This weeks
@metasploit
release has our unauthenticated RCE exploit module for CVE-2023-22515, affecting Atlassian Confluence. Get all the release details here:
We have added a
@metasploit
unauthenticated RCE exploit module to the pull queue for the recent ConnectWise ScreenConnect vulnerability (No CVE has been assigned yet):
We have disclosed 2 authentication bypass vulnerabilities, CVE-2024-27198 and CVE-2024-27199, affecting JetBrains TeamCity CI/CD server. The most severe of which allows for unauthenticated RCE. Read all the details here:
We have posted our AttackerKB
@rapid7
Analysis of the recent 0day exploit chain affecting Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887). Full details of the auth bypass and command injection vulns. Read all the details here:
We have published our AttackerKB
@rapid7
analysis for CVE-2024-21893, an SSRF vulnerability in the SAML component of Ivanti Connect Secure, that has recently been exploited in the wild, allowing attackers bypass the mitigation for an earlier exploit chain.
We have posted our
@rapid7
AttackerKB Analysis for CVE-2023-22515, affecting Atlassian Confluence. The vuln is unauthenticated and can be leveraged to create a new admin account on the server. Full root cause analysis and exploitation details are here:
The weeks
@metasploit
release includes our exploit for CVE-2023-40044, an unauthenticated RCE in the Ad Hoc Transfer module of WS_FTP Server, due to unsafe .NET deserialization. Get all the details here:
Our
@rapid7
AttackerKB analysis detailing CVE-2023-28771 is available. Unauthenticated command injection on the WAN interface of several Zyxel devices. Bug is in the IKE packet decoder for the IPSec VPN service, running by default.
Our exploit module for CVE-2024-27198 is now in the
@metasploit
pull queue. Unauthenticated RCE in JetBrains TeamCity due to an authentication bypass vulnerability:
This weeks
@metasploit
release includes our JetBrains TeamCity exploit module (CVE-2023-42793). Unauthenticated RCE due to an auth bypass vuln, all versions prior to 2023.05.4 are affected. Read the details here:
This week's
@metasploit
release has our exploit for CVE-2023-26360, unauth RCE in all versions of Adobe ColdFusion 2021 and 2018 prior to Adobe's March patch. Get the release here:
My
@rapid7
technical analysis of CVE-2022-21587 for Oracle E-business Suite is out. An arbitrary file upload vuln can be used to drop malicious JSP payloads, and we now have a
@metasploit
exploit for this in the pull queue too:
Our
@rapid7
AttackerKB Analysis of CVE-2023-26359 in Adobe ColdFusion has been updated to detail unauthenticated remote code execution and arbitrary file reading. A
@metasploit
module will be available soon. All the details here:
Our
@rapid7
AttackerKB analysis of CVE-2023-46604 affecting Apache ActiveMQ is out. Unauthenticated RCE via deserialization in the OpenWire transport connector. We also have a
@metasploit
module for this in the pull queue. Read our analysis here:
We have published our
@rapid7
AttackerKB Analysis of CVE-2023-42793, an unauthenticated RCE in JetBrains TeamCity CI/CD server, affecting all versions below 2023.05.4. A full technical analysis of both the root cause and exploitation is available here:
We have published our
@rapid7
AttackerKB Analysis for CVE-2023-40044. An unauthenticated RCE in WS_FTP due to unsafe .NET deserialization. Full root cause analysis and exploitation details here:
Our
@rapid7
AttackerKB analysis of CVE-2023-27532 in Veeam Backup & Replication has been posted, detailing the vulnerability, plaintext credentials leak and remote code execution:
Adobe has patched an access control bypass (CVE-2023-29298) affecting ColdFusion 2023, 2021 and 2018 that we reported last April, found when researching some other CF vulns. Full details on the
@rapid7
blog:
Last Friday's
@metasploit
release adds coverage for CVE-2023-34362 in MOVEit Transfer, great work by
@tychos_moose
,
@iagox86
,
@_CField
and team. Nice to see the new fetch payloads in action too🔥Check out the release here:
The vuln research team
@rapid7
is hiring for a Lead Security Researcher; working on 0day vuln research, n-day analysis, exploit dev, and more. Check out the job description below. Ping me with any questions, it's a fun job and we get to work on allot of very interesting things :)
Updated this assessment to include how Docker based installs are indeed exploitable via a small modification to the request. This development increases the potential impact of this vuln, we have more details on our
@rapid7
blog here:
Wrote up a short AttackerKB assessment on the ownCloud graphapi vuln (CVE-2023-49103). Docker installations do not seem exploitable due to an additional .htaccess rewrite rule not present in manually installed instances of ownCloud, which results in the target endpoint generating
Our
@rapid7
AttackerKB Analysis of CVE-2023-34362 in MOVEit Transfer is now available. Full details of the RCE exploit chain and how the SQLi is leveraged to achieve RCE via unsafe deserialization:
QNAP have patched an unauthenticated command injection vuln we reported, CVE-2023-47218, affecting QTS and QuTS Hero based systems. Vuln is in a component quick.cgi, which helps configure uninitialized systems. Read our disclosure here:
Adobe have released an out of band update for ColdFusion, to address CVE-2023-38205, a patch bypass of the access control bypass CVE-2023-29298 that was published last week (and exploited in the wild). Full details on the
@rapid7
blog:
Wrote up a short AttackerKB assessment on the ownCloud graphapi vuln (CVE-2023-49103). Docker installations do not seem exploitable due to an additional .htaccess rewrite rule not present in manually installed instances of ownCloud, which results in the target endpoint generating
Our
@rapid7
AttackerKB analysis of CVE-2023-26359 has been published. An interesting deserialization vulnerability in Adobe ColdFusion that was recently patched:
We have added a
@metasploit
unauthenticated RCE exploit module to the pull queue for the recent ConnectWise ScreenConnect vulnerability (No CVE has been assigned yet):
Super analysis by
@ChairNectar
detailing CVE-2024-4040 in CrushFTP - detailing the root cause, unauthenticated arbitrary file read primitive, and session stealing. Plus evasion techniques due to non compliant HTTP processing! 🔥
The SSRF, as we found it, is actually an n-day in the xmltooling library, patched out around June 2023 and assigned CVE-2023-36661. The SSRF can be chained to CVE-2024-21887 for unauthenticated command injection with root privileges.
Wrote up a post about the NETGEAR R6700v3 bug I used in last Novembers pwn2own which was patched recently. Overflowing a .bss variable into adjacent heap memory for the win!
Our
@rapid7
AttackerKB Analysis of CVE-2023-0339 in ForgeRock Web Agent is out. A simple yet highly impactful access control bypass vulnerability that leads to unauthorized access to protected resources:
Join us! ...the
@rapid7
vulnerability research team is hiring a Senior Security Researcher to work on zero day vuln discovery, n-day analysis, exploit development, and more! Location for this role is onsite in our Prague office. Full details here:
So CVE-2023-35082 (Unauth API access) is now known to affect all versions of Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core prior to the fix Ivanti released yesterday. Our
@rapid7
disclosure blog has been updated with the new details:
Interesting vuln in the ZK framework being activity exploited against ConnectWise R1Soft Server Backup Manager, details and guidance on the
@rapid7
blog:
h/t to
@Horizon3ai
and
@leak_ix
for their posts detailing exploitation, and today
@r4shimo
posted a full dump of the implant being installed which is the first time I have seen this in detail:
Curtis is a hugely talented and enthusiastic vulnerability researcher, who worked with us on our MOVEit exploit and he recently did an amazing deep dive analysis + exploit against barracuda esg. Snap him up!
Had a great time and will miss the team at Rapid7. Onto the next adventure to continue on with fun work. I'll be open to any vuln research and exploit dev work!
While inevitable, having your software product pirated will always suck, however I cant help but be impressed they bother to translate the entire UI too 🙃
Douglas is an extremely strong and accomplished leader and researcher in offensive security and vulnerability research. You would be lucky to hire him and have him on your team
Unfortunately I was affected by the Rapid 7 layoffs and therefore looking for a new opportunity. I have 14 years of experience in offensive security, security research, technical leadership, and public speaking. I will be at
@defcon
starting tonight. Send me a message to chat!
This vuln was reported exploited in the wild as CVE-2023-26360 but the root cause appears to be the deserialization of untrusted data via CVE-2023-26359.
We have posted our AttackerKB
@rapid7
Analysis of the recent 0day exploit chain affecting Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887). Full details of the auth bypass and command injection vulns. Read all the details here:
Exploit creates and admin account, then uploads a JSP payload to get a session. There's a nice (undocumented) unauthenticated REST endpoint /rest/gacmd/v1/system which gives you back version information too! Shoutout to
@Horizon3ai
for their analysis and PoC
Today I am releasing the final post of a 3 part series on “modern” browser exploitation targeting Windows. In this post we port our exploit primitives to Edge itself & combine 12 ROP chains in order to defeat ACG, CIG, DEP, ASLR, CFG, "no child processes"
Hey friends, the
#Metasploit
team is looking for a security researcher to work on modules, features, and enhancements for
@zeroSteiner
's open-source team! Currently Austin-based, but we're open to other R7 office locations, too!
If you're in Vegas next week check out
@zeroSteiner
at BlackHat Arsenal (and DEF CON), showcasing the awesome new active directory features recently added to
@metasploit
🔥
🛠 At the
#BlackHatUSA
Arsenal, join Rapid7 Manager, Security Research
@zeroSteiner
for an Active Directory-focused
#Metasploit
demonstration!
See the Framework's latest upgrades in action, learn how to execute multiple attack techniques, and much more:
@joel_land
ahh, was able to reproduce. If I delete the License.xml file and restart the server, it 404s when requesting anything from an installed extension. So the issue seems to be exploiting an unlicensed server.
@rhowe212
@catc0n
@rapid7
@ChairNectar
ya I agree, the os_MkdirAll call and creating the path from the session id cookie value during main__ptr_SessDiskStore_New is in first party PA code, and does not appear to be the gorilla library code as the root cause.
Some of the docker images I tested also explicitly add phpinfo to the disable_functions list in php.ini, so thats gonna be a blocker to exploitation also :)
@Big5_sec
Experimenting with adding both a subject (Arg01) and body (Arg04) omits that log message, however a different single log message remains for a package with no valid recipient. I don't think we can avoid that. Thanks for the feedback.
Found an old copy of Easy Amos for the Amiga! Had such fun trying to learn how to program on this back in the day. Even came with some file save icons 😄
#amigaforever
TIL C/C++ has standardized alternative tokens for several operators and punctuators due to limitations in some character encoding sets, which I thought was an interesting curiosity: