Attack Blogs

SEARCH

CATEGORIES

TAGS

    Lexmark Command Injection Vulnerability ZDI-CAN-19470 Pwn2Own Toronto 2022

    August 10, 2023
    Introduction In December 2022, we competed at our first pwn2own. We were able to successfully exploit the Lexmark MC3224i using a command injection 0-day. This post will detail the process we used to discover, weaponize, and have some fun with this vulnerability. You can find our POC here. Printer Acquisition It was rather difficult to…

    CVE-2023-39143: PaperCut Path Traversal/File Upload RCE Vulnerability

    August 4, 2023
    Summary CVE-2023-39143 is a critical vulnerability we disclosed to PaperCut that affects the widely used PaperCut NG/MF print management software. It affects PaperCut NG/MF running on Windows, prior to version 22.1.3. If you are a user of PaperCut on Windows, and have it exposed to the Internet, we recommend you check out the July 2023…

    MOVEit Transfer CVE-2023-34362 Deep Dive and Indicators of Compromise

    June 9, 2023
    On May 31, 2023, Progress released a security advisory for their MOVEit Transfer application which detailed a SQL injection leading to remote code execution and urged customers to update to the latest version. The vulnerability, CVE-2023-34362, at the time of release was believed to have been exploited in-the-wild as a 0-day dating back at least…

    CVE-2023-27524: Insecure Default Configuration in Apache Superset Leads to Remote Code Execution

    April 25, 2023
    Apache Superset is an open source data visualization and exploration tool. It has over 50K stars on GitHub, and there are more than 3000 instances of it exposed to the Internet. In our research, we found that a substantial portion of these servers - at least 2000 (two-thirds of all servers) - are running with…

    PaperCut CVE-2023-27350 Deep Dive and Indicators of Compromise

    April 24, 2023
    Overview On 8 March 2023, PaperCut released new versions for their enterprise print management software, which included patches for two vulnerabilities: CVE-2023-27350 and CVE-2023-27351. The PaperCut security advisory details CVE-2023-27350 as a vulnerability that may allow an attacker to achieve remote code execution to compromise the PaperCut application server. PaperCut also details in this advisory…

    Veeam Backup and Replication CVE-2023-27532 Deep Dive

    March 23, 2023
    Introduction Veeam has recently released an advisory for CVE-2023-27532 for Veeam Backup and Replication which allows an unauthenticated user with access to the Veeam backup service (TCP 9401 by default) to request cleartext credentials. Others, including Huntress, Y4er, and CODE WHITE , have provided insight into this vulnerability. In this post, we hope to offer…

    From CVE-2022-33679 to Unauthenticated Kerberoasting

    February 25, 2023
    On September 13, 2022, a new Kerberos vulnerability was published on the Microsoft Security Response Center's security site.  It's labeled as a Windows Kerberos Elevation of Privilege vulnerability and given the CVE ID CVE-2022-33679.  The MSRC page acknowledges James Forshaw of Google Project Zero for the disclosure and James published a detailed technical write-up of…

    Fortinet FortiNAC CVE-2022-39952 Deep-Dive and IOCs

    February 21, 2023
    Introduction On Thursday, 16 February 2023, Fortinet released a PSIRT that details CVE-2022-39952, a critical vulnerability affecting its FortiNAC product. This vulnerability, discovered by Gwendal Guégniaud of Fortinet, allows an unauthenticated attacker to write arbitrary files on the system and as a result obtain remote code execution in the context of the root user. Extracting…

    VMware vRealize Log Insight VMSA-2023-0001 Technical Deep Dive

    January 31, 2023
    Introduction The recent VMware VMSA describes four new CVEs affecting VMware vRealize Log Insight, reported by ZDI. Three of these CVEs can be combined to give an attacker remote code execution as root. This vulnerability is exploitable in the default configuration for VMware vRealize Log Insight. We have successfully reproduced this exploit and would like…

    VMware vRealize Log Insight VMSA-2023-0001 IOCs

    January 27, 2023
    Introduction The recent VMware VMSA describes four new CVEs affecting VMware vRealize Log Insight. Three of these CVEs can be combined to give an attacker remote code execution as root. This vulnerability is exploitable in the default configuration for VMware vRealize Log Insight. CVE-2022-31704: VMware vRealize Log Insight broken access control Vulnerability CVE-2022-31711: VMware vRealize…