• Search for:
    5Dec, 2022
    Deserialized web security roundup: Algolia API key leak, GitHub CVE reporting, scoring CVSS scores

    Our inaugural web security roundup begins with the news that thousands of applications were found to be leaking API keys for Algolia.

    Algolia technology is used by the likes of Lacoste, Stripe, and Slack, to incorporate search, discovery, and recommendations into web, voice, and mobile applications.

    Researchers from CloudSEK found 1,500 apps leaking Algolia API keys, 32 of which had hardcoded keys that could allow attackers to steal or delete the data of millions of users. Vulnerable data included IP addresses, access details, and analytics data.

    Meanwhile, maintainers of open source repositories can now receive private vulnerability reports, remediate them, and issue CVEs via GitHub, the Microsoft-owned software development platform announced at the GitHub Universe conference.

    The news went down well with at least one infosec pro, with vulnerability researcher and The Daily Swig interviewee Alex Chapman calling it an “amazing feature”.

    Staying with vulnerability management, the US Cybersecurity and Infrastructure Security Agency (CISA) has set out a three-step process for enhancing vulnerability management, including leveraging the vulnerability exploitability exchange (VEX), a form of security advisory index recently featured on The Daily Swig that focuses on the exploitability of flaws within applications.

    CISA has also published a study on the effectiveness of the CVSS base score equation that concluded that the metric closely – albeit not perfectly – represents the CVSS maintainers’ expert opinion.

    The Daily Swig also recently reported on system config issues in flavor-of-the-month social networking platform Mastodon, Tailscale VPN nodes being vulnerable to DNS rebinding, and how the Go SAML library was affected by an authentication bypass, among other news.

    Here are some more web security stories and other cybersecurity news that caught our attention in the last fortnight:

    Web vulnerabilities

    • Apache Commons BCEL / CVE-2022-42920 / CVSS 9.8 / Out-of-bounds writing issue impacting APIs could give attackers greater control of resulting bytecode
    • Apache MINA SSHD / CVE-2022-45047 / CVSS 9.8 / Unsafe Java deserialization / Patched
    • Flarum / CVE-2022-41938 / CVSS 9.0 / cross site-scripting XSS allowed injection of malicious HTML markup using discussion title input, either by creating a new discussion or renaming one / Patched November 21
    • TiDB / CVE-2022-3023 / CVSS 9.8 / Data source name injection could lead to arbitrary file reads / Patched November 17

    Research and attack techniques

    • Sonar published a three-part series documenting vulnerabilities in IT Infrastructure monitoring tool Checkmk and its NagVis integration. These flaws could be chained to seize control of servers
    • Platform certificates used to sign system apps on Android builds have been maliciously leaked and used to sign malicious Android apps – “Folks, this is bad. Very, very bad”, tweeted one Android expert
    • Software engineer Tom Forbes uncovered a serious oversight by IT firm Infosys whereby a file was accidentally published to PyPi – and accessible for more than a year – containing AWS keys to an S3 bucket potentially containing patient data from Johns Hopkins University
    • Cybercriminals are tricking TikTok users into downloading malware with the promise of removing invisibility filters from nude photos, Checkmarx reveals – with TikTok videos posted by the attacker gathering over a million views in just two days
    • Hacker extraordinaire Sam Curry revealed that he was part of a team that uncovered 100 vulnerabilities – 50 rated critical – on agricultural equipment supplier John Deere’s security program, with technical details in the pipeline

    Bug bounty / vulnerability disclosure

    • HackerOne’s leading Australian hacker and number 30 on its worldwide leaderboard Shubham Shah has published a deep dive on what it takes to succeed as a bug bounty hunter
    • Belgium-based bug bounty and pen testing platform Intigriti launched a Bug Bounty Calculator, as reported in our monthly Bug Bounty Radar
    • Idaho launched a vulnerability disclosure policy for election websites, becoming the fourth US state to launch a vulnerability disclosure policy, reports Statescoop

    New open source infosec/hacking tools

    • Mi-X – Determines your system’s potential vulnerability to flaws by evaluating runtime execution, configuration, permissions, mitigations, OS, and other relevant variables
    • GuardDog – Identifies malicious Python packages using Semgrep and package metadata analysis
    • Legitify – Detect and remediate misconfigurations plus security and compliance issues across your GitHub assets
    • inTheWild – Vulnerability feed that documents reports of CVEs being exploited in the wild
    • APTRS (Automated Penetration Testing Reporting System) – Python and Django tool for tracking projects and vulnerabilities and creating reports without using DOCX files

    For devs

    • The US’s National Security Agency (NSA) has released guidance (PDF) urging developers to abandon “programming languages that provide little or no inherent memory protection, such as C/C++, to a memory safe language when possible”

    Resource : https://portswigger.net/daily-swig/deserialized-web-security-roundup-algolia-api-key-leak-github-cve-reporting-scoring-cvss-scores

    26Oct, 2022
    Security experts targeted with malicious CVE PoC exploits on GitHub

    Researchers discovered thousands of GitHub repositories that offer fake proof-of-concept (PoC) exploits for various flaws used to distribute malware.

    A team of researchers at the Leiden Institute of Advanced Computer Science (Soufian El Yadmani, Robin The, Olga Gadyatskaya) discovered thousands of repositories on GitHub that offer fake proof-of-concept (PoC) exploits for multiple vulnerabilities.

    The experts analyzed PoCs shared on GitHub for known vulnerabilities discovered in 2017-2021, some of these repositories were used by threat actors to spread malware.

    The experts pointed out that public code repositories do not provide any guarantees that any given PoC comes from a trustworthy source.

    “We discovered that not all PoCs are trustworthy. Some proof-of-concepts are fake (i.e., they do not actually offer PoC functionality), or even malicious: e.g., they attempt to exfiltrate data from the system they are being run on, or they try to install malware on this system.” reads the research paper published by the experts.

    The team focused on a set of symptoms observed in the collected dataset, such as calls to malicious IP addresses, encoded malicious code, or included Trojanized binaries. The boffins analyzed 47313 repositories and 4893 of them were malicious repositories (i.e. 10.3% of the studied repositories have symptoms of malicious intent).

    “This figure shows a worrying prevalence of dangerous malicious PoCs among the exploit code distributed on GitHub.” continues the paper.

    GitHub malicious repositories PoC exploits

    The researchers analyzed a total of 358277 IP addresses, 150734 of them were unique IPs and 2864 were blacklisted. 1,522 IP addressed were labeled as malicious by Virus Total, and 1,069 of them were listed in the AbuseIPDB database.

    Of the 150,734 unique IPs extracted, 2,864 matched blacklist entries. 1522 were detected as malicious in AV scans on Virus Total, and 1069 were present in the AbuseIPDB database.

    Most of the malicious detections are related to vulnerabilities from 2020.

    During their research the experts found multiple examples of malicious PoC developed for CVEs and shared some case studies.

    One of the examples is related to a PoC developed for the CVE-2019-0708, also known as BlueKeep.

    “This repository was created by a user under the name Elkhazrajy. The source code contains a base64 line that once decoded will be running. It contains another Python script with a link to Pastebin28 that will be saved as a VBScript, then run by the first exec command. After investigating the VBScript we discovered that it contains the Houdini malware.” continues the paper.

    Another example detailed by the experts is related to a malicious PoC designed to gather info about the target. In this case the URL to the server used for data exfiltration was base64-encoded.

    The boffins explained that their study has several limitations. For example the GitHub API proved unreliable and not all repositories corresponding to the used CVE IDs were collected.

    Another limitation is related to the use of heuristics for detecting malicious PoCs. Experts explained that the approach can miss some malicious PoCs in their dataset.

    “However, this approach cannot detect every malicious PoC based on source code, since it is always possible to find more creative ways to obfuscate it. We have investigated code similarity as a feature to help identifying new malicious repositories. Our results show that indeed malicious repositories are on average more similar to each other than non-malicious one.” conclude the experts. “This result is the first step to develop more robust detection techniques.”

    The researchers have shared their findings with GitHub and some of the malicious repositories have yet to be removed.

    Resource : https://securityaffairs.co/wordpress/137527/hacking/malicious-github-repositories.html