• Search for:
    7Dec, 2023
    A New Protocol Vulnerability Will Haunt the Web for Years
    GOOGLE, AMAZON, MICROSOFT, and Cloudflare revealed this week that they battled massive, record-setting distributed denial of service attacks against their cloud infrastructure in August and September. DDoS attacks, in which attackers attempt to overwhelm a service with junk traffic to bring it down, are a classic internet menace, and hackers are always developing new strategies to make them bigger or more effective. The recent attacks were particularly noteworthy, though, because hackers generated them by exploiting a vulnerability in a foundational web protocol. This means that while patching efforts are well underway, fixes will need to essentially reach every web server globally before these attacks can be fully stamped out.

    Dubbed “HTTP/2 Rapid Reset,” the vulnerability can only be exploited for denial of service—it doesn’t allow attackers to remotely take over a server or exfiltrate data. But an attack doesn’t need to be fancy to cause major problems—availability is vital for access to any digital service, from critical infrastructure to crucial information.

    “DDoS attacks can have wide-ranging impacts to victim organizations, including loss of business and unavailability of mission-critical applications,” Google Cloud’s Emil Kiner and Tim April wrote this week. “Time to recover from DDoS attacks can stretch well beyond the end of an attack.”

    Another facet of the situation is where the vulnerability came from. Rapid Reset isn’t in a particular piece of software but in the specification for the HTTP/2 network protocol used for loading webpages. Developed by the Internet Engineering Task Force (IETF), HTTP/2 has been around for about eight years and is the faster, more efficient successor to the classic internet protocol HTTP. HTTP/2 works better on mobile and uses less bandwidth, so it has been extremely widely adopted. IETF is currently developing HTTP/3.

    “Because the attack abuses an underlying weakness in the HTTP/2 protocol, we believe any vendor that has implemented HTTP/2 will be subject to the attack,” Cloudflare’s Lucas Pardue and Julien Desgats wrote this week. Though it seems that there are a minority of implementations that are not impacted by Rapid Reset, Pardue and Desgats emphasize that the problem is broadly relevant to “every modern web server.”

    Unlike a Windows bug that gets patched by Microsoft or a Safari bug that gets patched by Apple, a flaw in a protocol can’t be fixed by one central entity because each website implements the standard in its own way. When major cloud services and DDoS-defense providers create fixes for their services, it goes a long way toward protecting everyone who uses their infrastructure. But organizations and individuals running their own web servers need to work out their own protections.

    Dan Lorenc, a longtime open source software researcher and CEO of the software supply chain security company ChainGuard, points out that the situation is an example of a time when the availability of open source and the prevalence of code reuse (versus always building everything from scratch) is an advantage, because many web servers have likely copied their HTTP/2 implementation from somewhere else rather than reinvent the wheel. If these projects are maintained, they will develop Rapid Reset fixes that can proliferate out to users.

    It will take years to reach full adoption of these patches, though, and there will still be some services that did their own HTTP/2 implementation from scratch and don’t have a patch coming from anywhere else.

    “It’s important to note that the big tech companies discovered this while it was being actively exploited,” Lorenc says. “It can be used to take a service down like operational tech or industrial control. That’s scary.”

    Though the string of recent DDoS attacks on Google, Cloudflare, Microsoft, and Amazon raised the alarm for being so large, the companies were ultimately able to repel the attacks, which didn’t cause lasting damage. But just by carrying out the assaults, hackers revealed the existence of the protocol vulnerability and how it could be exploited—a cause and effect known in the security community as “burning a zero day.” Even though the patching process will take time, and some web servers will remain vulnerable long term, the internet is safer now than if attackers hadn’t shown their cards by exploiting the flaw.

    “A bug like this in the standard is unusual, it’s a novel vulnerability and was a valuable finding for whoever first discovered it,” Lorenc says. “They could have saved it or even probably sold it for a lot of money. I’m always going to be curious about the mystery of why someone decided to burn this one.”

    Resource: https://www.wired.com/story/http-2-rapid-reset-flaw/

    13Apr, 2023
    SAP releases security updates for two critical-severity flaws

    Enterprise software vendor SAP has released its April 2023 security updates for several of its products, which includes fixes for two critical-severity vulnerabilities that impact the SAP Diagnostics Agent and the SAP BusinessObjects Business Intelligence Platform.

    In total, SAP has released 24 notes, 19 of which concern new issues of varying importance, and five are updates to previous bulletins.

    The three most critical issues fixed this time are:

    • CVE-2023-27267: Insufficient input validation and missing authentication issue impacting the OSCommand Bridge of SAP Diagnostics Agent, version 720, enabling an attacker to execute scripts on connected agents and fully compromise the system. (CVSS v3.1 score: 9.0)
    • CVE-2023-28765: Information disclosure vulnerability impacting SAP BusinessObjects Business Intelligence Platform (Promotion Management), versions 420 and 430, allowing an attacker with basic privileges to gain access to the lcmbiar file and decrypt it. This would enable the attacker to access the platform’s users’ passwords and take over their accounts to perform additional malicious actions. (CVSS v3.1 score: 9.8)
    • CVE-2023-29186: Directory traversal flaw impacting SAP NetWeaver versions 707, 737, 747, and 757, allowing an attacker to upload and overwrite files on the vulnerable SAP server. (CVSS v3.1 score: 8.7)

    The remaining 11 security flaws disclosed in SAP’s latest security bulletin concern low to medium-severity vulnerabilities.

    While such issues are generally not considered a priority for patching, they are still leveraged in attacks, especially as part of complex attack chains, so they should be taken care of nonetheless.

    Speedy patching important

    Hackers are always on the look for critical-severity flaws in widely deployed products like those of SAP, which are commonplace in large corporate networks.

    SAP is the largest ERP vendor in the world, having 24% of the global market share with 425,000 customers in 180 countries. Over 90% of the Forbes Global 2000 uses its ERP, SCM, PLM, and CRM products.

    In February 2022, the US Cybersecurity and Infrastructure Security Agency (CISA) urged admins to patch a set of severe vulnerabilities impacting SAP business apps to prevent data theft, ransomware attacks, and disruption of mission-critical processes and operations.

    In April 2021, threat actors were observed attacking fixed flaws in unpatched SAP systems to gain access to corporate networks.

    Hence, it is crucially important for SAP system administrators to apply the available security patches as soon as possible.

    Resource : https://www.bleepingcomputer.com/news/security/sap-releases-security-updates-for-two-critical-severity-flaws/

    6Dec, 2022
    Severe AMI MegaRAC flaws impact servers from AMD, ARM, HPE, Dell, others

    Three vulnerabilities in the American Megatrends MegaRAC Baseboard Management Controller (BMC) software impact server equipment used in many cloud service and data center providers.

    The flaws were discovered by Eclypsium in August 2022 and could enable attackers, under certain conditions, to execute code, bypass authentication, and perform user enumeration.

    The researchers discovered the flaws after examining leaked proprietary code of American Megatrends, specifically, the MegaRAC BMC firmware.

    MegaRAC BMC is a solution for complete “out-of-band” and “lights-out” remote system management, allowing admins to troubleshoot servers remotely as if standing in front of the device.

    MegaRAC BMC firmware is used by at least 15 server manufacturers, including AMD, Ampere Computing, ASRock, Asus, ARM, Dell EMC, Gigabyte, Hewlett-Packard Enterprise, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan.

    Vulnerability details

    The three vulnerabilities discovered by Eclypsium and reported to American Megatrends and impacted vendors are the following:

    • CVE-2022-40259: Arbitrary code execution flaw via Redfish API due to improper exposure of commands to the user. (CVSS v3.1 score: 9.9 “critical”)
    • CVE-2022-40242: Default credentials for sysadmin user, allowing attackers to establish administrative shell. (CVSS v3.1 score: 8.3 “high”)
    • CVE-2022-2827: Request manipulation flaw allowing an attacker to enumerate usernames and determine if an account exists. (CVSS v3.1 score: 7.5 “high”)

    The most severe of the three flaws, CVE-2022-40259, requires prior access to at least a low-privileged account to perform the API callback.

    “The only complication is the attack sits in the path parameter, but it is not URLdecoded by the framework, so the exploit needs to be crafted specially to both be valid per URL and valid per bash shell command,” says Eclypisum.

    For the exploitation of CVE-2022-40242, the only prerequisite for the attacker is to have remote access to the device.

    Impact

    The first two flaws are very severe due to giving attackers access to an administrative shell without requiring further escalation.

    The vulnerabilities could cause data manipulation, data breaches, service outage, business interruption, and more if successfully leveraged.

    The third flaw doesn’t have a significant direct security impact, as knowing what accounts exist on the target isn’t enough to cause any damage.

    However, it would open the way to brute-forcing passwords or performing credential-stuffing attacks.

    “As data centers tend to standardize on specific hardware platforms, any BMC-level vulnerability would most likely apply to large numbers of devices and could potentially affect an entire data center and the services that it delivers,” comments Eclypsium in the report.

    “Standardization of hosting & cloud providers on server components means these vulnerabilities can easily impact hundreds of thousands, possibly millions of systems.”

    System admins are recommended to disable remote administration options and add remote authentication steps where possible.

    Additionally, admins should minimize the external exposure of server management interfaces like Redfish and ensure that the latest available firmware updates are installed on all systems.

    Resource : https://www.bleepingcomputer.com/news/security/severe-ami-megarac-flaws-impact-servers-from-amd-arm-hpe-dell-others/