockbit is one of the most prevalent ransomware strains. It comes with an affiliate ransomware-as-a-service RaaS program offering up to 80% of the ransom demand to participants, and includes a bug bounty program for those who detect and report vulnerabilities that allow files to be decrypted...

Fixed in Apache Tomcat 11.0.0-M11

Moderate: Open redirect CVE-2023-41080 If the ROOT default web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice. This was fixed with commit e3703c9a. This issue was reported ...

Fixed in Apache Tomcat 9.0.80

Moderate: Open redirect CVE-2023-41080 If the ROOT default web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice. This was fixed with commit 77c0ce2d. This issue was reported ...

jenningsrealestateteam.com Cross Site Scripting vulnerability OBB-3615380

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Incorrect Authorization in Ivanti Mobileiron_Sentry

CVE-2023-38035 POC for CVE-2023-38035 affecting Ivanti Sentry...

CVE-2023-32498

CVE-2023-32498 : WordPress plugin Easy Form by AYS, affected versions ≤ 1.2.0, suffers a stored XSS vulnerability that requires administrator privileges. Patch available in version 1.2.1; update to 1.2.1 or later to fix.

Carderbee Attacks: Hong Kong Organizations Targeted via Malicious Software Updates

A previously undocumented threat cluster has been linked to a software supply chain attack targeting organizations primarily located in Hong Kong and other regions in Asia. The Symantec Threat Hunter Team, part of Broadcom, is tracking the activity under its insect-themed moniker Carderbee. The...

WordPress Team Slider and Team Grid Showcase plus Team Carousel Plugin <= 2.6 is vulnerable to Broken Access Control

Software Team Slider and Team Grid Showcase plus Team Carousel Type Plugin Vulnerable versions = 2.6 Fixed in 2.6.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b1cfd3da4f76...

CVE-2023-4330

Rejected reason: Broadcom were unable to duplicate the attack as described by Intel DCG Team...

Authentication flaw

Rejected reason: Broadcom were unable to duplicate the attack as described by Intel DCG Team...

CVE-2023-4330

PT-2023-28767 references Broadcom RAID Controller, describing a DoS via an authenticated REST API, implying an issue with the Broadcom RAID Controller web interface. The connected documents do not specify affected versions or a fix; no explicit exploit details are provided. The PT source notes th...

Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

CVE-2023-30533

creationtimestamp| type| source ---|---|--- 2023-08-11 03:59:21+00:00| published-proof-of-concept| https://t.me/crackcodes/4014 2023-08-11 04:00:05+00:00| published-proof-of-concept| Telegram/oCXtildE2yTi9IxdSuzh8AMqV0fg39dXN2lm3qeaYClxQ 2023-08-11 11:17:53+00:00| published-proof-of-concept|...