InfoSecBulletin Cybersecurity for mankind
The very month May-2024 is observed a significant increase in cybersecurity vulnerabilities across various software and operating systems. Many of these vulnerabilities have the potential to be exploited by malicious actors, posing a serious risk to organizations and individuals alike. It is crucial for organizations to stay vigilant and prioritize timely patching and updates to mitigate the risk of exploitation.
CVE-2024-30051: Critical Elevation of Privilege in Windows DWM Core Library
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
Description: CVE-2024-30051 is a serious security flaw in Microsoft Windows’ Desktop Window Manager (DWM) Core Library. It allows attackers to gain elevated privileges on affected systems. This vulnerability is actively being exploited and can have a significant impact.
Impact: A hacker can use this flaw to gain SYSTEM-level privileges, allowing them to execute any operation on the system, like running code, installing software, accessing, modifying, or deleting data, or creating a new account with full user rights.
Mitigation: Windows systems should be patched or updated immediately. Organizations should swiftly deploy Microsoft’s security updates to protect against this high-risk vulnerability.
CVE-2024-30043: Information Disclosure in Microsoft SharePoint Server
Description: Vulnerability in Microsoft SharePoint Server (CVE-2024-30043) could let an authorized attacker reveal sensitive information. Reported by Zero Day Initiative (ZDI).
Impact: This vulnerability enables Server-Side Request Forgery (SSRF) and NTLM relaying attacks. SSRF lets attackers make the application they control communicate with a different, potentially sensitive destination, while NTLM relaying lets the attacker authenticate themselves to other network services.
Mitigation: Users should update their Microsoft SharePoint Server installations, administrators should enforce strong authentication, and managers should monitor network activity for signs of abuse.
CVE-2024-30033: Elevation of Privilege in Windows Search Service
Description: CVE-2024-30033 is a security vulnerability in Windows Search Service that allows an attacker to elevate privileges and manipulate file deletions.
Implication: An attacker can exploit the target’s SELinux context to cause a deletion vulnerability. By constantly creating and removing arbitrary files, an attacker can trick the system into deleting important data or files required for system operations. This vulnerability can potentially cause the system to malfunction.
Mitigation: Updates for security can be applied by users and administrators to detect and prevent unauthorized file manipulations through strict access controls and regular system audits.
CVE-2024-30050: Security Feature Bypass in Windows Mark of the Web
Description: “CVE-2024-30050 is a vulnerability allowing ransomware gangs to bypass Windows Mark of the Web security feature.”
Implication: A skilled attacker can use a malware file to bypass traditional security defenses. This vulnerability can bypass security warnings and permissions, allowing the malicious file to be executed effectively.
Mitigation: It remains vitally important to follow proper security measures and educate users about the risks of downloading files from unknown sources.
Businesses today face various digital weaknesses such as privilege escalations, information leaks, and feature bypasses. Swiftly repairing these flaws upon discovery is essential to prevent attackers from taking advantage of them. Organizations that actively monitor these vulnerabilities are better positioned to stay secure than those that ignore or neglect this knowledge.
Identifying Potential Cybersecurity Threats in May 2024:
The CVE system is essential for tracking security vulnerabilities. The May 2024 CVE updates help us understand what needs to be addressed this year and how to protect our systems from security issues.
Mitigation Strategies for May 2024 Vulnerabilities:
CVE-2024-30051: Apply the Microsoft security updates right away.
Monitoring: Continuously monitor systems for signs of exploitation and unusual activities.
Access Controls: Limit administrative privileges to essential system functionality.
CVE-2024-30043: Information Disclosure in Microsoft SharePoint Server
Patching: Deploy the latest security patches from Microsoft.
Authentication: Strengthen authentication mechanisms, including multi-factor authentication (MFA).
Network Monitoring: Monitor for abnormal network traffic patterns indicative of SSRF or NTLM relay attacks.
CVE-2024-30033: Implement the necessary updates.
Access Controls: Prevent unauthorized file deletions.
Auditing: Regularly monitor logs for any suspicious file deletions.
CVE-2024-30050: Patching: Update all systems.
User Education: Inform users about the dangers of downloading and running files from untrusted sources.
Security Software: Use strong security software to prevent MOTW bypassing.
Threatmon said, such incidents remind us that it is always a good time to practice good forward security in our fast-changing cybersecurity world.
