Week in review: Google fixes yet another Chrome zero-day exploit, YouTube as a cybercrime channel
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-43208 | Unauthenticated Deserialization RCE in NextGen Healthcare Mirth Connect CVE-2023-43208 is an unauthenticated remote code execution flaw in NextGen Healthcare Mirth Connect, a widely used healthcare integration engine, caused by incomplete patching of the earlier CVE-2023-37679 deserialization vulnerability. An attacker can trigger it by sending crafted serialized data to the network-exposed Mirth Connect service, requiring no authentication or user interaction (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N). Successful exploitation yields arbitrary code execution on the server, giving attackers a foothold in hospital and health-system networks that Mirth Connect uses to move clinical data (including PHI) between systems. All deployments running Mirth Connect versions before 4.4.1 are affected. The flaw is being actively exploited — CISA added it to the Known Exploited Vulnerabilities catalog on 2024-05-20 with known ransomware use, public proof-of-concept exploits exist, and EPSS estimates an 82.7% chance of exploitation within 30 days. Do: Upgrade Mirth Connect to version 4.4.1 or later as the CISA KEV required action, or discontinue use if upgrades are unavailable. Identify and restrict internet-exposed Mirth Connect instances (the service is commonly reachable on its web/admin interface), and hunt for signs of compromise given confirmed ransomware use. Because this bypasses the earlier CVE-2023-37679 fix, verify patch levels directly rather than assuming prior remediation. | 9.8 | 83% | KEV ransomware PoC ×2 |
| large≈10,000–30,000 internet-exposed Mirth Connect instances, plus many more internal deployments at thousands of hospitals and health systems | |
| CVE-2024-22026 | A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance. NVD description · AI analysis pending | 6.7 | 1% |
| — | ||
| CVE-2024-27130 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the following version: QTS 5.1.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later NVD description · AI analysis pending | 8.8 | 38% |
| — | ||
| CVE-2024-29849 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. NVD description · AI analysis pending | 9.8 | 38% |
| — | ||
| CVE-2024-4323 | A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution. NVD description · AI analysis pending | 9.8 | 27% | PoC |
| — | |
| CVE-2024-4985 | An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional en An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. This vulnerability was reported via the GitHub Bug Bounty program. NVD description · AI analysis pending | 10.0 | 3% |
| — | ||
| CVE-2024-5274 | Google Chrome V8 Type Confusion Allows In-Sandbox RCE via Crafted HTML Pages CVE-2024-5274 is a type confusion flaw (CWE-843) in the V8 JavaScript engine of Google Chrome prior to 125.0.6422.112. A remote attacker can trigger it by persuading a user to open or interact with a crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code inside the browser's sandbox, and the scope-changed CVSS scoring indicates potential impact beyond the browser process itself. Anyone running an affected Chrome or Chromium build, including Chromium-derived distributions such as Fedora's Chromium package, is exposed. The flaw was added to CISA's KEV on 2024-05-28, a public PoC reference exists, and related news reports describe it as actively exploited in the wild. Do: Upgrade Google Chrome to 125.0.6422.112 or later and confirm the build via chrome://version; Fedora users and users of Chromium-derived browsers should install the corresponding updated packages from their vendor. Because the flaw is listed in CISA KEV, federal agencies and targeted organizations must apply the vendor fix or discontinue use per the required action, and all users should avoid untrusted web content until patched. | 9.6 | 7% | KEV PoC |
| masson the order of billions of users (Chrome has 3+ billion users and roughly two-thirds desktop browser share) |
Full article1,126 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
Google fixes yet another Chrome zero-day exploited in the wild (CVE-2024-5274)
For the eighth time this year, Google has released an emergency update for its Chrome browser that fixes a zero-day vulnerability (CVE-2024-5274) with an in-the-wild exploit.
YouTube has become a significant channel for cybercrime
Social engineering threats – those which rely on human manipulation – account for most cyberthreats faced by individuals in 2024, according to Avast.
Authelia: Open-source authentication and authorization server
Authelia is an open-source authentication and authorization server that offers 2FA and SSO for applications through a web portal. It works alongside reverse proxies to permit, deny, or redirect requests.
Cybersecurity jobs available right now: May 22, 2024
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.
Fail2Ban: Ban hosts that cause multiple authentication errors
Fail2Ban is an open-source tool that monitors log files, such as /var/log/auth.log, and blocks IP addresses that exhibit repeated failed login attempts. It does this by updating system firewall rules to reject new connections from those IP addresses for a configurable amount of time.
Strategies for transitioning to a SASE architecture
In this Help Net Security, Prakash Mana, CEO at Cloudbrink, discusses the primary challenges companies face when transitioning to a SASE architecture and how to overcome them.
Strategies for combating AI-enhanced BEC attacks
In this Help Net Security interview, Robert Haist, CISO at TeamViewer, discusses how AI is being leveraged by cybercriminals to enhance the effectiveness of BEC scams.
Grafana: Open-source data visualization platform
Grafana is an open-source solution for querying, visualizing, alerting, and exploring metrics, logs, and traces regardless of where they are stored.
US retailers under attack by gift card-thieving cyber gang
Earlier this month, the FBI published a private industry notification about Storm-0539 (aka Atlas Lion), a Morocco-based cyber criminal group that specializes in compromising retailers and creating fraudulent gift cards.
Compromised courtroom recording software was served from vendor’s official site
Courtroom recording software JAVS Viewer has been saddled with loader malware and has been served from the developer’s site since at least April 2, a threat researcher has warned last month.
GitHub fixes maximum severity Enterprise Server auth bypass bug (CVE-2024-4985)
A critical, 10-out-of-10 vulnerability (CVE-2024-4985) allowing unrestricted access to vulnerable GitHub Enterprise Server (GHES) instances has been fixed by Microsoft-owned GitHub.
Windows’ new Recall feature: A privacy and security nightmare?
Microsoft has announced the Copilot+ line of Windows 11-powered PCs that, among other things, will have Recall, a feature that takes screenshots every few seconds, encrypts them, saves them, and leverages AI to allow users to search through them for specific content that has been viewed in apps, websites, documents, etc.
HHS pledges $50M for autonomous vulnerability management solution for hospitals
As organizations in the healthcare sector continue to be a prime target for ransomware gangs and CISA warns about a vulnerability (CVE-2023-43208) in a healthcare-specific platform being leveraged by attackers, the Advanced Research Projects Agency for Health (ARPA-H) has announced the Universal PatchinG and Remediation for Autonomous DEfense (UPGRADE) program aimed at developing a vulnerability management platform for healthcare IT teams.
Veeam fixes auth bypass flaw in Backup Enterprise Manager (CVE-2024-29849)
Veeam has patched four vulnerabilities in Backup Enterprise Manager (VBEM), one of which (CVE-2024-29849) may allow attackers to bypass authentication and log in to its web interface as any user.
15 QNAP NAS bugs and one PoC disclosed, update ASAP! (CVE-2024-27130)
Researchers have found 15 vulnerabilities in QNAP’s network attached storage (NAS) devices, and have released a proof-of-concept for one: an unauthenticated stack overflow vulnerability (CVE-2024-27130) that may be leveraged for remote code execution.
Critical Fluent Bit flaw affects major cloud platforms, tech companies’ offerings (CVE-2024-4323)
Tenable researchers have discovered a critical vulnerability (CVE-2024-4323) in Fluent Bit, a logging utility used by major cloud providers and tech companies, which may be leveraged for denial of service, information disclosure, or remote code execution.
PoC exploit for Ivanti EPMM privilege escalation flaw released (CVE 2024-22026)
Technical details about and a proof-of-concept (PoC) exploit for CVE-2024-22026, a privilege escalation bug affecting Ivanti EPMM, has been released by the vulnerability’s reporter.
CISOs pursuing AI readiness should start by updating the org’s email security policy
Over the past few years, traditional phishing messages — with their pervasive linguistic errors, thinly-veiled malicious payloads, and often outlandish pretexts — have been on the decline. Easily detected by most of today’s standard email security tools (and thoroughly unconvincing to most recipients), this prototypical form of phishing may soon be a thing of the past.
Cybercriminals shift tactics to pressure more victims into paying ransoms
Ransomware didn’t just grow in the US in 2023, it evolved, with the frequency of ransomware claims jumping 64% year-over-year, according to At-Bay.
2024 sees continued increase in ransomware activity
In this Help Net Security video, Ryan Bell, Threat Intelligence Manager at Corvus Insurance, discusses how ransomware will continue to grow in 2024.
The challenges of GenAI in fintech
While some organizations and their boards have an all-in mindset on GenAI’s usage, others are watching and waiting.
Phishing statistics that will make you think twice before clicking
This article includes excerpts from various reports that offer statistics and insights into the current phishing landscape.
Fighting identity fraud? Here’s why we need better tech
In this Help Net Security video, Patrick Harding, Chief Architect at Ping Identity, discusses the state of identity fraud prevention.
Consumers continue to overestimate their ability to spot deepfakes
The Jumio 2024 Online Identity Study reveals significant consumer concerns about the risks posed by generative AI and deepfakes, including the potential for increased cybercrime and identity fraud.
SEC requires financial institutions to notify customers of breaches within 30 days
The Securities and Exchange Commission (SEC) announced the adoption of amendments to Regulation S-P to modernize and enhance the rules that govern the treatment of consumers’ nonpublic personal information by certain financial institutions.
Technological complexity drives new wave of identity risks
Security leaders are facing increased technological and organizational complexity, which is creating a new wave of identity risks for their organizations, according to ConductorOne.
Product showcase: Alert – Data breach detector for your email, credit card, and ID
With Alert, you can easily monitor your most important credentials, such as your email, credit card, and ID. Alert will instantly notify you if it appears in breached online databases. This way, you can immediately secure your accounts and prevent more damage before it happens.
New infosec products of the week: May 24, 2024
Here’s a look at the most interesting products from the past week, featuring releases from CyberArk, OneTrust, PlexTrac, and Strike Graph.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/05/26/week-in-review-google-fixes-yet-another-chrome-zero-day-exploit-youtube-as-a-cybercrime-channel/