Скачать или смотреть Vulnerability Weekly 22/9/22 Microsoft Exchange RCE zero-day, cobalt strike, bitbucket vulnerability

This week in Vulnerability Weekly

Full Details: https://appsecphoenix.com/vulnerabili...

This week we deep dive into Exchange zero-day and large-scale exploit, cobalt strike, bitbucket.

Two new Microsoft Exchange zero-days exploited in the wild from Chinese ATP

On September 30th two vulnerabilities have been discovered in a large attack.

On September 29 a Vietnamese researcher warned the ATP was targeting exchange servers with RCE directly on the system.

As RCE is a category of devastating attacks as they allow an attacker to further deploy payloads and additional exploits.

GTSC suspects that a Chinese threat group is responsible for the attacks based on the web shells’ code page, a Microsoft character encoding for simplified Chinese.

Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019. The first one, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, and the second one, identified as CVE-2022-41082, allows Remote Code Execution (RCE) when PowerShell is accessible to the attacker.
----
BitBucket Server vulnerability hack CISA warns agencies.


U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed critical flaw impacting Atlassian’s Bitbucket Server and Data Center to the Known Exploited Vulnerabilities (KEV) catalogue, citing evidence of active exploitation.

CVE-2022-36804, the issue relates to a command injection vulnerability that could allow malicious actors to gain arbitrary code execution on susceptible installations by sending a specially crafted HTTP request.

----

Cobalt Strike beacon disguised as job advert.
Cobalt Strike | Adversary Simulation and Red Team Operations

The renowned attack platform cobalt strike has been targeted by attackers with a malware campaign distributed by documents and disguised as job advertisements.

Several exploits in the wild with Remote Code Execution

“The payload discovered is a leaked version of a Cobalt Strike beacon,” Cisco Talos researchers Chetan Raghuprasad and Vanja Svajcer said in a new Wednesday analysis.

Together with this attack Cobalt strike was found with a vulnerability.

Official Registration as medium CVSS score for CVE-2022-39197

#cyber #cybersecurity #app #appsec #cloud #vulnerabilities #priorities #assessment #automation #orchestration #applicaitonsecurity #appsecprogramme #vulnerabilities #vulnerabilityscan #vulnerabilitymanagement