PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename could exploit this to escalate privileges or distribute malicious content.

Original Release: August 4, 2022

****Overview****

Recently, a security vulnerability was discovered in the PrinterLogic Windows Client driver installation process. Vasion has completed remediation for this vulnerability via an updated Windows Client package.

****Vulnerability Description****

The PrinterLogic Windows Client on or before Version 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename could exploit this to escalate privileges or distribute malicious content. A CVE will be published by Mitre shortly and added to this bulletin when available.

****Investigation and Remediation****

The vulnerability is remediated by updating the PrinterLogic Windows Client to Version 25.0.0.688 or later. Release notes for the new client are found here. Depending on your PrinterLogic platform, the following instructions apply:

*   For PrinterLogic SaaS, information about updating clients is found here.
*   For the PrinterLogic Virtual Appliance, a VA Application Update containing the new Windows client is available. For more information about application updates is available here. Once the update is complete, deploy the new client using the steps found here.
*   For PrinterLogic Web Stack, the latest client download is here.
*   If you prefer to push the new Windows client via third-party software, you’ll find the client installation package (MSI) here.

Original Release: April 5, 2022

****Overview****

A security vulnerability that affects VMware products was reported in CVE-2022-22965. The issue does not impact Vasion software.

****Description****

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment.

****Impact****

While some customers run their PrinterLogic Virtual Appliance on VMware hypervisors, the VA itself is not at risk. Information about remediations for VMware software is available here.

Original Release: Mar 24, 2022

****Overview****

Recently, an out-of-bounds vulnerability assigned to CVE-2021-44142 was disclosed in Samba versions prior to 4.13.17. This flaw involves an out-of-bounds heap read-write event in which remote attackers could execute arbitrary code as root on affected Samba installations that use the VFS module vfs\_fruit. The PrinterLogic Virtual Appliance (VA) is susceptible to this vulnerability and was remediated. This issue does not affect PrinterLogic SaaS.

****Vulnerability Description****

Samba is an implementation of SMB protocol that provides file and printer interoperability for Windows platforms over the network. It is a widely installed software package, and many Linux-based IoT and network devices include publicly open SMB services by default.

The specific flaw exists in EA metadata parsing when opening files in smbd, the Samba server daemon that provides file sharing and printing services to Windows clients. Access as a user with write access to a file’s extended attributes is required to exploit this vulnerability. A guest or unauthenticated user could do this if they are allowed write access to file extended attributes.

The problem in vfs\_fruit exists in the default configuration of the fruit VFS module using fruit:metadata=netatalk or fruit:resource=file. If both options are set to settings other than the default values, the system is not affected by the security issue. The PrinterLogic VA Host has vfs\_fruit enabled and required remediation.

****Vasion Investigation and Remediation****

Vasion has removed the VA\_Fruit module from the PrinterLogic Virtual Appliance. Therefore, we recommend that PrinterLogic VA customers with host versions 1.0.735 and earlier update their VA Host, which includes the latest application release. This update includes other new functionality as well described in the release notes. The update and release notes can be found in our PrinterLogic VA Admin Guide here.

Original Release: Feb 7, 2022

****Overview****

In late January, Vasion became aware of a vulnerability that affects many Linux distributions. The company has completed remediations in its PrinterLogic SaaS and PrinterLogic Virtual Appliance (VA) platforms.

****Vulnerability Description****

Polkit (formerly known as PolicyKit) is a systemd SUID-root program and is installed by default in every major Linux distribution. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. 

In the version of Polkit that resulted in this vulnerability discovery, the pkexec application doesn’t handle the calling parameters count correctly and ends by trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in a way that induces pkexec to execute arbitrary code. This can result in a local privilege escalation and give unprivileged users administrative rights on the target machine.

A new version of Polkit was released that addresses this vulnerability. More information can be found in the CVE-2021-4034 detail document found here.

****Vasion Investigation and Remediation****

Vasion completed its investigation to determine how this vulnerability affects PrinterLogic SaaS and the PrinterLogic Virtual Appliance (VA). It was found that servers for both platforms contained the affected version of Polkit.  

Both PrinterLogic products have been patched with the latest version of Polkit recommended by Linux (0.105-20 Ubuntu 0.18.04.05 changed to 0.105-20 Ubuntu 0.18.04.06). 

Because PrinterLogic SaaS updates occur automatically, this remediation is already live.

PrinterLogic VA customers with host versions 1.0.730 and earlier will need to update their VA host, which includes the latest application release as well. The VA update and release notes can be found in our Admin Guide here.

Original Release: Jan 21, 2022

****Overview****

Recently, security vulnerabilities were discovered in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below. PrinterLogic has completed corrective measures to remediate each vulnerability, and updates are available now for PrinterLogic Web Stack and the Virtual Appliance. Updates occurred automatically with PrinterLogic SaaS and are live worldwide. A summary of the vulnerabilities and corrective actions PrinterLogic has taken are below. Links to the respective CVEs will be added once they are available.

****Vulnerabilities (CVEs) and Remediation Summary****

*   **CVE-2021-42631:** Object Injection leading to RCE CVSS 8.1

– The affected endpoints were reorganized so they no longer use objects passed as parameters (removing the vulnerability). The vulnerable function “unserialize()” is no longer used.

– Affected Web Stack, the VA, and SaaS. Remediations completed.

*   **CVE-2021-42635:** Hardcoded APP\_KEY leading to RCE CVSS 8.1

– The Web Stack installers were adjusted to generate random keys on installation and on updates.

– In addition, we performed scans for other keys and credentials that may have been leaked, and any findings were also corrected.  Measures were furthermore put in place to prevent any leaked secrets from accidentally    being included in future releases.

– Affected Web Stack only. Remediations completed.

*   **CVE-2021-42638:** Misc command injections leading to RCE CVSS 8.1

– The affected areas were completely removed where possible (e.g., no longer supported features, printer models, etc.), and escaping/sanitation was corrected for items that could not be removed.

– Affected Web Stack only. Remediations completed.

*   **CVE-2021-42633:** SQLi may disclose audit logs CVSS 0

– The SQLi code was never used. The offending pages were removed.

– Affected Web Stack, the VA, and SaaS. Remediations completed.

*   **CVE-2021-42637:** Blind SSRF CVSS 4.0

– The test page causing this issue was removed.

– Affected Web Stack only. Remediations completed.

*   **CVE-2021-42639:** Misc reflected XSS CVSS 4.0

– All RCSS vulnerabilities were identified and removed or inputs were escaped or sanitized.

– Affected Web Stack, the VA, and SaaS. Remediations completed.

*   **CVE-2021-42640:** Driver assignment IDOR CVSS 3.8

– RBAC security was added to routes that were allowing access to sensitive objects/data.  

– Affected Web Stack, the VA, and SaaS. Remediations completed.

*   **CVE-2021-42641:** Username/email info disclosure CVSS 2.0

– RBAC security was added to routes that were allowing access to sensitive objects/data.  

– Affected Web Stack, the VA, and SaaS. Remediations completed.

*   **CVE-2021-42642:** Printer console username/password info disclosure CVSS 4.0

– RBAC security was added to routes that were allowing access to sensitive objects/data.  

– Affected Web Stack, the VA, and SaaS. Remediations completed.

****Affected PrinterLogic Software Versions:****

*   **PrinterLogic Web Stack**

– **Version 19.1.1.13 SP9 and earlier**, when operating with macOS or Linux endpoint client software. See new install and update links below.

*   **PrinterLogic Virtual Appliance**

– **Version 20.0.1304 and earlier,** when operating with macOS or Linux endpoint client software.

a. Application update is required. See links below.  

b. Host update not required if you have **VA Host v1.0.674 or later.** 

*   **PrinterLogic SaaS**

– Our SaaS platform does automatic updates. Remediations are now live worldwide. No customer action is needed.

****Updated Files and Documentation****

*   **PrinterLogic Web Stack**

– Link to file for new installs

– Link to file for updates

– Online documentation for these updates

– Only admin server updates are required; no client updates are needed.

*   **PrinterLogic Virtual Appliance**

– Online documentation and file(s) for these updates

– No client software updates are required.

Original Release: Dec 14, 2021

****Overview****

The Log4j vulnerability, documented in CVE-2021-44228, is a remote code execution vulnerability in Log4j. This framework is used for logging within many software solutions. The Log4j library is vulnerable to Remote Command Execution (RCE), which means a remote attacker can execute commands over the network on software that contains the vulnerable Log4j versions.

****Vasion Security Response****

Vasion is aware of the issue and has not found any evidence of exploitation or vulnerability with our products. Vasion products including PrinterLogic SaaS, PrinterLogic VA, and Vasion ST do not utilize, or have dependencies on, the affected Log4j libraries. Therefore, these products are not vulnerable to the referenced CVE-2021-44228.

Our security team will continue to monitor the situation. If our assessment changes, we will publish our findings and subsequent recommendations in this bulletin.

Original Release: Jul 13, 2021

****Overview****

PrintNightmare, documented in CVE-2021-34527, is a remote code execution vulnerability in the Windows Print Spooler. This vulnerability is exposed through specific inbound Remote Procedure Calls (RPC), which are used to add printers and related drivers. This can allow a remote authenticated attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system.

****PrinterLogic Solution****

With PrinterLogic’s Managed Direct IP Printing solution, print jobs are always spooled locally using the local print spooler on the originating workstation. Since PrinterLogic does not use  RPC to access the Windows Print Spooler, a PrinterLogic Managed Direct IP print environment is entirely unaffected when the mitigation steps detailed in the CVE **(option 2)** are followed as recommended by Microsoft. This ensures that the attack vector is closed on all machines running the Windows Print Spooler, while allowing users to continue to safely print using PrinterLogic’s Managed Direct IP solution.

Microsoft has released a patch for this vulnerability. PrinterLogic highly recommends all customers install the July 2021 Out-of-band update on all Windows systems. For details, see KB5004945 and KB5004946.

****What about Point and Print?****

According to Microsoft documentation, Point and Print is a term that refers to the capability of allowing a user on a Windows 2000 and later client to create a connection to a remote printer without providing disks or other installation media. All necessary files and configuration information are automatically downloaded from the print server to the client.

This specifically applies to print queues installed from a Windows print server and does not impact a user’s ability to install print queues from the PrinterLogic Self-Service Portal.

As part of the July 2021 Out-of-band update, a registry setting is checked that will restrict the installation of new unsigned printer drivers to Administrators only. Since PrinterLogic only allows signed Type 3 drivers to be used, and since the PrinterLogic Client is solely responsible for managed print driver installation, this setting will not adversely affect PrinterLogic customers.

While this registry setting does not impact a PrinterLogic Managed Direct IP environment, in accordance with security best practices, PrinterLogic still recommends that all customers enable this registry setting as recommended by Microsoft:

Key: HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint

Value: RestrictDriverInstallationToAdministrators

Type: REG\_DWORD

Data: 1

For more information, please see KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates.

****Caveats****

Printers that are configured as shared printers or with Windows Print Server Links will cease to function properly if inbound remote printing is disabled on the Windows print server. PrinterLogic highly recommends that these printers be converted to Managed Direct IP print queues to avoid this and future Windows Print Spooler vulnerabilities.

****References****

Security Update Guide – Microsoft Security Response Center – CVE-2021-34527

VU#383432 – Microsoft Windows Print Spooler allows for RCE via AddPrinterDriverEx()

KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates

July 6, 2021—KB5004945 (OS Builds 19041.1083, 19042.1083, and 19043.1083) Out-of-band

July 6, 2021—KB5004946 (OS Build 18363.1646) Out-of-band

Introduction to Point and Print – Windows drivers

Original Release: May 3, 2019 | Last Revised: May 9, 2019

**Description**

Using an exploit to forcibly update configuration data, the PrinterLogic Client can be directed to bypass HTTPS hardening or directed to another PrinterLogic Server. The PrinterLogic Client does not correctly verify the origin and integrity of updates. An attacker who successfully exploits these vulnerabilities could run arbitrary code in the context of the Local System Account.

**Solution**

**CVE-2018-5408**

This solution prevents Man-in-the-Middle (MITM) attacks where bad actors may attempt to spoof a trusted entity by tricking the PrinterLogic Server into connecting to a malicious host. To reduce any attempt at MITM attacks, you must configure your PrinterLogic Server to use the HTTPS protocol as described below:

1\. Follow the steps outlined here: HTTP and HTTPS Configuration Steps.

2\. Next, make sure your homeURL is updated to HTTPS. For more information, see Update the Client’s HomeURL.

3\. In addition, you need to apply the client update described below to secure your PrinterLogic environment.

**CVE-2018-5409, CVE-2019-9505**

This solution addresses vulnerabilities related to properly verifying the origin and integrity of the PrinterLogic Client code, as well as sanitizing special characters that could lead to unauthorized changes to configuration files. To address these issues, apply the latest PrinterLogic software update as described below:

1\. Download the update from: PrinterLogic Security Update.

2\. On the PrinterLogic Server, navigate to C:\\inetpub\\wwwroot\\public\\client\\setup.

3\. Make a backup copy of your existing PrinterLogic Client files before replacing them.

4\. Copy and replace the PrinterLogic Client installation files with the new files provided in the download.

5\. Navigate to your PrinterLogic Admin Console and enable the automatic update option to update your clients. If you want to push out the clients via GPO or using a software deployment tool, follow these instructions.

6\. To validate the update, check to see that the client for each workstation has been updated to the new version by navigating to **Tools** → **Reports** → **Workstations** from the PrinterLogic Admin Console. Click **Search** to run a report for workstations in your environment. Verify that the numbers in the Client Version column are **at least** as recent as the numbers shown below  
– Windows: **25.0.0.49** or higher– Mac: **25.1.0.274** or higher– Linux: **25.1.0.274** or higher

If you have questions about these solutions, contact PrinterLogic Product Support for assistance.

**References**

CVE-2018-5408, CVE-2018-5409, CVE-2019-9505

CVE-2022-32427: Security Bulletin | Printerlogic

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:
* CVE-2022-31625: php: uninitialized array in pg_query_params() leading to RCE


RHSA-2022:6158: Red Hat Security Advisory: php:7.4 security update

An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.

****Brief of this vulnerability****

72crm v9 has sql injection vulnerability in View the task calendar

****Test Environment****

*   Windows10
*   PHP 5.6.9+Apache/2.4.39

****Affect version****

72crm v9

****Vulnerable Code****

application\\work\\controller\\Task.php line 506

The $param parameter is passed to getDateList

The start\_time parameter and stop\_time parameter are directly spliced ​​into $whereDate, and then executed on line 493. resulting in sql injection vulnerability

****Vulnerability display****

First enter the background

Click as shown,go to the View the task calendar and capture the packet

payload: start\_time=1&stop\_time=1))+or+sleep(2)--+

Sleep successfully for 2 seconds

If debug mode is enabled  
  
payload：start\_time=1&stop\_time=1))+or+updatexml(1,concat(0x7e,database(),0x7e,version()),1)--+  
  
Successfully obtained the database name and version number

CVE-2022-37178: 72crm v9 has sql injection vulnerability · Issue #34 · 72wukong/72crm-9.0-PHP

Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.

  

> Read our Blog: https://goteleport.com/blog/

> Read our Documentation: https://goteleport.com/docs/getting-started/

**Table of Contents**

1.  Introduction
2.  Installing and Running
3.  Docker
4.  Building Teleport
5.  Why Did We Build Teleport?
6.  More Information
7.  Support and Contributing
8.  Is Teleport Secure and Production Ready?
9.  Who Built Teleport?

**Introduction**

Teleport is the easiest, most secure way to access all your infrastructure. Teleport is an identity-aware, multi-protocol access proxy which understands SSH, HTTPS, RDP, Kubernetes API, MySQL, MongoDB and PostgreSQL wire protocols.

On the server-side, Teleport is a single binary which enables convenient secure access to behind-NAT resources such as:

*   SSH nodes - SSH works in browsers too!
*   Kubernetes clusters
*   PostgreSQL, MongoDB, CockroachDB and MySQL databases
*   Internal Web apps
*   Windows Hosts
*   Networked servers

Teleport is trivial to set up as a Linux daemon or in a Kubernetes pod. It's rapidly replacing legacy sshd\-based setups at organizations who need:

*   Developer convenience of having instant secure access to everything they need across many environments and cloud providers.
*   Audit log with session recording/replay for multiple protocols
*   Easily manage trust between teams, organizations and data centers.
*   Role-based access control (RBAC) and flexible access workflows (one-time access requests)

In addition to its hallmark features, Teleport is interesting for smaller teams because it facilitates easy adoption of the best infrastructure security practices like:

*   No need to manage shared secrets such as SSH keys: Teleport uses certificate-based access with automatic certificate expiration time for all protocols.
*   Two-factor authentication (2FA) for everything.
*   Collaboratively troubleshoot issues through session sharing.
*   Single sign-on (SSO) for everything via Github Auth, OpenID Connect, or SAML with endpoints like Okta or Active Directory.
*   Infrastructure introspection: Use Teleport via the CLI or Web UI to view the status of every SSH node, database instance, Kubernetes cluster, or internal web app.

Teleport is built upon the high-quality Golang SSH implementation. It is _fully compatible with OpenSSH_, sshd servers, and ssh clients.

Project Links

Description

Teleport Website

The official website of the project.

Documentation

Admin guide, user manual and more.

Demo Video

3-minute video overview of Teleport.

Blog

Our blog where we publish Teleport news.

Forum

Ask us a setup question, post your tutorial, feedback, or idea on our forum.

Slack

Need help with your setup? Ping us in our Slack channel.

Cloud-hosted

We offer Enterprise with a Cloud-hosted option. For teams that require easy and secure access to their computing environments.

**Installing and Running**

| Follow the Installation Guide

Download the latest binary release, unpack the .tar.gz and run sudo ./install. This will copy Teleport binaries into /usr/local/bin.

Then you can run Teleport as a single-node cluster:

In a production environment, Teleport must run as root. For testing or non-production environments, run it as the $USER:

chown $USER /var/lib/teleport

*   In this case, you will not be able to log in as another user.

**Docker**

| Follow the Docker-Compose Getting Started Guide

**Deploy Teleport**

If you wish to deploy Teleport inside a Docker container:

    # This command will pull the Teleport container image for version 8
    docker pull public.ecr.aws/gravitational/teleport:8
    

View latest tags on Amazon ECR Public | gravitational/teleport

**For Local Testing and Development**

Follow the instructions in the docker/README file.

To run a full test suite locally, see the test dependecies list

**Building Teleport**

The teleport repository contains the Teleport daemon binary (written in Go) and a web UI written in Javascript (a git submodule located in the webassets/ directory).

If your intention is to build and deploy for use in a production infrastructure a released tag should be used. The default branch, master, is the current development branch for an upcoming major version. Get the latest release tags listed at https://goteleport.com/download/ and then use that tag in the git clone. For example git clone https://github.com/gravitational/teleport.git -b v9.1.2 gets release v9.1.2.

**Dockerized Build**

It is often easiest to build with Docker, which ensures that all required tooling is available for the build. To execute a dockerized build, ensure that docker is installed and running, and execute:

    make -C build.assets build-binaries
    

**Local Build****Dependencies**

Ensure you have installed correct versions of necessary dependencies:

*   Go version from go.mod
*   If you wish to build the Rust-powered features like Desktop Access, see the Rust and Cargo version in build.assets/Makefile (search for RUST_VERSION)
*   For tsh version > 10.x with FIDO support, you will need libfido and openssl 1.1 installed locally

For an example of Dev Environment setup on a Mac, see these instructions.

**Perform a build**

> **Important**
> 
> *   The Go compiler is somewhat sensitive to the amount of memory: you will need **at least** 1GB of virtual memory to compile Teleport. A 512MB instance without swap will **not** work.
> *   This will build the latest version of Teleport, **regardless** of whether it is stable. If you want to build the latest stable release, run git checkout and git submodule update --recursive to the corresponding tag (for example,
> *   run git checkout v8.0.0) **before** performing a build.

Get the source

git clone https://github.com/gravitational/teleport.git
cd teleport

To perform a build

To build tsh with Apple TouchID support enabled:

> **Important**
> 
> tsh binaries with Touch ID support are only functional using binaries signed with Teleport's Apple Developer ID and notarized by Apple. If you are a Teleport maintainer, ask the team for access.

make build/tsh TOUCHID=yes

To build tsh with libfido:

make build/tsh FIDO2=dynamic

*   On a Mac, with libfido and openssl 1.1 installed via homebrew
    
    export PKG\_CONFIG\_PATH="$(brew --prefix openssl@1.1)/lib/pkgconfig"
    make build/tsh FIDO2=dynamic
    

**Build output and running locally**

If the build succeeds, the installer will place the binaries in the build directory.

Before starting, create default data directories:

sudo mkdir -p -m0700 /var/lib/teleport
sudo chown $USER /var/lib/teleport

**Web UI**

The Teleport Web UI resides in the Gravitational Webapps repo.

**Rebuilding Web UI for development**

To clone this repository and rebuild the Teleport UI package, run the following commands:

git clone git@github.com:gravitational/webapps.git
cd webapps
make build-teleport

Then you can replace Teleport Web UI files with the files from the newly-generated /dist folder.

To enable speedy iterations on the Web UI, you can run a local web-dev server.

You can also tell Teleport to load the Web UI assets from the source directory. To enable this behavior, set the environment variable DEBUG=1 and rebuild with the default target:

# Run Teleport as a single-node cluster in development mode:
DEBUG=1 ./build/teleport start -d

Keep the server running in this mode, and make your UI changes in /dist directory. For instructions about how to update the Web UI, read the webapps README file.

**Updating Web UI assets**

After you commit a change to the webapps repo, you need to update the Web UI assets in the webassets/ git submodule.

Run make update-webassets to update the webassets repo and create a PR for teleport to update its git submodule.

You will need to have the gh utility installed on your system for the script to work. For installation instructions, read the GitHub CLI installation documentation.

**Managing dependencies**

All dependencies are managed using Go modules. Here are the instructions for some common tasks:

**Add a new dependency**

Latest version:

go get github.com/new/dependency

and update the source to use this dependency.

To get a specific version, use go get github.com/new/dependency@version instead.

**Set dependency to a specific version**

go get github.com/new/dependency@version

**Update dependency to the latest version**

go get -u github.com/new/dependency

**Update all dependencies****Debugging dependencies**

Why is a specific package imported?

go mod why $pkgname

Why is a specific module imported?

go mod why -m $modname

Why is a specific version of a module imported?

go mod graph | grep $modname

**Why did We Build Teleport?**

The Teleport creators used to work together at Rackspace. We noticed that most cloud computing users struggle with setting up and configuring infrastructure security because popular tools, while flexible, are complex to understand and expensive to maintain. Additionally, most organizations use multiple infrastructure form factors such as several cloud providers, multiple cloud accounts, servers in colocation, and even smart devices. Some of those devices run on untrusted networks, behind third-party firewalls. This only magnifies complexity and increases operational overhead.

We had a choice, either start a security consulting business or build a solution that's dead-easy to use and understand. A real-time representation of all of your servers in the same room as you, as if they were magically _teleported_. Thus, Teleport was born!

**More Information**

*   Teleport Getting Started
*   Teleport Architecture
*   Reference
*   FAQ

**Support and Contributing**

We offer a few different options for support. First of all, we try to provide clear and comprehensive documentation. The docs are also in Github, so feel free to create a PR or file an issue if you have ideas for improvements. If you still have questions after reviewing our docs, you can also:

*   Join Teleport Discussions to ask questions. Our engineers are available there to help you.
*   If you want to contribute to Teleport or file a bug report/issue, you can create an issue here in Github.
*   If you are interested in Teleport Enterprise or more responsive support during a POC, we can also create a dedicated Slack channel for you during your POC. You can reach out to us through our website to arrange for a POC.

**Is Teleport Secure and Production Ready?**

Teleport is used by leading companies to enable engineers to quickly access any computing resource anywhere. Teleport has completed several security audits from the nationally recognized technology security companies. We make some our audits public, view our latest audit reports.. We are comfortable with the use of Teleport from a security perspective.

You can see the list of companies who use Teleport in production on the Teleport product page.

You can find the latest stable Teleport build on our Releases page.

**Who Built Teleport?**

Teleport was created by Gravitational Inc. We have built Teleport by borrowing from our previous experiences at Rackspace. Learn more about Teleport and our history.

CVE-2022-36633: GitHub - gravitational/teleport: The easiest, most secure way to access infrastructure.

By Waqas
This article discusses essential keys to successfully implementing the least privilege policy.
This is a post from HackRead.com Read the original post: 5 Keys To Successful Least Privilege Policy Implementation

The invention of the internet and the latest technologies allows business owners to simplify operations and enhance the efficiency of their businesses. However, it comes with some risks. For instance, it can allow outsiders to access business networks, thus increasing the chances of online or **cybersecurity attacks**. 

A successful online attack can harm your business in various ways. For instance, you can lose your critical data. 

Data forms an integral part of your company. Without it, you might not be able to make strategic decisions. As a result, your business will barely take off from the ground. 

Furthermore, customers won’t trust your brand if it’s prone to cybersecurity attacks. This significantly affects the reputation of your company.  Therefore, you should find effective ways to enhance your cybersecurity strategy. 

You can consider various strategies to increase your business’s online security. One of them is the **principle** of least privilege.

This article discusses essential keys to successfully implementing the least privilege policy. But before delving into the details, here is an overview of this strategy.  

**An Overview Of Least Privilege Principle **

The least privilege principle is an **online security strategy** that gives ordinary users the bare minimum level of access needed to perform a particular task. In simple terms, it ensures employees are given only the level of access necessary to complete the assigned tasks or authorized activities. 

There are several benefits of implementing the least privilege principle. For instance, it can protect your company against common attacks like malware and Structured Query Language **(SQL) injections**.

Also, the least privilege principle involves classifying data and assigning various permissions to different employees. This goes a long way in helping you create a healthy and secure network.  

In addition to that, the strategy allows for better online security and audit capabilities. All these enhance your company’s cybersecurity strategy.  

**Implementing The Least Privilege Principle In Your Business **

As you’ve seen above, implementing the least privilege principle offers considerable benefits. However, the policy of least privilege comes with its **own set of operational challenges**, thus making it hard for organizations to embrace it. But with the right strategies, you can be sure to adopt the least privilege policy in your business successfully and reap its benefits.  

That said, here are five keys to the successful implementation of the least privilege policy: 

*   **Build A Privileged Password Policy**

Passwords form an integral part of running your company’s systems securely. They ensure that only people with specific rights can access certain information. This goes a long way in boosting your business’s online security. 

Therefore, you must build privileged and clear password policies. This ensures everyone using your passwords understands how to protect them. 

In addition to that, you should consider establishing solid passwords for all your accounts. As a result, no non-user can correctly guess them. 

You can adopt numerous strategies to help build strong passwords. First of all, your passwords must be reasonably long. For instance, you can **consider creating passwords** of more than 12 characters.  

In addition, make sure you include a variety of characters in your passwords. These include numerals, letters (upper and lower case), and non-standard characters. Furthermore, you should change passwords regularly. Promoting the use of uncrackable passwords is part of a robust **cybersecurity strategy**.  

*   **Involve Various Stakeholders When Determining Privilege Access Levels**

Being a business owner means handling numerous activities on the same day. For instance, you may want to supervise your team, connect with clients, attend business forums, and even address private matters. That means you may lack enough time to develop and effectively implement the **least privilege policy** in your company systems. For that reason, you may consider working with other company stakeholders. Doing so helps you to complete the task in no time.  

Stakeholders like the human resources manager and department heads can help determine which workers need access and to what extent. Such collaboration can help streamline the implementation of the principle of least privilege than doing the work alone.  

*   **Set All New Accounts With Least Privilege** 

Today, you may be running a small business with just a few employees. However, this may change as your company starts to grow. That means giving more **employees the right to access** your business information. And to achieve that, you need to create new accounts.  

When you decide to build new accounts, you should set their privilege as low as possible. In simple terms, you should give new employees the right to access only what is necessary to complete their assigned tasks. You’ll only need to add specific higher-level access as the job demands. Therefore, ensure the default setting for all newly created account privileges is set to the bare minimum access.  

*   **Determine And Remove Any Inactive User Accounts** 

Inactive user accounts can pose a significant danger to your organization. Such accounts are less monitored. Therefore, hackers can use them to access your business without being caught. 

Besides hackers, employees who no longer work for you may use such dormant accounts to access company information without your knowledge (_**Remember that ex-Cisco employee who Cisco’s AWS Infrastructure; erased virtual machines**_). It’s therefore essential to identify and remove them before implementing the least privilege policy in your organization.  

*   **Select The Right Managed Service Provider** 

Adopting the least privilege policy is one of the best approaches to dealing with cybersecurity attacks. However, this strategy might not work if you partner with the wrong access management service provider. 

There are **numerous managed service providers** you can partner with. However, not all can effectively and seamlessly implement your least privilege policy. Strive to find a service provider with the best solution.  

You can consider various factors to ensure you find the best partner in the market. These include expertise, experience, availability, and technology used, among others. 

Aside from these, the selected service provider should have your company’s best interests at heart. Only by selecting the best identity and data security solution can you have a hassle-free least privilege implementation process. 

**Takeaway**

Implementing the principle of least privilege in your company’s systems is one of the best approaches to access management. It ensures that permissions or ‘privileges’ are given only as needed and revoked when access is no longer necessary. Hence, only the minimum level of access is granted to ordinary users, while **privileged users** have a higher level of access. Their respective roles determine access.

Although it sounds simple, implementing the least privilege policy isn’t easy. However, adopting the abovementioned strategies can help you successfully enforce this security policy in your business systems.

5 Keys To Successful Least Privilege Policy Implementation

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.

**SQL injection in jflyfox jfinal**

Critical severity GitHub Reviewed Published Aug 24, 2022 • Updated Aug 30, 2022

GHSA-5rf4-f24c-hpvh: SQL injection in jflyfox jfinal

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.

GHSA-wv39-f3vx-3v6q: SQL injection in jflyfox jfinal

IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.

\[+\] Title: IceWarp WebClient \[+\] Author: veyselxan \[+\] Vendor Homepage:https://www.icewarp.com/ \[+\] Tested on: Windows 10 \[+\] Versions: 13.0.2.9 \[+\] Fix version: DC2 - Update 2 Build 10 (13.0.2.10) \[+\] Vulnerability Type: SQL injection \[+\] Vulnerable Parameter: "search" \[+\] Vulnerable File: webmail/server/webmail.php \[+\] Cve:CVE-2022-35115 \[+\] Video POC: https://youtu.be/E04ZuqISASQ \[+\] Exploit: INJECTION\_CODE\_POC') AND (SELECT 9056 FROM (SELECT(SLEEP(5)))Ouc0) AND ('bvsb'=bvsb \[+\] Payload: 240 IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.

CVE-2022-35115

Bluecms 1.6 has SQL injection in line 132 of admin/area.php

**Bluecms\_v1.6****Download**

http://lp.downcode.com/j\_14/j\_14745\_bluecms.rar

**vulnerability code:**

in admin/area.php line 36:  
  
Line 36 of admin/area.php is not heavily filtered, and insert at line 47 allows injection  
Single quotes cannot be injected because the argument passed in is get\_magic\_quotes\_gpc()  
However, we found the use code GB2312 in the returned response header  
  
  
So we can do wide-byte injection here  
payload: area\_name=0%df',0,0,0,0),(0,@@Version,0,0,0,0)%23&parentid=0&show\_order=0&act=doadd  
  
  
Successful injection！

CVE-2022-37113: Bluecms V1.6 has SQL injection in line 132 of admin/area.php · Issue #3 · seizer-zyx/Vulnerability

BlueCMS 1.6 has SQL injection in line 55 of admin/model.php

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tag

#sql