https://bugalert.org/2023-10-31T14:45:00+00:00A nonprofit service for alerting security and IT professionals of high-impact and 0day vulnerabilities.2023-10-31T14:45:00+00:002023-10-31T14:45:00+00:00Bug Alert Contributorstag:bugalert.org,2023-10-31:/content/notices/2023-10-31-confluence.html

<p>An authorization vulnerability exploitable by unauthenticated users has been discovered in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Exploitation of the vulnerability can cause substanial data loss. Atlassian recommends removing installations from the Internet immediately if they cannot be patched.</p>

<table> <thead> <tr> <th>⚠ Quick note: SMS and phone notifications are not working in the United States due to new compliance requirements. Bug Alert is working with our telephony provider to resolve this as soon as possible.</th> </tr> </thead> <tbody> <tr> <td></td> </tr> </tbody> </table> <p>On Tuesday, October 31st, 2023, <a href="https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-confluence-server-1311473907.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to an authorization vulnerability which allows an unauthenticated attacker to cause significant data loss. Patches are available.</p> <p>Now that a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet if they cannot be patched immediately, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2023-22518.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2023-10-31T14:45:00+00:002023-10-31T14:45:00+00:00Bug Alert Contributorstag:bugalert.org,2023-10-31:/content/notices/2023-10-31-confluence.html

<p>An authorization vulnerability exploitable by unauthenticated users has been discovered in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Exploitation of the vulnerability can cause substanial data loss. Atlassian recommends removing installations from the Internet immediately if they cannot be patched.</p>

<table> <thead> <tr> <th>⚠ Quick note: SMS and phone notifications are not working in the United States due to new compliance requirements. Bug Alert is working with our telephony provider to resolve this as soon as possible.</th> </tr> </thead> <tbody> <tr> <td></td> </tr> </tbody> </table> <p>On Tuesday, October 31st, 2023, <a href="https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-confluence-server-1311473907.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to an authorization vulnerability which allows an unauthenticated attacker to cause significant data loss. Patches are available.</p> <p>Now that a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet if they cannot be patched immediately, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2023-22518.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2023-10-31T14:45:00+00:002023-10-31T14:45:00+00:00Bug Alert Contributorstag:bugalert.org,2023-10-31:/content/notices/2023-10-31-confluence.html

<p>An authorization vulnerability exploitable by unauthenticated users has been discovered in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Exploitation of the vulnerability can cause substanial data loss. Atlassian recommends removing installations from the Internet immediately if they cannot be patched.</p>

<table> <thead> <tr> <th>⚠ Quick note: SMS and phone notifications are not working in the United States due to new compliance requirements. Bug Alert is working with our telephony provider to resolve this as soon as possible.</th> </tr> </thead> <tbody> <tr> <td></td> </tr> </tbody> </table> <p>On Tuesday, October 31st, 2023, <a href="https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-confluence-server-1311473907.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to an authorization vulnerability which allows an unauthenticated attacker to cause significant data loss. Patches are available.</p> <p>Now that a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet if they cannot be patched immediately, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2023-22518.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2023-10-04T12:45:00+00:002023-10-04T12:45:00+00:00Bug Alert Contributorstag:bugalert.org,2023-10-04:/content/notices/2023-10-04-confluence.html

<p>A privilege escalation flaw has been found, and is being actively exploited, in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Atlassian recommends removing installations from the Internet immediately if they cannot be patched.</p>

<p>On Wednesday, October 4th, 2023, <a href="https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to a privilege escalation vulnerability <strong>that is under active exploitation</strong>. Patches are available.</p> <p>Now that a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet if they cannot be patched immediately, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2023-22515.</p> <p>If your Confluence installation is hosted behind Cloudflare and your origin is protected from the Internet, <a href="https://blog.cloudflare.com/all-cloudflare-customers-protected-atlassian-cve-2023-22515/">Cloudflare is mitigating the exploit for you already</a>.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2023-10-04T12:45:00+00:002023-10-04T12:45:00+00:00Bug Alert Contributorstag:bugalert.org,2023-10-04:/content/notices/2023-10-04-confluence.html

<p>A privilege escalation flaw has been found, and is being actively exploited, in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Atlassian recommends removing installations from the Internet immediately if they cannot be patched.</p>

<p>On Wednesday, October 4th, 2023, <a href="https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to a privilege escalation vulnerability <strong>that is under active exploitation</strong>. Patches are available.</p> <p>Now that a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet if they cannot be patched immediately, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2023-22515.</p> <p>If your Confluence installation is hosted behind Cloudflare and your origin is protected from the Internet, <a href="https://blog.cloudflare.com/all-cloudflare-customers-protected-atlassian-cve-2023-22515/">Cloudflare is mitigating the exploit for you already</a>.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2023-10-04T12:45:00+00:002023-10-04T12:45:00+00:00Bug Alert Contributorstag:bugalert.org,2023-10-04:/content/notices/2023-10-04-confluence.html

<p>A privilege escalation flaw has been found, and is being actively exploited, in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Atlassian recommends removing installations from the Internet immediately if they cannot be patched.</p>

<p>On Wednesday, October 4th, 2023, <a href="https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to a privilege escalation vulnerability <strong>that is under active exploitation</strong>. Patches are available.</p> <p>Now that a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet if they cannot be patched immediately, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2023-22515.</p> <p>If your Confluence installation is hosted behind Cloudflare and your origin is protected from the Internet, <a href="https://blog.cloudflare.com/all-cloudflare-customers-protected-atlassian-cve-2023-22515/">Cloudflare is mitigating the exploit for you already</a>.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-11-09T15:00:00+00:002022-11-09T15:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-11-09:/content/notices/2022-11-09-twilio-support-test.html

<p>This is a test notice, which you have opted in to. Bug Alert has completed integrating Twilio support for international calls and SMS. Save our phone number to your contacts!</p>

<p>The Bug Alert team is excited to test our integration with Twilio, which will allow the project to send calls and SMS notifications to our subscribers outside of North America. We have a new phone number as well.</p> <p>Calls and texts will now come from <strong>+1 (507) 668-8567</strong> _{+1 (507) NOVULNS 😉}</p> <h3>A celebration!</h3> <p>When Bug Alert launched in January 2022, it was hard to imagine having even a few hundred people as part of our community. Today, we serve notices to thousands of people all across the world, and continue to stand at the ready to make a positive difference in the security community. Thank you for your continued support, and we're so glad to be bringing the entire Bug Alert feature set to our worldwide community.</p> <p>If you got this test notice by SMS (we didn't fire off phone calls for this one), feel free to take a screen shot and post it in celebration on the <a href="https://github.com/BugAlertDotOrg/bugalert/pull/73">GitHub pull request for this notice</a>! We especially want to celebrate a (hopefully) successful test with anyone who lives outside of North America.</p> <h3>A few housekeeping items:</h3> <p>We've also seen an increase in email notices going to Spam folders; if you would please check your spam and mark any Bug Alert messages as 'safe', it would help the project immensely!</p> <p>Bug Alert is happy to continue serving the Twitter community, but I (Matthew Sullivan, Founder) remain concerned about Twitter's long-term prospects. A significant number of security professionals have adopted the <a href="https://infosec.exchange/">Infosec Exchange Mastodon server</a> as their new home. Bug Alert runs on volunteer time, but getting support for posting notices automatically on the Infosec Exchange Mastodon server will be a high priority, so that we can properly serve that community. If that's something you are interested in tackling, we'd be happy to accept a pull request to the project.</p> <p>Finally: if you received an email or SMS linking to this notice, and no longer wish to receive test notices (typically no more than one per quarter), please update <a href="https://bugalert.org/content/pages/my-subscriptions.html">your Bug Alert subscription preferences</a>.</p>2022-07-20T10:00:00+00:002022-07-20T10:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-07-20:/content/notices/2022-07-20-atlassian.html

<p>Multiple Vulnerabilities have been disclosed in Atlassian Products. A hardcoded credential vulnerability in Questions for Confluence, and Servlet Filter Bypass Vulnerabilities have been found in multiple Atlassian products that may enable Authentication Bypasses, XSS Attacks, and CORS attacks. These vulnerabilities have been assigned a bug alert severity of 'very high'. Atlassian recommends patching affected installations immediately.</p>

<p>On Wednesday, July 20th, 2022, <a href="https://confluence.atlassian.com/security/july-2022-atlassian-security-advisories-overview-1142446703.html">Atlassian released a Security Advisory</a> stating that a hardcoded credential vulnerability exists in the Questions for Confluence application, as well as Servlet Filter bypasses in both first and third party applications tied to multiple Atlassian products. </p> <p>The hardcoded credential vulnerability stems from the use of the Questions for Confluence application with the <code>disabledsystemuser</code> account. The fix here is to update the Questions for Confluence app to a non-vulnerable version, or to disable/delete this account. <strong>Uninstalling the Questions for Confluence application does not remediate this vulnerability.</strong></p> <p>To check for use of the <code>disabledsystemuser</code> account, follow instructions found <a href="https://confluence.atlassian.com/confkb/how-to-get-a-list-of-users-with-their-last-logon-times-985499701.html">here.</a></p> <p>At this time they have not released any specifics as to what the exact vulnerable endpoint is for the servlet bypasses, or any indicators of compromise that could lead defenders to believe they have been exploited. The current fix is to patch to the level indicated in the advisory.</p> <p>If exploited, these servlet bypass vulnerabilities may enable attackers to perform an Authentication Bypass, Cross-Site Scripting (XSS) Attacks, or Cross-Origin Resource Sharing (CORS) bypass.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-06-02T17:00:00+00:002022-06-02T17:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-06-02:/content/notices/2022-06-02-confluence.html

<p>An unauthenticated remote code execution flaw has been found, and is being actively exploited, in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Atlassian recommends removing installations from the Internet immediately.</p>

<p>On Thursday, June 2nd, 2022, <a href="https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to an Unauthenticated Remote Code Execution vulnerability <strong>that is under active exploitation</strong>. At this time they have not released any specifics as to what the exact vulnerable endpoint is, or any indicators of compromise that could lead defenders to believe they have been exploited. There is currently no fix.</p> <p>Once a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. This post will be updated as information becomes available.</p> <p>At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2022-26134. <del>Patches are not yet available from the vendor</del> (see last update for patch links). This notice will be updated when they are published.</p> <h2>Update as of June 2nd, 10:00PM New York time</h2> <p>Cybersecurity firm Volexity has <a href="https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/">published a blog post</a> detailing how they originally found this vulnerability being used in the wild, prior to reporting it to Atlassian. Their write-up includes IP ranges the attackers utilized, as well as some additional background information.</p> <p>The United States Cybersecurity &amp; Infrastructure Security Agency (CISA) has added this flaw to its list of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">known exploited vulnerabilities</a> with a deadline for remediation of Friday, June 3rd, 2022.</p> <p><del>As of this update, there is still no patch available.</del> Confluence administrators are urged to remove public-facing installations from the Internet as soon as possible.</p> <h2>Update as of June 3rd, 2:30PM New York time</h2> <p><strong><a href="https://www.atlassian.com/software/confluence/download-archives">Patches are now available from Atlassian.</a></strong></p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-06-02T17:00:00+00:002022-06-02T17:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-06-02:/content/notices/2022-06-02-confluence.html

<p>An unauthenticated remote code execution flaw has been found, and is being actively exploited, in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Atlassian recommends removing installations from the Internet immediately.</p>

<p>On Thursday, June 2nd, 2022, <a href="https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to an Unauthenticated Remote Code Execution vulnerability <strong>that is under active exploitation</strong>. At this time they have not released any specifics as to what the exact vulnerable endpoint is, or any indicators of compromise that could lead defenders to believe they have been exploited. There is currently no fix.</p> <p>Once a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. This post will be updated as information becomes available.</p> <p>At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2022-26134. <del>Patches are not yet available from the vendor</del> (see last update for patch links). This notice will be updated when they are published.</p> <h2>Update as of June 2nd, 10:00PM New York time</h2> <p>Cybersecurity firm Volexity has <a href="https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/">published a blog post</a> detailing how they originally found this vulnerability being used in the wild, prior to reporting it to Atlassian. Their write-up includes IP ranges the attackers utilized, as well as some additional background information.</p> <p>The United States Cybersecurity &amp; Infrastructure Security Agency (CISA) has added this flaw to its list of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">known exploited vulnerabilities</a> with a deadline for remediation of Friday, June 3rd, 2022.</p> <p><del>As of this update, there is still no patch available.</del> Confluence administrators are urged to remove public-facing installations from the Internet as soon as possible.</p> <h2>Update as of June 3rd, 2:30PM New York time</h2> <p><strong><a href="https://www.atlassian.com/software/confluence/download-archives">Patches are now available from Atlassian.</a></strong></p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-06-02T17:00:00+00:002022-06-02T17:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-06-02:/content/notices/2022-06-02-confluence.html

<p>An unauthenticated remote code execution flaw has been found, and is being actively exploited, in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Atlassian recommends removing installations from the Internet immediately.</p>

<p>On Thursday, June 2nd, 2022, <a href="https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html">Atlassian released a Security Advisory</a> stating that Confluence Server and Data Center editions are vulnerable to an Unauthenticated Remote Code Execution vulnerability <strong>that is under active exploitation</strong>. At this time they have not released any specifics as to what the exact vulnerable endpoint is, or any indicators of compromise that could lead defenders to believe they have been exploited. There is currently no fix.</p> <p>Once a patch has been made available, it's likely that additional attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. This post will be updated as information becomes available.</p> <p>At this time, Atlassian is advising customers to remove Confluence Server and Data Center from being available from the Internet, either by shutting them down, or by firewalling them off.</p> <p>This vulnerability been assigned CVE-2022-26134. <del>Patches are not yet available from the vendor</del> (see last update for patch links). This notice will be updated when they are published.</p> <h2>Update as of June 2nd, 10:00PM New York time</h2> <p>Cybersecurity firm Volexity has <a href="https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/">published a blog post</a> detailing how they originally found this vulnerability being used in the wild, prior to reporting it to Atlassian. Their write-up includes IP ranges the attackers utilized, as well as some additional background information.</p> <p>The United States Cybersecurity &amp; Infrastructure Security Agency (CISA) has added this flaw to its list of <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">known exploited vulnerabilities</a> with a deadline for remediation of Friday, June 3rd, 2022.</p> <p><del>As of this update, there is still no patch available.</del> Confluence administrators are urged to remove public-facing installations from the Internet as soon as possible.</p> <h2>Update as of June 3rd, 2:30PM New York time</h2> <p><strong><a href="https://www.atlassian.com/software/confluence/download-archives">Patches are now available from Atlassian.</a></strong></p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $100 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-05-30T09:00:00+00:002022-05-30T09:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-05-30:/content/notices/2022-05-30-office.html

<p>A remote code execution vulnerability, dubbed 'Follina', has been found in Microsoft Office via Microsoft Support Diagnostic Tool (MSDT). This issue can be exploited in the default configuration on Windows, and only requires the user be tricked into downloading a malicious file. There is no patch. This issue has been assigned a bug alert severity of 'high'.</p>

<p>On Monday, May 30th, 2022, <a href="https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e">security researcher Kevin Beaumont published a blog post</a> detailing an exploit, 'Follina', that had been discovered three days prior and discussed at length on Twitter. This exploit abuses the template retrieval mechanism in Microsoft Office installations on Microsoft Windows systems to initiate arbitrary code, using a vulnerability in Microsoft Support Diagnostic Tool (MSDT). On May 30th, 2022, <a href="https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/">Microsoft acknowledged this issue</a> and workarounds are available, but there is no patch. This exploit has been actively used against Russia-based targets for over a month.</p> <p>Exploit code is widely available online, and weaponization of this vulnerability by groups <em>other than</em> the original authors is likely already underway. While awaiting patches from Microsoft, the best course of action is to monitor for use of this exploit, provide user education and implement workarounds. Signatures for various detection tools have been made available and are linked from Kevin Beaumont's post. Microsoft has also released detections for Microsoft Defender. This post will be updated as information becomes available.</p> <p>This vulnerability has been assigned CVE-2022-30190.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $50 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-04-20T19:00:00+00:002022-04-20T19:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-04-20:/content/notices/2022-04-20-jira.html

<p>An authentication bypass vulnerability has been found in Atlassian Jira. This issue can be exploited in the default configuration, and has been assigned a bug alert severity of 'very high'.</p>

<p>On Wednesday, April 20th, 2022, <a href="https://confluence.atlassian.com/jira/jira-security-advisory-2022-04-20-1115127899.html">Atlassian released a Security Advisory</a> stating that Jira's web authentication framework, Jira Seraph, is vulnerable to an Authentication Bypass vulnerability. At this time they have not released any specifics as to what the exact vulnerable endpoint is, or any indicators of compromise that could lead defenders to believe they have been exploited. It's likely that attackers will inspect the differences in the application binaries between the fixed and vulnerable versions, and develop attack methods rapidly. This post will be updated as information becomes available.</p> <p>At this time, Atlassian is advising customers to install updated version of Jira Core Server, Jira Software Server, and Jira Software Data Center. If updating is not possible, installing updates to affected plug-ins (found in the advisory) is suggested, followed by disabling those plug-ins if updates are not available.</p> <p>This vulnerability been assigned CVE-2022-0540. Patches are available now from the vendor.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $50 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-03-30T15:00:00+00:002022-03-30T15:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-03-30:/content/notices/2022-03-30-spring.html

<p>Praetorian has confirmed that a remote code execution vulnerability exists in Spring, an extremely popular Java framework. How broadly this impacts the Spring ecosystem remains unclear. The flaw has been assigned a bug alert severity of 'critical'.</p>

<h4>Updated Notice, 10:00AM New York Time</h4> <p>This flaw has been assigned CVE-2022-22965, and the Spring team is now issuing fixes. <a href="https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement">Please follow their post here for further updates</a>.</p> <h4>Original Notice</h4> <p>This is <strong><em>not</em></strong> related to CVE-2022-22963, Spring Cloud Function, or SpEL routing expressions. That is a separate, (possibly?) less widespread issue <a href="https://tanzu.vmware.com/security/cve-2022-22963">documented here</a>. Sadly, both are being referred to broadly as 'Spring4Shell', significantly adding to the confusion. We suggest the community refrain from using the term.</p> <p><a href="https://www.praetorian.com/blog/spring-core-jdk9-rce/">Praetorian has confirmed the existence of the remote code execution vulnerability that impacts Spring Core.</a> Praetorian has also confirmed online rumors of the issue being caused by a partial fix to a very old issue, <a href="http://blog.o0o.nu/2010/06/cve-2010-1622.html">CVE-2010-1622</a>. Unfortunately, proof-of-concept code is now widely available and is likely to be weaponized. What we don't know, though, is how widespread this issue really is, or how easily exploited it will be in the real world. As of late in the evening on March 30th, New York time, there's not much evidence yet that it will be exploitable in common configurations.</p> <p>There is currently no patch. The existing proof-of-concept, as well as the proof-of-concept from 2010, both reference <code>class.module.classLoader</code> when constructing the attack. Bug Alert therefore recommends testing and deploying a WAF rule that analyzes request bodies for requests containing the term <code>classLoader</code>. Please remember that regex-based WAF rules are often easily bypassed, so do not regard this as a long-term solution.</p> <p>Continue to monitor the Praetorian blog and the Bug Alert discussion thread (linked below) for further information. Once available, official notice from the Spring project is likely to be placed on the <a href="https://tanzu.vmware.com/security/">VMware Tanzu security advisories page</a> (VMware owns the Spring project). It's likely they will also <a href="https://spring.io/blog">furnish a blog post</a> with further information at a later time.</p> <p><a href="https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/">Rapid7 has put together a fantastic writeup with technical details</a>. Their blog post also details some of the configurations that are required for the exploit to be successful, and they have committed to using that venue to provide additional information as it becomes available.</p> <p>If you have feedback or questions, please comment on the discussion thread linked below. This notice cost the project approximately $150 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a></p>2022-03-30T15:00:00+00:002022-03-30T15:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-03-30:/content/notices/2022-03-30-spring.html

<p>Praetorian has confirmed that a remote code execution vulnerability exists in Spring, an extremely popular Java framework. How broadly this impacts the Spring ecosystem remains unclear. The flaw has been assigned a bug alert severity of 'critical'.</p>

<h4>Updated Notice, 10:00AM New York Time</h4> <p>This flaw has been assigned CVE-2022-22965, and the Spring team is now issuing fixes. <a href="https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement">Please follow their post here for further updates</a>.</p> <h4>Original Notice</h4> <p>This is <strong><em>not</em></strong> related to CVE-2022-22963, Spring Cloud Function, or SpEL routing expressions. That is a separate, (possibly?) less widespread issue <a href="https://tanzu.vmware.com/security/cve-2022-22963">documented here</a>. Sadly, both are being referred to broadly as 'Spring4Shell', significantly adding to the confusion. We suggest the community refrain from using the term.</p> <p><a href="https://www.praetorian.com/blog/spring-core-jdk9-rce/">Praetorian has confirmed the existence of the remote code execution vulnerability that impacts Spring Core.</a> Praetorian has also confirmed online rumors of the issue being caused by a partial fix to a very old issue, <a href="http://blog.o0o.nu/2010/06/cve-2010-1622.html">CVE-2010-1622</a>. Unfortunately, proof-of-concept code is now widely available and is likely to be weaponized. What we don't know, though, is how widespread this issue really is, or how easily exploited it will be in the real world. As of late in the evening on March 30th, New York time, there's not much evidence yet that it will be exploitable in common configurations.</p> <p>There is currently no patch. The existing proof-of-concept, as well as the proof-of-concept from 2010, both reference <code>class.module.classLoader</code> when constructing the attack. Bug Alert therefore recommends testing and deploying a WAF rule that analyzes request bodies for requests containing the term <code>classLoader</code>. Please remember that regex-based WAF rules are often easily bypassed, so do not regard this as a long-term solution.</p> <p>Continue to monitor the Praetorian blog and the Bug Alert discussion thread (linked below) for further information. Once available, official notice from the Spring project is likely to be placed on the <a href="https://tanzu.vmware.com/security/">VMware Tanzu security advisories page</a> (VMware owns the Spring project). It's likely they will also <a href="https://spring.io/blog">furnish a blog post</a> with further information at a later time.</p> <p><a href="https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/">Rapid7 has put together a fantastic writeup with technical details</a>. Their blog post also details some of the configurations that are required for the exploit to be successful, and they have committed to using that venue to provide additional information as it becomes available.</p> <p>If you have feedback or questions, please comment on the discussion thread linked below. This notice cost the project approximately $150 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a></p>2022-03-29T23:00:00+00:002022-03-29T23:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-03-29:/content/notices/2022-03-29-spring.html

<p>An unconfirmed, but possible, remote code execution vulnerability is believed to exist in Spring, an extremely popular Java framework. This issue is likely easily exploited in common configurations. If confirmed, another notice will be sent out with a severity of 'critical'. While unconfirmed, the severity has been assigned 'high'.</p>

<h2>Update as of March 30th, 3:00PM New York time</h2> <p><a href="https://www.praetorian.com/blog/spring-core-jdk9-rce/">Praetorian has confirmed the existence of this RCE in a recently-published blog post.</a></p> <p><a href="/content/notices/2022-03-30-spring.html">A new Bug Alert notice has been added here.</a></p> <h2>Update as of March 30th, 1:30PM New York time</h2> <p>The Bug Alert team is aware of claims of a PoC for a Spring core RCE. However, we are awaiting confirmation before raising any further alarms, and we have not been able to utilize the PoC successfully against real-world Spring installs that we have (legal) access to. Some security professionals have claimed, on Twitter, that they are able to utilize the PoC successfully against Spring instances running behind Tomcat.</p> <p>Adding to the confusion, multiple Spring devs have publicly stated there is no known vulnerability within Spring Core, and they have also stated that yesterday's serialization-related code change <em>was not</em> an attempt a resolving an open security issue.</p> <p>We'll share any further info as it comes in, but at this time we are taking a cautious approach with raising any further alarms. This is already a deeply confusing situation, and Bug Alert wants to avoid making it worse.</p> <p>Finally, we would like to remind readers that Bug Alert is intended to be one of the earliest sources of information, and we have to weigh the risks of being early, but being wrong. This may very well end up being a case where we are wrong, but in the moment it is hard to know what is accurate. We will continue to monitor the situation and report on new developments.</p> <h2>Original notice</h2> <p>This notice is intended to alert you that there <em>may</em> be a significant issue with Spring which, if confirmed, would require immediate attention.</p> <p>In the morning (New York time) on Tuesday, March 29th, 2022, a member of the security research team KnownSec posted a now-removed screenshot to Twitter purporting to show a trivially-exploited remote code execution vulnerability against Spring core, the most popular Java framework in use on the Internet. The researcher did not provide a proof-of-concept or public details. Since then, the Bug Alert team has been very closely monitoring activity and discussion in the Spring ecosystem.</p> <p><strong><em>Update: the claims in the next paragraph have been refuted by the Spring team. I have left them visible for historical context.</em></strong> <del>During our initial investigation, the Bug Alert volunteer team noted that a <a href="https://github.com/spring-projects/spring-framework/commit/7f7fb58dd0dae86d22268a4b59ac7c72a6c22529#diff-6c2618839eda075efe4491842d3673eab8fe1e342f6d9ddc2bbda8556e595864L153">small change was introduced into the Spring codebase at roughly the same time</a> which may be the patch for this particular remote code execution issue. The team believes RCE could be possible through this vector, and that this change is likely the change that is intended to resolve the issue in Spring. However, the Spring team has not yet commented and has locked/closed GitHub issues inquiring about the accuracy of the claims being made.</del></p> <p>Just a few minutes ago, Cyber Kendra, a cybersecurity blog, <a href="https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html">put up a new post</a> detailing (translated) claims that have been circulating on Chinese blogs and media for the past several hours. This post also details some of the (unconfirmed) ways this vulnerability could be detected or mitigated.</p> <p>This notice is intended to prepare you for the possibility that a trivially-exploited remote code execution vulnerability may be present in one of the most widely-used pieces of open-source software. The impact of this vulnerability, if it does exist, would be significant; far in excess of the impact of Log4j or Heartbleed.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $50 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-03-29T23:00:00+00:002022-03-29T23:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-03-29:/content/notices/2022-03-29-spring.html

<p>An unconfirmed, but possible, remote code execution vulnerability is believed to exist in Spring, an extremely popular Java framework. This issue is likely easily exploited in common configurations. If confirmed, another notice will be sent out with a severity of 'critical'. While unconfirmed, the severity has been assigned 'high'.</p>

<h2>Update as of March 30th, 3:00PM New York time</h2> <p><a href="https://www.praetorian.com/blog/spring-core-jdk9-rce/">Praetorian has confirmed the existence of this RCE in a recently-published blog post.</a></p> <p><a href="/content/notices/2022-03-30-spring.html">A new Bug Alert notice has been added here.</a></p> <h2>Update as of March 30th, 1:30PM New York time</h2> <p>The Bug Alert team is aware of claims of a PoC for a Spring core RCE. However, we are awaiting confirmation before raising any further alarms, and we have not been able to utilize the PoC successfully against real-world Spring installs that we have (legal) access to. Some security professionals have claimed, on Twitter, that they are able to utilize the PoC successfully against Spring instances running behind Tomcat.</p> <p>Adding to the confusion, multiple Spring devs have publicly stated there is no known vulnerability within Spring Core, and they have also stated that yesterday's serialization-related code change <em>was not</em> an attempt a resolving an open security issue.</p> <p>We'll share any further info as it comes in, but at this time we are taking a cautious approach with raising any further alarms. This is already a deeply confusing situation, and Bug Alert wants to avoid making it worse.</p> <p>Finally, we would like to remind readers that Bug Alert is intended to be one of the earliest sources of information, and we have to weigh the risks of being early, but being wrong. This may very well end up being a case where we are wrong, but in the moment it is hard to know what is accurate. We will continue to monitor the situation and report on new developments.</p> <h2>Original notice</h2> <p>This notice is intended to alert you that there <em>may</em> be a significant issue with Spring which, if confirmed, would require immediate attention.</p> <p>In the morning (New York time) on Tuesday, March 29th, 2022, a member of the security research team KnownSec posted a now-removed screenshot to Twitter purporting to show a trivially-exploited remote code execution vulnerability against Spring core, the most popular Java framework in use on the Internet. The researcher did not provide a proof-of-concept or public details. Since then, the Bug Alert team has been very closely monitoring activity and discussion in the Spring ecosystem.</p> <p><strong><em>Update: the claims in the next paragraph have been refuted by the Spring team. I have left them visible for historical context.</em></strong> <del>During our initial investigation, the Bug Alert volunteer team noted that a <a href="https://github.com/spring-projects/spring-framework/commit/7f7fb58dd0dae86d22268a4b59ac7c72a6c22529#diff-6c2618839eda075efe4491842d3673eab8fe1e342f6d9ddc2bbda8556e595864L153">small change was introduced into the Spring codebase at roughly the same time</a> which may be the patch for this particular remote code execution issue. The team believes RCE could be possible through this vector, and that this change is likely the change that is intended to resolve the issue in Spring. However, the Spring team has not yet commented and has locked/closed GitHub issues inquiring about the accuracy of the claims being made.</del></p> <p>Just a few minutes ago, Cyber Kendra, a cybersecurity blog, <a href="https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html">put up a new post</a> detailing (translated) claims that have been circulating on Chinese blogs and media for the past several hours. This post also details some of the (unconfirmed) ways this vulnerability could be detected or mitigated.</p> <p>This notice is intended to prepare you for the possibility that a trivially-exploited remote code execution vulnerability may be present in one of the most widely-used pieces of open-source software. The impact of this vulnerability, if it does exist, would be significant; far in excess of the impact of Log4j or Heartbleed.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $50 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-02-08T10:02:00+00:002022-02-08T10:02:00+00:00Bug Alert Contributorstag:bugalert.org,2022-02-08:/content/notices/2022-02-08-sap.html

<p>A request smuggling issue in SAP NetWeaver, SAP Content Server, and SAP Web Dispatcher allows unauthenticated user impersonation. These systems are commonly Internet-facing. The flaw has been assigned a bug alert severity of 'critical', and the vendor has supplied patches.</p>

<p>On Tuesday, February 8, 2022, <a href="https://blogs.sap.com/2022/02/08/sap-partners-with-onapsis-to-identify-and-patch-cybersecurity-vulnerabilities/">SAP published a notice detailing a major request smuggling flaw</a> within their SAP NetWeaver, SAP Content Server, and SAP Web Dispatcher products, which SAP claims could lead to authentication bypass.</p> <p>Publicly available documentation is scarce, but the Bug Alert team has analyzed <a href="https://github.com/Onapsis/onapsis_icmad_scanner/blob/master/src/ICMAD_scanner.py">the PoC</a> and SAP documentation. It appears that SAP <a href="https://help.sap.com/viewer/e815bb97839a4d83be6c4fca48ee5777/7.5.21/en-US/4a47abb3e1f41cd4e10000000a421937.html">can utilize the <code>REMOTE_USER</code> header</a> (which is usually stripped from untrusted traffic) to authenticate a user through an authenticating proxy or SSO module.</p> <p>Again, publicly available information is limited at this time, but it appears likely that this request smuggling issue could be utilized to insert the <code>REMOTE_USER</code> request header and impersonate another SAP user, including the present-by-default 'Administrator' account.</p> <p>This vulnerability been assigned CVE-2022-22536. Patches are available now from the vendor.</p> <p>If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $150 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-01-25T20:42:00+00:002022-01-25T20:42:00+00:00Bug Alert Contributorstag:bugalert.org,2022-01-25:/content/notices/2022-01-25-pkexec.html

<p>A local privilege escalation bug (from any user to root) has been found polkit's pkexec, and exploit code is available. This binary is a SUID root program available on every major Linux distro, and is most commonly installed if a GUI is present. The flaw has been assigned a bug alert severity of 'very high'.</p>

<p>On Tuesday, January 25th, 2022, <a href="https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034">Qualys published a blog post detailing an issue they identified</a> within pkexec, a core component of polkit (formerly known as PolicyKit). In the time since Qualys disclosed this issue, <a href="https://haxx.in/files/blasty-vs-pkexec.c">exploit code</a> has been made available. The pkexec binary is <em>most commonly</em> installed with Linux GUI components and may not be present on servers that run 'minimal' OS installs. This post will be updated as more information becomes available.</p> <p>PwnKit, as this vulnerability is being called, has been assigned CVE-2021-4034. Patches are available now for most Linux distributions.</p> <p>Thank you to <a href="https://github.com/mattcobb">Matt Cobb</a> for reporting this issue.</p> <p>This was Bug Alert's first notice. If you have feedback (did you agree/disagree that a notice should have been sent?) or questions, please comment on the discussion thread linked below. This notice cost the project approximately $120 USD to send. If you would like to support the project, <a href="https://bugalert.org/content/pages/financial-support.html">you can learn more here</a>.</p>2022-01-11T23:00:00+00:002022-01-11T23:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-01-11:/content/notices/2022-01-11-post-launch.html

<p>The Bug Alert team is celebrating a successful launch with more features (Telegram support!), a community Slack, and more.</p>

<p align="center"> <img width="50%" src="https://i.imgur.com/TbDWmWr.png"> </p> <p>The Bug Alert team is happy to announce Telegram support! <a href="https://t.me/s/BugAlert">Join our Telegram channel</a> to receive vulnerability notices in real-time.</p> <p>This functionality was contributed by a member of our volunteer team, <a href="https://github.com/BugAlertDotOrg/bugalert/pull/26">Ethan Schorer</a>. Thanks Ethan!</p> <hr> <p align="center"> <img width="40%" src="https://i.imgur.com/EKU8YJB.png"> </p> <p>Stay up to date on the latest Bug Alert news or come chat vulnerabilities in our public Slack workspace. This is also where the volunteer team discusses features and updates, and we'd be happy to get your input as well!</p> <p><a href="https://join.slack.com/t/bug-alert/shared_invite/zt-1199f3i50-Fz2kn0D3Oa1z3fQBHTdzAw">Click here to create an account.</a></p> <hr> <p align="center"> <font size="100%"> &#x1f389; Post-Launch Celebration</font> </p> <p>Over 1,000 subscribers have registered with Bug Alert, which is far in excess of what I could have imagined just a week ago. I am honored you agree that Bug Alert is a potential solution to a very real problem, and as a community, we'll work to improve security across the world.</p> <p>If you have suggestions for Bug Alert, or wish functionality existed which doesn't today, please <a href="https://github.com/BugAlertDotOrg/bugalert/issues">file an issue on GitHub</a> and let us know! If you know Python, we'd also love to have you contribute to our codebase to make those ideas a reality.</p> <p>Thanks again for making Bug Alert an early success. We look forward to what the future has in store.</p> <hr> <p>P.S. If you haven't already, <a href="https://twitter.com/BugAlertDotOrg">follow us on Twitter</a>. While notices are also posted to Twitter, we'll also use the platform for disseminating less pressing, informational content, such as minor feature enhancements or bugfixes. Notices will always be tagged with <code>#BugAlertNotice</code>, which you can use for filtering alerts if you are utilizing tools like IFTTT to monitor the feed and only want to see the emergency stuff. Hope to see you there!</p>2022-01-04T14:00:00+00:002022-01-04T14:00:00+00:00Bug Alert Contributorstag:bugalert.org,2022-01-04:/content/notices/2022-01-04-bugalert.html

<p>Hello, world! Bug Alert is now live. Read the announcement post at https://mattslifebytes.com/2022/01/04/bugalert-org/ to learn more.</p>

<p>I'm happy announce that Bug Alert is now generally-available! Read the announcement post at <a href="https://mattslifebytes.com/2022/01/04/bugalert-org/">https://mattslifebytes.com/2022/01/04/bugalert-org/</a> for background and further information.</p>2021-12-09T23:00:00+00:002021-12-09T23:00:00+00:00Bug Alert Contributorstag:bugalert.org,2021-12-09:/content/notices/2021-12-09-log4j.html

<p>A remote code execution vulnerability has been found in the popular Java logging library Log4j. This issue is easily exploited in common configurations, and has been assigned a bug alert severity of 'critical'.</p>

<p>On Tuesday, December 9th, 2021, a security researcher posted a screenshot and proof-of-concept code for executing an RCE against the latest available build of the popular Java logging library, Log4j. For up-to-date information, please visit <a href="https://www.lunasec.io/docs/blog/log4j-zero-day/">https://www.lunasec.io/docs/blog/log4j-zero-day/</a>.</p>2021-12-01T23:00:00+00:002021-12-01T23:00:00+00:00Bug Alert Contributorstag:bugalert.org,2021-12-01:/content/notices/2021-12-01-end-user-applications-placeholder.html

<p>Our site generator requires all categories to have a notice. This is the placeholder for the 'End-User Applications' category.</p>2021-12-01T23:00:00+00:002021-12-01T23:00:00+00:00Bug Alert Contributorstag:bugalert.org,2021-12-01:/content/notices/2021-12-01-operating-systems-placeholder.html

<p>Our site generator requires all categories to have a notice. This is the placeholder for the 'Operating Systems' category.</p>2021-12-01T23:00:00+00:002021-12-01T23:00:00+00:00Bug Alert Contributorstag:bugalert.org,2021-12-01:/content/notices/2021-12-01-services-system-applications-placeholder.html

<p>Our site generator requires all categories to have a notice. This is the placeholder for the 'Services &amp; System Applications' category.</p>