1724 matches found
Rapid7’s Mid-Year Threat Review
It will come as little surprise to most people that cyber threats in 2023 have been rather prolific. From widely exploited vulnerabilities to high-profile ransomware and extortion campaigns, the first half of the year has seen more than its fair share of large-scale incidents. Rapid7’s 2023...
What's New in CVSS v4
The pending update to the Common Common Vulnerability Scoring System CVSS, version 4.0, has garnered a noticeable volume of articles, blog posts and watercooler now known as Slack and Zoom air time. Reaction from the community has been positive, with general sentiment pinned somewhere near...
Metasploit weekly wrap-up
New module content 1 Metabase Setup Token RCE Authors: Maxwell Garrett, Shubham Shah, and h00die Type: Exploit Pull request: 18232 contributed by h00die Path: exploits/linux/http/metabasesetuptokenrce AttackerKB reference: CVE-2023-38646 Description: This adds a module for an unauthenticated RCE...
Patch Tuesday - August 2023
Microsoft is addressing 86 vulnerabilities this August Patch Tuesday, including one zero-day vulnerability, as well as five critical remote code execution RCE vulnerabilities, and 12 browser vulnerabilities. An unpatched zero-day malicious document vulnerability from July also receives Windows OS...
A Message from Rapid7 CEO, Corey Thomas
Earlier today, the following email was shared with Rapid7 employees. Team, As we accelerate our delivery of the leading security operations solution and service platform experience to customers, we have determined it is necessary to restructure our operations, including the difficult decision to...
Metasploit Weekly Wrap-Up
Fly High in the Sky With This New Cloud Exploit! This week, a new module was added that takes advantage of both authentication bypass and command injection in certain versions of Western Digital's MyCloud hardware. Submitted by community member Erik Wynter, this module gains access to the target,...
PenTales: A Badge, a Tag, and a Bunch of Unattended Chemicals; Why Physical Social Engineering Engagements are an Important Part of Security
At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully...
Poorly Purged Medical Devices Present Security Concerns After Sale on Secondary Market
In a post-pandemic landscape, the interconnectedness of cybersecurity is front and center. Few could say that they were not at least aware of, if not directly affected by, the downstream effects of major breaches that cause impacts felt across economies. One should look at disruptions in the glob...
CVE-2023-35082 - MobileIron Core Unauthenticated API Access Vulnerability
When this blog was originally published on August 2, it said that CVE-2023-35082 only affected MobileIron Core 11.2 and earlier, which are unsupported. On August 7, Ivanti published an updated advisory noting that since originally disclosing CVE-2023-35082, they have continued their investigation...
InsightAppSec Advanced Authentication Settings: Token Replacement
There are many different ways to use InsightAppSec to authenticate to web apps, but sometimes you need to go deeper into the advanced settings to fully automate your logins, especially with API scanning. Today, we’ll cover one of those advanced settings: Token Replacement. InsightAppSec Token...
New InsightCloudSec Compliance Pack for CIS AWS Benchmark 2.0.0
The Center for Internet Security CIS recently released version two of their AWS Benchmark. CIS AWS Benchmark 2.0.0 brings two new recommendations and eliminates one from the previous version. The update also includes some minor formatting changes to certain recommendation descriptions. In this...
New InsightCloudSec Compliance Pack for CIS AWS Benchmark 2.0.0
The Center for Internet Security CIS recently released version two of their AWS Benchmark. CIS AWS Benchmark 2.0.0 brings two new recommendations and eliminates one from the previous version. The update also includes some minor formatting changes to certain recommendation descriptions. In this...
How To Present SecOps Metrics (The Right Way)
SecOps metrics can be a gold mine of potential for informing better business decisions, but 78% of CEOs say they don’t have adequate data on risk exposure to make good decisions. Even when they do see the right data, 82% are inclined to “trust their gut” anyway. Here lies the disconnect between...
Metasploit Weekly Wrap up
Unauthenticated RCE in VMware Product This week, community contributor h00die added an exploit module that leverages a command injection vulnerability in VMWare Aria Operations for Networks, formerly known as vRealize Network Insight. Versions 6.2 to 6.10 are vulnerable CVE-2023-20887. A remote...
PenTales: There Are Many Ways to Infiltrate the Cloud
At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully...
CVE-2023-35078: Critical API Access Vulnerability in Ivanti Endpoint Manager Mobile
CVE-2023-35078 is a remote unauthenticated API access vulnerability in Ivanti Endpoint Manager Mobile, which was previously branded as MobileIron Core. The vulnerability has a CVSS v3 base score of 10.0 and has a severity rating of Critical. Ivanti has reported that they have received information...
Metasploit Weekly Wrap up
It’s open season on Openfire with a new RCE module in Metasploit This week the Metasploit framework saw the addition of an RCE module which exploits path traversal vulnerability in the instant messaging and group chat server, Openfire. The module was submitted by the one and only community...
PenTales: Testing Security Health for a Healthcare Company
At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully...
The Japanese Technology and Media Attack Landscape
Recently, we released a major report analyzing the threat landscape of Japan, the globe’s third largest economy. In that report we looked at the ways in which threat actors infiltrate Japanese companies spoiler alert: it is often through foreign subsidiaries and affiliates and some of the most...
CVE-2023-38205: Adobe ColdFusion Access Control Bypass [FIXED]
!CVE-2023-38205: Adobe ColdFusion Access Control Bypass \FIXED\https://blog.rapid7.com/content/images/2023/07/GettyImages-1185282377-3.jpg On July 11, 2023, Rapid7 and Adobe disclosed CVE-2023-29298, an access control bypass vulnerability affecting ColdFusion, which Rapid7 had reported to Adobe i...
Critical Zero-Day Vulnerability in Citrix NetScaler ADC and NetScaler Gateway
On Tuesday, July 18, Citrix published a security bulletin warning users of three new vulnerabilities affecting NetScaler ADC and NetScaler Gateway. Of the three vulnerabilities, CVE-2023-3519 is the most severe—successful exploitation allows unauthenticated attackers to execute code remotely on...
Managing Risk Across Hybrid Environments with Executive Risk View
Over the last decade or so, organizations of all shapes and sizes across all industries have been going through a seismic shift in the way they engage with their customers and deliver their solutions to the market. These new delivery models are often underpinned by cloud services, which can chang...
Active Exploitation of Multiple Adobe ColdFusion Vulnerabilities
Rapid7 managed services teams have observed exploitation of Adobe ColdFusion in multiple customer environments. The attacks our team has responded to thus far appear to be chaining CVE-2023-29298, a Rapid7-discovered access control bypass in ColdFusion that was disclosed on July 11, with an...
[Lost Bots] S03 E04 A Security Leader’s Playbook for the C-suite
!\Lost Bots\ S03 E04 A Security Leader’s Playbook for the C-suitehttps://blog.rapid7.com/content/images/2023/07/The-Lost-Bots-logo-large.png In a special two-part “Lost Bots,” hosts Jeffrey Gardner and Stephen Davis talk about presenting cybersecurity results up the org chart. Both have handled...
Metasploit Weekly Wrap-Up
Authentication bypass in Wordpress Plugin WooCommerce Payments This week's Metasploit release includes a module for CVE-2023-28121 by h00die. This module can be used against any wordpress instance that uses WooCommerce payments 5.6.1. This module exploits an auth by-pass vulnerability in the...
The Japanese Financial Services Attack Landscape
Recently, we released a major report analyzing the threat landscape of Japan, the globe’s third largest economy. In that report we looked at the ways in which threat actors infiltrate Japanese companies spoiler alert: it is often through foreign subsidiaries and affiliates and some of the most...
PenTales: Old Vulns, New Tricks
At Rapid7 we love a good pentest story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully highlig...
Old Blackmoon Trojan, NEW Monetization Approach
Rapid7 is tracking a new, more sophisticated and staged campaign using the Blackmoon trojan, which appears to have originated in November 2022. The campaign is actively targeting various businesses primarily in the USA and Canada. However, it is not used to steal credentials, instead, it implemen...
SonicWall Recommends Urgent Patching for GMS and Analytics CVEs
On Wednesday, July 12, 2023, security firm SonicWall published an urgent security advisory warning customers of 15 new vulnerabilities affecting on-premise instances of their Global Management System GMS and Analytics products. Four of the vulnerabilities carry critical severity ratings:...
Patch Tuesday - July 2023
Microsoft is addressing 130 vulnerabilities this July Patch Tuesday, including five zero-day vulnerabilities, and eight further critical remote code execution RCE vulnerabilities. Overall, it’s safe to say that this is a busier Patch Tuesday than the past couple of months. Note that the total cou...
CVE-2023-29298: Adobe ColdFusion Access Control Bypass
Rapid7 discovered an access control bypass vulnerability affecting Adobe ColdFusion, in a product feature designed to restrict external access to the ColdFusion Administrator. Rapid7 reported this vulnerability to Adobe on April 11, 2023 and we are now disclosing it in accordance with our...
What’s New in Rapid7 Detection & Response: Q2 2023 in Review
We are excited to share another quarter of new Detection & Response capabilities and improvements. As we continue to innovate across our platform, we thank our customers for continuous insight, engagement, and direction. Keenly focused on our mission to deliver solutions for consolidated,...
Metasploit Weekly Wrap-Up
Apache RocketMQ We saw some great teamwork this week from jheysel-r7 and h00die to bring you an exploit module for CVE-2023-33246. In Apache RocketMQ version 5.1.0 and under, there is an access control issue which the module leverages to update the broker's configuration file without...
The Japanese Automotive Industry Attack Landscape
Recently, we released a major report analyzing the threat landscape of Japan, the globe’s third largest economy. In that report we looked at the ways in which threat actors infiltrate Japanese companies spoiler alert: it is often through foreign subsidiaries and affiliates and some of the most...
PenTales: “User enumeration is not a vulnerability” – I beg to differ
At Rapid7 we love a good pentest story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully highlig...
Showcasing SecOps Metrics That Matter
This year, new rules from the Security and Exchange Commission SEC about board-level expertise, risk management, and public disclosures will take effect. The European Union is updating its regulations, as well. To meet these new requirements, organizations will need to explain to shareholders...
Alerting Rules!: InsightIDR Raises the Bar for Visibility and Coverage
By George Schneider, Information Security Manager at Listrak I've worked in cybersecurity for over two decades, so I've seen plenty of platforms come and go—some even crash and burn. But Rapid7, specifically InsightIDR, has consistently performed above expectations. In fact, InsightIDR has become...
Metasploit Weekly Wrap-Up
Nothing but .NET? Smashery continues to… smash it by updating our .NET assembly execution module. The original module allowed users to run a .NET exe as a thread within a process they created on a remote host. Smashery’s improvements let users run the executable within a thread of the process...
Four Signs You Need to Consolidate Your Tech Stack
Recently, Gartner surveyed security professionals and found that over 50% of the respondents were looking to consolidate their security tech stack. Why? These professionals recognized that security vendor consolidation is key to achieving their goals of improving productivity, visibility, and...
What’s New in InsightVM and Nexpose: Q2 2023 in Review
The past few weeks have been extraordinary for the global threat landscape with zero-day vulnerabilities like MOVEit CVE-2023-34362 and Barracuda’s Email Security Gateway ESG CVE-2023-2868. Rapid7’s security research team was one of the first to detect exploitation of Progress Software’s MOVEit...
Rapid7 Solutions for Partners
Central to our mission at Rapid7 is building long-term relationships with partners who deliver valuable security solutions to customers. As customers increasingly seek managed services to meet their security needs, we've eagerly expanded our partner ecosystem to support a rapidly growing body of...
The Japanese Threat Landscape: A Report on Cyber Threats in the Third Largest Economy on Earth
The Japanese economy is massive, global, and varied. It is also a major target for cyber threat actors. As a hub for automotive, manufacturing, technology, and financial services, Japanese companies and organizations face significant cyber risk. There is nonetheless relatively little...
Standardizing SaaS Data to Drive Greater Cloud Security Efficacy
The way we do business has fundamentally changed, and as a result, so must security. Whether it’s legacy modernization initiatives, process improvements, or bridging the gap between physical and digital—most organizational strategies and initiatives involve embracing the cloud. However, investing...
Uncover and Remediate Toxic Combinations with Attack Path Analysis
Particularly at enterprise scale, it’s not uncommon to have hundreds of thousands of resources running across your cloud environments at any given time. Of course, these resources aren’t running independently. In modern environments, these resources are all interconnected and in many cases...
Metasploit Weekly Wrap-Up
I like to MOVEit, MOVEit, We like to MOVEit! Party hard just like it's Mardi Gras! bwatters-r7 delivered the dance moves this week with a masterful performance. The windows/http/moveitcve202334362 module is available for all your party needs, taking advantage of CVE-2023-34362, this module gets...
Multiple Vulnerabilities in Fortra Globalscape EFT Administration Server [FIXED]
!Multiple Vulnerabilities in Fortra Globalscape EFT Administration Server \FIXED\https://blog.rapid7.com/content/images/2023/06/GettyImages-1345443906.jpg Earlier this year, Rapid7 researchers undertook a project to analyze managed file transfer applications, due to the number of recent...
Cyber Asset Attack Surface Management 101
Understanding CAASM This article was written by Ethan Smart, Co-Founder and Chief Solution Architect, appNovi a Rapid7 integration partner. It's essential for security and IT teams to have a comprehensive view and control of their cyber assets. This is why Cyber Asset Attack Surface Management...
Metasploit Weekly Wrap-Up
Metasploit T-Shirt Design Contest In honor of Metasploit's 20th anniversary, Rapid7 is launching special edition t-shirts - and we're inviting members of our community to have a hand in its creation. The contest winner will have their design featured on the shirts, which will then be available to...
CVE-2023-34362: MOVEit Vulnerability Timeline of Events
The following article was written by Drew Burton and Cynthia Wyre. Rapid7 continues to track the impact of CVE-2023-34362, a critical zero-day vulnerability in Progress Software’s MOVEit Transfer solution. CVE-2023-34362 allows for SQL injection, which can result in unauthorized access to sensiti...
Patch Tuesday - June 2023
It’s June, and it’s Patch Tuesday. The volume of fixes this month is typical compared with recent history: 94 in total including Edge-on-Chromium. For the first time in a while, Microsoft isn’t offering patches for any zero-day vulnerabilities, but we do get fixes for four critical Remote Code...