InfoSecBulletin Cybersecurity for mankind
Brief description of the vulnerabilities is as follows:
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
Sensitive credentials and configuration in container deployments for graphapi versions 0.2.0 to 0.3.0 were exposed, leading to a security vulnerability with a CVSS score of 10.0.
WebDAV API authentication bypass through the use of pre-signed URLs affects core versions 10.6.0 to 10.13.0. This vulnerability has a CVSS score of 9.8.
Subdomain Validation Bypass impacting oauth2 prior to version 0.6.1 (CVSS score: 9.0)
“The first vulnerability involves the ‘graphapi’ app relying on a third-party library that exposes the PHP environment configuration details (phpinfo).”
“This information includes all the environment variables of the web server. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.”
To fix the issue, ownCloud suggests removing the “owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php” file and disabling the ‘phpinfo’ function. Additionally, users are advised to update their ownCloud admin password, mail server and database credentials, and Object-Store/S3 access keys.
The second problem allows anyone to access, modify, or delete any file without needing authentication if they know the victim’s username and the victim hasn’t set up a signing-key, which is the default setting.
“Lastly, the third flaw relates to a case of improper access control that enables an attacker to redirect callbacks to a TLD controlled by the attacker without undergoing validation.”
Besides adding hardening measures to the validation code in the oauth2 app, ownCloud has suggested that users disable the “Allow Subdomains” option as a workaround.
