Explosion of 0-day exploits: The bad news and the good news
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21166 | Race Condition Heap Corruption in Google Chromium (Chrome, Edge, Opera) Google Chromium contains a race condition (CWE-362) that can lead to heap corruption (CWE-122) when the browser processes a crafted HTML page, meaning an attacker can trigger the flaw simply by getting a user to visit an attacker-controlled or malicious webpage. Successful exploitation of the heap corruption could crash the browser and potentially allow the attacker to execute code within the affected browser process. Because the vulnerable code is in the Chromium engine itself, all Chromium-based browsers are potentially affected, including Google Chrome, Microsoft Edge, Opera, and other derived browsers, across desktop and mobile fleets. CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming the flaw is being exploited in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS currently assigns a 26.7% probability of exploitation within 30 days (98th percentile), and CVSS scoring has not yet been published. Do: Apply the latest patched releases of all Chromium-based browsers in use (Chrome, Edge, Opera, and any derived browsers) per vendor instructions, as required by CISA's KEV listing. Prioritize managed endpoints and any systems where users browse untrusted or internet-facing websites, verify fleet-wide browser versions after updating, and monitor CISA/vendor advisories for ransomware-associated activity since that linkage is currently unknown. | 8.8 | 27% | KEV |
| massbillions of users and installations (Chromium powers Chrome, Edge, Opera and many other browsers) | |
| CVE-2021-30551 | V8 Type Confusion Zero-Day in Google Chrome (CVE-2021-30551), Exploited in the Wild CVE-2021-30551 is a type confusion flaw (CWE-843) in the V8 JavaScript engine used by Google Chrome and Chromium, which can lead to heap corruption. An attacker triggers it by persuading a user to open a specially crafted HTML page — the browser bug requires user interaction but no privileges or authentication. Successful exploitation could allow a remote attacker to execute code or otherwise corrupt the browser process, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). Anyone running Google Chrome prior to 91.0.4472.101, including Chromium-based packages such as Fedora's chromium, is affected. The flaw was exploited as a zero-day before the fix was released, with Google attributing recent Chrome zero-day attacks including this issue to campaigns against Armenian targets linked to a commercial spyware vendor, and it is listed in CISA's Known Exploited Vulnerabilities catalog. Do: Update Google Chrome to 91.0.4472.101 or later (via chrome://settings/help) and update Fedora's chromium package to the patched build, then verify the version in chrome://version. Fedora/Chromium administrators should apply vendor updates per CISA KEV guidance. Until patched, treat web browsing as a risk vector and avoid opening untrusted links, since exploitation requires loading a crafted web page. | 8.8 | 65% | KEV PoC |
| masshundreds of millions to billions of Chrome/Chromium installs worldwide (Chrome is the world's dominant browser) | |
| CVE-2021-33742 | Out-of-Bounds Write RCE in Microsoft Windows MSHTML Engine (CVE-2021-33742) A remote code execution vulnerability exists in the Microsoft Windows MSHTML Platform — the Internet Explorer/Trident rendering engine that Windows components and applications invoke to display web content — caused by an out-of-bounds write (CWE-787). An attacker triggers it by persuading a user to open attacker-controlled content, such as a crafted document or web page that causes MSHTML to render a remote URL; no privileges are required, but user interaction is needed and the attack is rated high complexity. Successful exploitation runs attacker code in the context of the logged-in user, potentially allowing installation of programs, viewing/changing/deleting data, or creating new accounts with the victim's rights. The affected range spans Windows 7, 8.1, RT 8.1, Windows 10 versions 1507 through 21H1, and Windows Server 2008 and 2012 — essentially the entire supported Windows installed base at the time of disclosure. Exploitation is confirmed in the wild: Microsoft disclosed the flaw as used in limited targeted attacks, CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 (ransomware use unknown), and EPSS assigns a 59.4% 30-day exploitation probability (99th percentile). Do: Apply Microsoft's security update for CVE-2021-33742, delivered via the July 2021 cumulative Windows updates (and later), to all affected Windows 7/8.1/RT 8.1/10 clients and Windows Server 2008/2012 hosts, prioritizing internet-exposed systems and per CISA's required action. Because exploitation requires user interaction, treat unsolicited documents and links with caution until systems are patched. No public proof-of-concept is known, but the KEV listing confirms real-world targeted exploitation, so assume active scanning/attacks and verify patch status across the estate. | 7.5 | 59% | KEV |
| masson the order of 1 billion+ Windows installations |
Full article600 words · extracted from helpnetsecurity.com · click to collapse
Have you noticed that lately we’ve been hearing more about in-the-wild attacks exploiting 0-day vulnerabilities? “Halfway into 2021, there have been 33 0-day exploits used in attacks that have been publicly disclosed this year — 11 more than the total number from 2020,” researchers with Google’s Threat Analysis Group (TAG) have pointed out in a recent blog post.
Does this mean that threat actors are leveraging more 0-day exploits than ever? Or that researchers and threat analysts are getting better at detecting these attacks? Both answers are likely true, and there may be other factors at play.
Recently detected attacks
TAG analysts Maddie Stone and Clement Lecigne have shared information about several attack campaigns exploiting 0-day vulnerabilities that TAG discovered this year, and in some of them they believe the 0-day exploits were sourced from the same (unnamed) commercial surveillance company.
Two campaigns exploiting two Chrome zero-days (CVE-2021-21166 and CVE-2021-30551) have lured Armenian targets to attacker-controlled domains that fingerprinted their devices to see whether they can be targeted with the exploits and, if they could, the exploits would be automatically delivered.
In two other attack campaigns, the threat actors exploited an Internet Explorer 11 0-day (CVE-2021-33742) to target Armenian users with malicious Office documents that loaded web content within Internet Explorer to deliver the exploit (again, after fingerprinting the targets’ devices first).
Finally, a Safari zero-day (CVE-2021-1879) was exploited in attacks targeting government officials from western European countries. The targets would receive a malicious link and, if they visited the site with Safari from an iOS device, they would be redirected to an attacker-controlled domain that served the exploit, which “would turn off Same-Origin-Policy protections in order to collect authentication cookies from several popular websites, including Google, Microsoft, LinkedIn, Facebook and Yahoo and send them via WebSocket to an attacker-controlled IP.”
The analysts believe that these attacks were likely perpetrated by a Russian government-backed actor.
Why are we witnessing an uptick of attacks exploiting 0-days?
“Those of us working on protecting users from 0-day attacks have long suspected that overall, the industry detects only a small percentage of the 0-days actually being used,” Stone and Lecigne noted.
Threat actors are doing their best to keep 0-day exploits hidden from researchers and security solutions and are generally successful – at least for a short while, and sometimes even longer.
Google’s analysts believe that part of the reason we’re hearing more about attacks using 0-day exploits are improvements in detection and a growing culture of disclosure. Also, that attackers are forced to use 0-day exploits because security measures aimed at closing known vulnerabilities are working and making their job more difficult.
Unfortunately, the demand for 0-day exploits has created a lucrative market for private companies that sell 0-day capabilities for legal surveillance purposes, and those end up in the hands and repertory of government-backed actors.
On the whole, though, an increased detection of 0-day exploits is a good thing for IT companies, they say: the vulnerabilities get fixed, and the companies can learn to get better at preventing and fighting exploitation.
In other exploit-related news, it seems that cybercriminals are starting to prefer Access-as-a-Service to specific 0-day or N-day exploits, as the hard work has already been done for them.
UPDATE (July 16, 2021, 00:20 a.m. PT):
Microsoft and Citizen Lab revealed that the two Chrome zero-days and the IE zero-day have been exploited by the DevilsTongue malware – a creation of Israeli spyware vendor Candiru. Citizen Lab’s extensive report offers more details about the firm, the spyware it uses, and the victims that its customers targeted with it.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/07/15/0-day-exploits/