pwn.watch: Deserialization incident updates

[critical] Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)

Thu, 02 Nov 2023 00:00:00 GMT

A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.

Status: closed · Patch: patched · Fixed in: 5.15.16, 5.16.7, 5.17.6, 5.18.3

Latest updates:

2023-11-02: CISA adds CVE-2023-46604 to the KEV catalog
2023-11-01: Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware (source)
2023-10-27: Apache publishes the CVE-2023-46604 announcement; fixed releases already out (source)

CVEs: CVE-2023-46604

[high] Progress WS_FTP Server: Deserialization of Untrusted Data (CVE-2023-40044)

Thu, 05 Oct 2023 00:00:00 GMT

Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. Added to CISA KEV on 2023-10-05. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-05: CISA added CVE-2023-40044 to the KEV catalog (due 2023-10-26).

CVEs: CVE-2023-40044

[critical] Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26359)

Mon, 21 Aug 2023 00:00:00 GMT

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. Added to CISA KEV on 2023-08-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-08-21: CISA added CVE-2023-26359 to the KEV catalog (due 2023-09-11).

CVEs: CVE-2023-26359

[critical] Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)

Tue, 11 Jul 2023 00:00:00 GMT

Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. Added to CISA KEV on 2023-07-11. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-07-11: CISA added CVE-2022-31199 to the KEV catalog (due 2023-08-01).

CVEs: CVE-2022-31199

[critical] Novi Survey: Insecure Deserialization (CVE-2023-29492)

Thu, 13 Apr 2023 00:00:00 GMT

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account. Added to CISA KEV on 2023-04-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-13: CISA added CVE-2023-29492 to the KEV catalog (due 2023-05-04).

CVEs: CVE-2023-29492

[high] Adobe ColdFusion: Deserialization of Untrusted Data (CVE-2023-26360)

Wed, 15 Mar 2023 00:00:00 GMT

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2023-03-15.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-03-15: CISA added CVE-2023-26360 to the KEV catalog (due 2023-04-05).

CVEs: CVE-2023-26360

[critical] IBM Aspera Faspex: Code Execution (CVE-2022-47986)

Tue, 21 Feb 2023 00:00:00 GMT

IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. Added to CISA KEV on 2023-02-21. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-02-21: CISA added CVE-2022-47986 to the KEV catalog (due 2023-03-14).

CVEs: CVE-2022-47986