Threat Intelligence

A critical vulnerability in the open-source logging software Apache Log4j 2 is fueling a chaotic race in the cybersecurity world, with the Apache Software Foundation (ASF) issuing an emergency security update as bad actors searched for vulnerable servers.

Log4j 2, developed by the ASF, is a widely used Java package that enables logging in an array of  popular applications. The bug, tracked as CVE-2021-44228, is a zero-day vulnerability that allows unauthenticated remote code execution (RCE) that could give attacks control of the systems the software is running in.

The vulnerability – which has been dubbed Log4Shell – has been given a severity score of 10/10, the highest score possible. The Apache Foundation released an emergency patch as part of the 2.15.0 release of Log4j 2 that fixes the RCE vulnerability.

The software is used by both enterprise applications as well as cloud-based services, and the vulnerability could have wide effects on enterprises, according to security professionals. Log4Shell reportedly also can impact the default configurations of several Apache frameworks, such as Apache Struts2, Apache Druid and Apache Flink.

More info: https://www.bleepingcomputer.com/news/security/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare/

Read more

Hello All. VMware has shipped updates to address two security vulnerabilities in vCenter Server and Cloud Foundation that could be abused by a remote attacker to gain access to sensitive information.

The more severe of the issues concerns an arbitrary file read vulnerability in the vSphere Web Client. Tracked as CVE-2021-21980, the bug has been rated 7.5 out of a maximum of 10 on the CVSS scoring system, and impacts vCenter Server versions 6.5 and 6.7.

“A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information,” the company noted in an advisory published on November 23, crediting ch0wn of Orz lab for reporting the flaw.

The second shortcoming remediated by VMware relates to an SSRF (Server-Side Request Forgery) vulnerability in the Virtual storage area network (vSAN) Web Client plug-in that could allow a malicious actor with network access to port 443 on vCenter Server to exploit the flaw by accessing an internal service or a URL request outside of the server.

The company credited magiczero from SGLAB of Legendsec at Qi’anxin Group with discovering and reporting the flaw.

Further information can be found at:

Read more

Hello All. The deadline of December 31, 2020 that DHS’s Cybersecurity and Infrastructure Security Agency (CISA) have imposed requiring that all US federal agencies to update their SolarWinds Orion platform to the latest version of Orion has come and gone. We all know having been on the sharp end of the stick requiring the business to update vulnerable software can sometimes end with the business accepting the risk. This is essentially what CISA is requiring US Government depts. and agencies to do if they are unable to upgrade for some reason or another.

They also have to provide proof that a “forensic analysis” has been conducted to verify that a breach has not already occurred using the vulnerable install of Orion. However, there is even an exception for those who are unable to perform a forensic analysis – “Agencies running affected versions that have no capability to conduct forensic analysis (system memory, host storage, network, and cloud) shall, at minimum, hunt for IOCs or other evidence of threat actor activity published in ED 21-01, Activity Alert AA20-352A, and future associated guidance. Agencies that, through hunting and/or forensic analysis, find these IOCs or evidence of threat actor activity, such as secondary AOO, shall assume breach and must report it as an incident to CISA through https://us-cert.cisa.gov/report”

Here is the supplemental guidance v3 from CISA:

“This supplemental guidance v3 requires (1) agencies that ran affected versions conduct forensic analysis, (2) agencies that accept the risk of running SolarWinds Orion comply with certain hardening requirements, and (3) reporting by agency from department-level Chief Information Officers (CIOs) by Tuesday, January 19, and Monday, January 25, 2020.”

Would be interesting to know what the stats are on the remaining affected installations of Orion and what depts. and agencies are affected. With all the exceptions in place, do you think the US Government is leaving themselves open for breaches?

Read more on the CISA site: https://cyber.dhs.gov/ed/21-01/#supplemental-guidance

Read more