blog

Latest Security Vulnerability of the Week 24/10/22 – Application Security – Cloud Security – Infrastructure Security – apache commons – text4shell apple os service fabric 

Latest Security Vulnerability of the Week 24/10/22 - Application Security - Cloud Security - Infrastructure Security - apache commons - text4shell apple os service fabric

Latest Security Vulnerability of the Week 24/10/22 - Application Security - Cloud Security - Infrastructure Security - apache commons - text4shell apple os service fabric

—-

This week we deep dive into the application security vulnerability for apache commons text4shell and the cloud security vulnerability exploit (fixed) service fabric.

—-

Previous Issues of Vulnerability Weekly




Application Security

Attackers started exploiting the new Apache Commons Text 4 Shell.

Apache common text4shell not log4j CVE-2022-42889
Apache common text4shell not log4j CVE-2022-42889

Wordfence on Thursday said it started detecting exploitation attempts targeting the newly disclosed application security flaw in Apache Commons Text on October 18, 2022.

The new vulnerability, CVE-2022-42889, aka Text4Shell, has been assigned a severity ranking of 9.8 out of a possible 10.0 even though the assessment is undergoing new scrutiny. 

The security issue affects libraries versions 1.5 through 19.

The vulnerability resembles the widespread and infamous Log4Shell vuln in that the issue is rooted in how to string substitutions carried out during DNS, script, and URL lookups could lead to the execution of arbitrary code on susceptible systems when passing untrusted input.

The original log4shell was difficult to detect and ingrained in many common libraries, this new version.

“The attacker can send a crafted payload remotely using ‘script,’ ‘dns,’ and ‘url’ lookups to achieve arbitrary remote code execution,” the Zscaler ThreatLabZ team explained.

Like Log4j, a threat actor can send a well-crafted string and open a reverse shell connection with the vulnerable application. A specifically crafted payload can trigger this shell, effectively opening the door for follow-on attacks.

From Zscaler blog

“Most of the payloads we have observed and are tracking appear in query string parameters or headers and use one of the following formats:

DNS prefix: ${dns:address:<victimdomain>.<unique identifier>.<listenerdomain>}” 

Quote from https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/ 

“Fortunately, not all library users would be affected by this security issue – unlike Log4j in the Log4Shell vuln, which was vulnerable even in its most basic use cases,” Checkmarx researcher Yaniv Nizry said.

Users with direct dependencies is recommended to upgrade to the fixed version to mitigate potential threats. 

According to Maven, as many as 2,593 projects use the library, although Flashpoint noted that very few of those listed use the vulnerable method.

INFRA and Network Vulnerabilities

Apple Vulnerability fixes the last zero day of the list.

Apple OS vulnerability Apple fixes latest vulnerability and zero day
Apple OS vuln Apple fixes the latest zero-day.

In a recent update ( Monday, 24th), Apple has fixed the ninth zero-day security issue used in attacks against iPhones since the start of the year. 

The bug (CVE-2022-42827) is an out-of-bounds write issue reported to Apple by an anonymous researcher and caused by software writing data outside the boundaries of the current memory buffer.

No information on the attack and exploitation of that vulnerability. Apple still needs to address and disclose them.

This zero-day bug was most likely only used in highly-targeted attacks.

Installing this update prevents those attacks; hence is highly recommended. 

This will likely allow Apple customers to patch their devices before more attackers develop additional exploits and start using them in attacks targeting vulnerable iPhones and iPads.

Following the full list of vulnerabilities fixed since the beginning of the year by apple

Cloud Security

Azure SFX flaw could have been used to exploit the machine and gain admin access (aka Fabricsape)

now-patched security flaw in Azure Service Fabric Explorer (SFX) 

The cloud security misconfiguration/vuln, tracked as CVE-2022-35829, carried a CVSS severity rating of 6.2 and was addressed by Microsoft as part of its Patch Tuesday updates last week.

orca security fabric scape exploit for cloud security

SFX is described by Microsoft as an open-source tool for inspecting and managing Azure Service Fabric clusters, a distributed systems platform that’s used to build and deploy microservices-based cloud applications.

Armed with this exploit, an adversary can send the specially crafted input during the application creation step, eventually leading to its execution.

Credit Orca Security for this exploit:

“This includes performing a Cluster Node reset, which erases all customized settings such as passwords and security configurations, allowing an attacker to create new passwords and gain full Administrator permissions,” Orca Security researchers Lidor Ben Shitrit and Roee Sagi said.

Previous Issues of vulnerability Weekly





Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

November brings a new release of the platform; as most of the features will be released in v3 we are providing a preview of what’s to come
aeappsecphoenix-com
What is the real cost of manual vulnerability management? in this snapshot we analyse the size of the problem and the requirement for a better and more automated approach
Francesco Cipollone
AppSec Phoenix, the leader in ASOC, pioneering the cloud security and application security relationship, was selected amongst thousands of startups and the only one in cybersecurity as a finalist for the prestigious world communication awards. AppSec Phoenix’s Francesco Cipollone, pioneering the cloud security and application security relationship, was selected as a finalist for the innovator of the year award.
Francesco Cipollone
Francesco Cipollone dreamed of creating an organizations that helps all security professionals love back the work on vulnerability management and application security. AppSec Phoenix’s Francesco Cipollone, pioneering the cloud security and application security relationship, was selected as a finalist for the innovator of the year award.
Francesco Cipollone

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

x Logo: Shield Security
This Site Is Protected By
Shield Security