Google: four zero-day flaws have been exploited in the wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1879 | Universal XSS in Apple WebKit on iOS, iPadOS, and watchOS (Actively Exploited) CVE-2021-1879 is a universal cross-site scripting (UXSS) flaw in the WebKit browser engine affecting iOS, iPadOS, and watchOS, caused by an object-lifetime management error. An attacker can trigger it by convincing a user to process maliciously crafted web content (e.g., visiting an attacker-controlled page in Safari or another WebKit-based browser), allowing the attacker to bypass the same-origin policy and read or modify content of other sites in the browser. Successful exploitation is rated Medium severity (CVSS 6.1) because it requires user interaction, but it can leak sensitive data such as cookies, session tokens, or page content. Any user of an iPhone, iPad, or Apple Watch running software older than iOS 12.5.2, iOS 14.4.2/iPadOS 14.4.2, or watchOS 7.3.3 is affected. Apple reported that the issue may have been actively exploited in the wild at the time of patching, it is on the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), and public reporting tied its use to targeted campaigns (including Russian SVR-linked operations), though no public proof-of-concept is known. Do: Update devices to iOS 12.5.2 (older devices) or iOS 14.4.2/iPadOS 14.4.2, and Apple Watch devices to watchOS 7.3.3, per Apple's instructions. Because exploitation requires loading malicious web content in WebKit, avoid following untrusted web links on unpatched devices until updated; verify fleet-wide OS versions and confirm the fix, since this CVE is on the CISA KEV catalog with patching required. Check logs or browser history for signs of visits to attacker-controlled sites on devices that have since been updated, as no public proof-of-concept exists to test against. | 6.1 | 7% | KEV |
| masshundreds of millions of devices (Apple's active iPhone/iPad/watchOS install base was on the order of 1+ billion when patched; all unpatched devices are exposed… | |
| CVE-2021-21166 | Race Condition Heap Corruption in Google Chromium (Chrome, Edge, Opera) Google Chromium contains a race condition (CWE-362) that can lead to heap corruption (CWE-122) when the browser processes a crafted HTML page, meaning an attacker can trigger the flaw simply by getting a user to visit an attacker-controlled or malicious webpage. Successful exploitation of the heap corruption could crash the browser and potentially allow the attacker to execute code within the affected browser process. Because the vulnerable code is in the Chromium engine itself, all Chromium-based browsers are potentially affected, including Google Chrome, Microsoft Edge, Opera, and other derived browsers, across desktop and mobile fleets. CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming the flaw is being exploited in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS currently assigns a 26.7% probability of exploitation within 30 days (98th percentile), and CVSS scoring has not yet been published. Do: Apply the latest patched releases of all Chromium-based browsers in use (Chrome, Edge, Opera, and any derived browsers) per vendor instructions, as required by CISA's KEV listing. Prioritize managed endpoints and any systems where users browse untrusted or internet-facing websites, verify fleet-wide browser versions after updating, and monitor CISA/vendor advisories for ransomware-associated activity since that linkage is currently unknown. | 8.8 | 27% | KEV |
| massbillions of users and installations (Chromium powers Chrome, Edge, Opera and many other browsers) | |
| CVE-2021-30551 | V8 Type Confusion Zero-Day in Google Chrome (CVE-2021-30551), Exploited in the Wild CVE-2021-30551 is a type confusion flaw (CWE-843) in the V8 JavaScript engine used by Google Chrome and Chromium, which can lead to heap corruption. An attacker triggers it by persuading a user to open a specially crafted HTML page — the browser bug requires user interaction but no privileges or authentication. Successful exploitation could allow a remote attacker to execute code or otherwise corrupt the browser process, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). Anyone running Google Chrome prior to 91.0.4472.101, including Chromium-based packages such as Fedora's chromium, is affected. The flaw was exploited as a zero-day before the fix was released, with Google attributing recent Chrome zero-day attacks including this issue to campaigns against Armenian targets linked to a commercial spyware vendor, and it is listed in CISA's Known Exploited Vulnerabilities catalog. Do: Update Google Chrome to 91.0.4472.101 or later (via chrome://settings/help) and update Fedora's chromium package to the patched build, then verify the version in chrome://version. Fedora/Chromium administrators should apply vendor updates per CISA KEV guidance. Until patched, treat web browsing as a risk vector and avoid opening untrusted links, since exploitation requires loading a crafted web page. | 8.8 | 65% | KEV PoC |
| masshundreds of millions to billions of Chrome/Chromium installs worldwide (Chrome is the world's dominant browser) | |
| CVE-2021-33742 | Out-of-Bounds Write RCE in Microsoft Windows MSHTML Engine (CVE-2021-33742) A remote code execution vulnerability exists in the Microsoft Windows MSHTML Platform — the Internet Explorer/Trident rendering engine that Windows components and applications invoke to display web content — caused by an out-of-bounds write (CWE-787). An attacker triggers it by persuading a user to open attacker-controlled content, such as a crafted document or web page that causes MSHTML to render a remote URL; no privileges are required, but user interaction is needed and the attack is rated high complexity. Successful exploitation runs attacker code in the context of the logged-in user, potentially allowing installation of programs, viewing/changing/deleting data, or creating new accounts with the victim's rights. The affected range spans Windows 7, 8.1, RT 8.1, Windows 10 versions 1507 through 21H1, and Windows Server 2008 and 2012 — essentially the entire supported Windows installed base at the time of disclosure. Exploitation is confirmed in the wild: Microsoft disclosed the flaw as used in limited targeted attacks, CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 (ransomware use unknown), and EPSS assigns a 59.4% 30-day exploitation probability (99th percentile). Do: Apply Microsoft's security update for CVE-2021-33742, delivered via the July 2021 cumulative Windows updates (and later), to all affected Windows 7/8.1/RT 8.1/10 clients and Windows Server 2008/2012 hosts, prioritizing internet-exposed systems and per CISA's required action. Because exploitation requires user interaction, treat unsolicited documents and links with caution until systems are patched. No public proof-of-concept is known, but the KEV listing confirms real-world targeted exploitation, so assume active scanning/attacks and verify patch status across the estate. | 7.5 | 59% | KEV |
| masson the order of 1 billion+ Windows installations |
Full article596 words · extracted from securityaffairs.com · click to collapse
Google security experts revealed that Russia-linked APT group targeted LinkedIn users with Safari zero-day.
Security researchers from Google Threat Analysis Group (TAG) and Google Project Zero revealed that four zero-day vulnerabilities have been exploited in the wild earlier this year.
The four security flaws were discovered earlier this year and affect Google Chrome, Internet Explorer, and WebKit browser engine. Below the list of the zero-day issues disclosed by the experts:
- CVE-2021-1879: Use-After-Free in QuickTimePluginReplacement
- CVE-2021-21166: Chrome Object Lifecycle Issue in Audio
- CVE-2021-30551: Chrome Type Confusion in V8
- CVE-2021-33742: Internet Explorer out-of-bounds write in MSHTML
The vulnerabilities were exploited in three different campaigns analyzed by the researchers, it is interesting to note that three out of four exploits were developed by the same surveillance firm,. The fourth exploit (CVE-2021-1879) was likely developed by a Russia-linked APT group.
“The four exploits were used as a part of three different campaigns. As is our policy, after discovering these 0-days, we quickly reported to the vendor and patches were released to users to protect them from these attacks.” reads the post published by Google. “We assess three of these exploits were developed by the same commercial surveillance company that sold these capabilities to two different government-backed actors. Google has also published root cause analyses (RCAs) on each of the 0-days.”
Google researchers also provide information about the exploitation of zero-day vulnerabilities in attacks that took place in the first half of 2021. According to the experts, there have been 33 0-day exploits used in attacks that have been publicly disclosed this year, 11 more than the total number from zero-day exploits used in attacks during 2020.
The CVE-2021-1879 vulnerability exploited by the Russia-linked cyberespionage group resides in the WebKit flaw, it could be exploited by an attacker to trick the victims into processing maliciously crafted web content that can lead to universal cross-site scripting attacks.
“Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited.” reads the advisory published by Apple that addressed the flaw in March with the release of out-of-band updates for iOS, iPadOS, macOS and watchOS.
The IT giant addressed the issue by improving the management of object lifetimes.
The CVE-2021-1879 was reported by Clement Lecigne of Google Threat Analysis Group and Billy Leonard of Google Threat Analysis Group.
Google researchers explained that the zero-day was used in attacks aimed at government officials from western European countries.
“In this campaign, attackers used LinkedIn Messaging to target government officials from western European countries by sending them malicious links. If the target visited the link from an iOS device, they would be redirected to an attacker-controlled domain that served the next stage payloads. The campaign targeting iOS devices coincided with campaigns from the same actor targeting users on Windows devices to deliver Cobalt Strike, one of which was previously described by Volexity.” continues the report.
“After several validation checks to ensure the device being exploited was a real device, the final payload would be served to exploit CVE-2021-1879.”
Google researchers did not attribute the attacks to a specific APT group, however, Microsoft researchers who investigated the campaign attributed them to Nobelium.
The NOBELIUM APT is the threat actor that conducted the supply chain attack against SolarWinds which involved multiple families of implants, including the SUNBURST backdoor, TEARDROP malware, GoldMax malware, Sibot, and GoldFinder backdoors.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, APT)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/120116/apt/zero-day-russia-apt.html