Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 22nd, 2023 https://isc.sans.edu/podcastdetail/8790, (Fri, Dec 22nd)
[This is a Guest Diary by David Thomson, an ISC intern as part of the SANS.edu BACS program]
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 21st, 2023 https://isc.sans.edu/podcastdetail/8788, (Thu, Dec 21st)
Today, exploit attempts for %%cve:2023-22518%% cross the “significant” threshold for our “First Seen URLs” list. The URL being accessed, “/json/setup-restore.action?synchronous=true“, can be used to bypass authentication [1]. Due to a failure to properly control access to this path, the attacker can execute the “setup-restore” feature, which restores the database using attacker-supplied data and can lead to system command execution.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 20th, 2023 https://isc.sans.edu/podcastdetail/8786, (Wed, Dec 20th)
Update: Thanks to our reader Dustin Decker for pointing out that these scans are likely looking for Citrix devices. The recent “CitrixBleed” vulnerability is exploited using the OpenID connect URL (%%cve:2023-4966%%, %%cve:2023-4967%%). An attack would also include an oversized Host header in a request to the OpenID URL. The scans I have observed do not appear to include this oversized Host header. Looks like they are just looking for possible targets to exploit later.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 19th, 2023 https://isc.sans.edu/podcastdetail/8784, (Tue, Dec 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 18th, 2023 https://isc.sans.edu/podcastdetail/8782, (Mon, Dec 18th)
A few months ago, RocketMQ[1], a real-time message queue platform, suffered of a nasty vulnerability referred as %%cve:2023-33246%%. I found another malicious script in the wild a few weeks ago that exploits this vulnerability. It has still today a very low VirusTotal detection score:2/60 [2] (SHA256:70710c630390dbf74a97162ab61aae78d3e18eacb41e16d3dd6bbd872fee66c5).
Continue reading An Example of RocketMQ Exploit Scanner, (Sat, Dec 16th)
I found an interesting CSharp source code on VT a few days ago. Its score is only 3/59 (SHA256:5aebf1369b9b54cfc340f34fcc61a90872085a2833fd9bcf238f7c62a5c7620a)[1].
Continue reading CSharp Payload Phoning to a CobaltStrike Server, (Fri, Dec 15th)