Cryptominers attack misconfigured Apache Hadoop
Cryptominers attack misconfigured Apache Hadoop#### Welcome to Security Sunday, your weekly round-up of cybersecurity news.
Over 150k WordPress websites at risk
Last month, security researchers at Wordfence discovered two vulnerabilities in the POST SMTP Mailer plugin.
The first, tracked as CVE-2023–6875, is a critical authorisation bypass vulnerability that occurs in the REST API. The issue affects all versions of the plugin back to 2.8.7.
The second vulnerability is a Cross Site Scripting (XSS) issue identified as CVE-2023–7027. The vulnerability affects POST SMPT up to version 2.8.7 and allows an attacker to inject arbitrary scripts into web pages.
Based on statistics from wordpress.org, there are approximately 150,000 sites using a vulnerable version of the plugin below 2.8.
Wordfence has contacted the vendor of plugin 8. a 19. December 2023. The fix has been released on 1. Administrators are advised to upgrade to version 2.8.8.
Juniper warns of critical RCE vulnerability in its firewalls and switches
Juniper Networks has issued security updates to address a critical Remote Code Execution (RCE) vulnerability in its SRX Series Firewalls and EX Series Switches.
This critical vulnerability, located in the J-Web configuration interfaces and tracked as CVE-2024–21591, could be exploited by an unauthenticated attacker to gain root privileges or perform a denial-of-service (DoS) attack.
“This issue is caused by the use of an insecure feature that allows an attacker to overwrite arbitrary memory,” the company said in a security alert published on Wednesday.
According to Shadowserver, more than 8,000 Juniper devices have J-Web interfaces that are accessible from the Internet.
Administrators are advised to apply security updates immediately or upgrade JunOS to the latest version. If an update is not possible, it is recommended to at least disable the J-Web interface to remove the attack vector.
GitLab releases patch for critical vulnerabilities
GitLab has released security updates that address two critical vulnerabilities, including one that could be exploited to take over accounts without user interaction.
The bug, identified as CVE-2023–7028, has a CVSS severity rating of 10.0.
The DevSecOps platform said the vulnerability was the result of a flaw in the email authentication process that allowed users to reset their passwords via a secondary email address.
GitLab says it has fixed the issue in GitLab 16.5.6, 16.6.4 and 16.7.2, and has also pushed the fix back to 16.1.6, 16.2.9, 16.3.7 and 16.4.5.
Users with two-factor authentication enabled are not susceptible to account takeover because their second authentication factor is required to log in. — GitLab said.
As part of the latest update, GitLab has also fixed another critical bug (CVE-2023–5356, CVSS rating: 9.6) that allows a user to exploit the Slack/Mattermost integration to execute slash commands as another user.
Critical Microsoft SharePoint vulnerability now being actively exploited
CISA warns that attackers are now exploiting a critical privilege escalation vulnerability in Microsoft SharePoint that can be combined with another critical vulnerability to allow remote code execution.
The vulnerability, tracked as CVE-2023–29357, allows remote attackers to gain administrative privileges on unpatched servers by bypassing authentication using forged JWT authentication tokens.
“An attacker who successfully exploited this vulnerability could gain administrative privileges. The attacker does not need any privileges, nor does the user need to take any action,” Microsoft said.
Attackers can also execute arbitrary code on compromised SharePoint servers via command injection if they combine this vulnerability with the RCE vulnerability CVE-2023–24955.
Cryptominers attack misconfigured Apache Hadoop
Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink applications to deploy Cryptominers in target environments.
“What makes this attack particularly interesting is that the attacker uses packers and rootkits to hide the malware. The malware then deletes the contents of certain directories and modifies the system configuration to avoid detection,” the security researchers said.
The attack vector targeting the Hadoop system exploits a misconfiguration of the YARN resource manager, which is responsible for monitoring cluster resources and scheduling applications. Specifically, this flaw can be exploited by an unauthenticated attacker to execute arbitrary code via an HTTP request.
Attacks against Apache Flink similarly target a misconfiguration that allows a remote attacker to achieve code execution without any authentication.
The executed payload is a packed binary that acts as a downloader to obtain two rootkits and a binary for mining the Monero cryptocurrency. To achieve persistence, a cron is created to run the downloader.
As a mitigation, organisations are advised to deploy agent-based security solutions that detect cryptominers and rootkits.
Bitwarden adds passkey support
Popular open source password manager Bitwarden has announced that all users can now log into their web vaults using a passkey instead of the standard username/password pair.
Passkeys are a more secure alternative to most people’s passwords and are resistant to phishing. In Bitwarden’s case, they allow users to decrypt their vault without having to enter a master password, email address or two-factor authentication (2FA).
Interested in cyber security? Check out the next episodes of Security Sunday.
https://medium.com/@zakpatrikcz/list/security-sunday-en-c438ddf5f168