Week in review: PoC for wormable SharePoint RCE released, how to select a DMARC solution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1147 | XML Markup RCE in Microsoft .NET Framework, SharePoint, and Visual Studio CVE-2020-1147 is a remote code execution flaw that exists in Microsoft .NET Framework, .NET Core, SharePoint Enterprise Server, SharePoint Server, Visual Studio 2017, and Visual Studio 2019 when the software fails to check the source markup of XML file input. It is triggered when an application parses attacker-controlled XML — public proofs-of-concept demonstrate exploitation through SharePoint's DataSet/DataTable deserialization, allowing an attacker to run arbitrary code in the context of the affected application or service. An attacker who successfully exploits the flaw gains code execution with the privileges of the parsing process, which on SharePoint servers typically means compromise of a widely used business platform. Organizations running affected .NET Framework, .NET Core, SharePoint, or Visual Studio deployments are affected. Exploitation is confirmed: public PoCs were released around the July 2020 Patch Tuesday fixes, the flaw was added to CISA's Known Exploited Vulnerabilities catalog in November 2021, and news reports describe the Storm-2603 group deploying ransomware on exploited SharePoint servers. Do: Apply the July 2020 Microsoft security updates for .NET Framework, .NET Core, SharePoint, and Visual Studio, as required by CISA's KEV catalog entry. Prioritize internet-facing SharePoint servers, and hunt for signs of exploitation there given reports of Storm-2603 deploying ransomware on exploited SharePoint servers. Until patched, restrict untrusted XML input handling and limit exposure of SharePoint and other affected services to the internet. | 7.8 | 94% | KEV PoC ×4 |
| masshundreds of millions of Windows devices with .NET Framework installed, plus tens of thousands of SharePoint deployments (order of magnitude estimate) | |
| CVE-2020-1350 | Wormable Unauthenticated RCE in Microsoft Windows DNS Server CVE-2020-1350 is a critical (CVSS 10.0) remote code execution vulnerability in the DNS Server role of Microsoft Windows Server, caused by improper input handling (CWE-20) when the server fails to properly process crafted DNS requests, notably malicious DNS signature (SIG) records delivered over TCP. An unauthenticated attacker can trigger it by sending a crafted DNS query that forces the vulnerable DNS server to perform an upstream lookup and receive a malicious response, overflowing a heap buffer. Successful exploitation yields code execution with SYSTEM privileges on the DNS server, which is very often an Active Directory domain controller, giving the attacker control of the host and typically the entire domain; the flaw is considered wormable because compromised DNS servers can propagate attacks to other servers they query. Any Windows Server 2008, 2012, 2016, or 2019 host running the DNS Server role is affected — internet-facing DNS servers are directly explovable, while internal DNS servers can be reached via malicious DNS responses passed through firewalls. The flaw was fixed in Microsoft's July 2020 updates, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, required action: apply vendor updates), carries EPSS of 91.4% (100th percentile), and appears in the NSA's top-25 list of flaws exploited by Chinese state-sponsored hackers; no public PoC is cataloged in this dataset and ransomware use is listed as unknown. Do: Apply the July 2020 (or later) Microsoft security updates for each affected Windows Server release, prioritizing internet-facing DNS servers and domain controllers; if patching must be delayed, apply Microsoft's registry-based workaround limiting TCP DNS packet size (TcpReceivePacketSize = 0xFF00) and restart the DNS Server service. Inventory hosts with the DNS Server role installed and review their TCP/53 exposure, especially any resolvers reachable from the internet, and confirm remediation per CISA's required action. | 10.0 | 91% | KEV |
| masshundreds of thousands of internet-exposed Windows DNS servers (est.), with millions of total deployments including internal domain controllers |
Full article808 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news and articles:
Attackers exploit Twilio’s misconfigured cloud storage, inject malicious code into SDK
Twilio has confirmed that, for 8 or so hours on July 19, a malicious version of their TaskRouter JS SDK was being served from their one of their AWS S3 buckets.
Details and PoC for critical SharePoint RCE flaw released
A “wormable” remote code execution flaw in the Windows DNS Server service (CVE-2020-1350) temporarily overshadowed all the other flaws patched by Microsoft on July 2020 Patch Tuesday, but CVE-2020-1147, a RCE affecting Microsoft SharePoint, was also singled out as critical and requiring a speedy fix.
REMnux toolkit for malware analysis version 7 released
REMnux is a popular Linux-based toolkit for reverse-engineering malicious software which malware analysts have been relying on for more than 10 years to help them quickly investigate suspicious programs, websites, and document files.
Cybersecurity teams are struggling with a lack of visibility into key security controls
89% of security professionals are most concerned about phishing, web and ransomware attacks. This is especially alarming, considering that only 48% confirm that they have continuous visibility into the risk area of phishing, web and ransomware, a Balbix report reveals.
BadPower: Fast chargers can be modified to damage mobile devices
If you needed another reason not to use a charger made available at a coffeeshop or airport or by an acquaintance, here it is: maliciously modified fast chargers may damage your phone, tablet or laptop and set it on fire.
20,000+ new vulnerability reports predicted for 2020, shattering previous records
Over 9,000 new vulnerabilities have been reported in the first six months of 2020, and we are on track to see more than 20,000 new vulnerability reports this year — a new record, Skybox Security reveals.
Infosec is a mindset as well as a job, but burnout can happen to anyone
Time and again (and again), survey results tell us that many cybersecurity professionals are close to burnout and are considering quitting their jobs or even leaving the cybersecurity industry entirely.
Microsoft releases new encryption, data security enterprise tools
Microsoft has released (in public preview) several new enterprise security offerings to help companies meet the challenges of remote work.
Ransomware recovery: Moving forward without backing up
For IT, the biggest concern with a remote workforce is the inability to control the network in a traditional sense. Perhaps their greatest fear is a ransomware attack on company data made possible by users connected through their VPN and attaching to file shares.
In addition to traditional DDoS attacks, researchers see various abnormal traffic patterns
In the first quarter of 2020, DDoS attacks rose more than 278% compared to Q1 2019, and more than 542% compared to the last quarter, as published in the Nexusguard Q1 2020 Threat Report. DDoS attacks have become a global risk, and as attacks continue to increase in complexity, further spurred by the pandemic, ISPs will have to strengthen their security measures.
IT teams failing to deliver a positive remote employee experience
Conducted during the coronavirus pandemic, 1E unveils the findings of an analysis of the remote employee experience and the digital workplace in 2020.
How do cybercriminals secure cybercrime?
Trend Micro unveiled new insights analyzing the market for underground hosting services and detailing how and where cybercriminals rent the infrastructure that hosts their business.
How do I select a DMARC solution for my business?
To select a suitable DMARC solution for your business, you need to think about a variety of factors. We’ve talked to several cybersecurity professionals to get their insight on the topic.
People work more while at home, but worry about data security
A global research report by Lenovo highlights the triumphs, challenges and the consequences of the sudden shift to work-from-home (WFH) during the COVID-19 pandemic and how companies and their IT departments can power the new era of working remotely that will follow.
Human error: Understand the mistakes that weaken cybersecurity
43% of US and UK employees have made mistakes resulting in cybersecurity repercussions for themselves or their company, according to a Tessian report.
27% of consumers hit with pandemic-themed phishing scams
Phishing is the top digital fraud scheme worldwide related to the COVID-19 pandemic.
Digital privacy: A double-edged sword
Digital privacy is paramount to the global community, but it must be balanced against the proliferation of digital-first crimes, including child sexual abuse, human trafficking, hate crimes, government suppression, and identity theft. The more the world connects with each other, the greater the tension between maintaining privacy and protecting those who could be victimized.
There’s CISSP training, then there’s official CISSP training
Put your trust in an (ISC)² Official Training Provider for your CISSP exam prep. (ISC)² partners with leading training providers throughout the world, so you have convenient access to official training that meets your needs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/07/26/week-in-review-poc-for-wormable-sharepoint-rce-released-how-to-select-a-dmarc-solution/