ColdFusion and USAHERDS web-application Vulnerabilities

 

ColdFusion is an application server. ColdFusion is also a web programming language that allows a web application communicate with various back-end systems.

Using ColdFusion, you can create dynamic web pages that offer user input, database lookups, time of day, or any other criteria you require.

ColdFusion is used by the US Social Security Administration, the Food and Drug Administration, The Kennedy Center, the State Department, and the Fortune 100 websites.

ColdFusion Builder reached the end-of-life, effective Oct 1, 2024.

Vulnerability:

• v A critical security flaw in ColdFusion such as exploit that could cause an arbitrary file system read.

Recommendation:

ü The vulnerability has been addressed in ColdFusion 2023 Update 12. Recommended to apply the patches to mitigate potential risks.

USAHERDS, USALIMS, USAPlants, USAFoodSafety, and USAMeals are web applications developed by Acclaim Systems to assist U.S. government agencies in tracking and managing animal health, as well as controlling disease outbreaks, which is part of the AgraGuard product suite, which supports agriculture and food safety operations.

Vulnerability:

• v This involves the use of hardcoded credentials such as static Validation Key and Decryption Key values, allowing attackers to execute malicious code on the USAHERDS, USALIMS, USAPlants, USAFoodSafety, and USAMeals web applications.

With these keys for the web applications, one can construct a malicious View State that passes the MAC check and will be deserialized by the server. This deserialization can result in the execution of code on the server.

Note: 

More than 125,000 ColdFusion servers are deployed, ColdFusion is one of the most widely adopted web technologies, and a total of 643,663 websites use ColdFusion, across the globe.

 

Apple OS and Interface Security Vulnerabilities

Apple's operating system for its computers, mobiles, ipads, is called macOS, which was previously known as Mac OS X. It is designed specifically for Apple hardware and provides a user-friendly interface along with various built-in applications. Apple OS Operating system is branded and known for its security features.

The following is a list of operating systems released by Apple Inc. There are six supported software platforms: iOS, iPadOS, watchOS, tvOS, macOS and visionOS.

Vulnerabilities – Operating System:

An app may be able to access sensitive user data, or a malicious app may be able to access private information.

This issue is fixed in watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2.

Vulnerabilities – User Interface:

An unpredictable user interface issue such as “muting a call while ringing may not result in mute being enabled, or increasing the volume and decreasing the volume will not work as expected and misfunction/bug is identified”.

This issue is fixed in iOS 18.2 and iPadOS 18.2. Security fixes are available for, iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later.

Recommendation: 

It is advised to apply the security fixes or keep the Apple OS up-to-date.

VMware vCenter Vulnerabilities

 

VMware virtualize physical computers using its core hypervisor product. A hypervisor is a thin layer of software that interacts with the underlying resources of a physical computer (called the host) and allocates those resources to other operating systems (known as guests). Multiple virtual servers can be designed on a single host machine by virtualizing Windows servers and by connecting them to networks and clouds and by designing and implementing virtual desktop infrastructure (VDI) and by enabling template management.

VMware software allows you to run a virtual computer on your physical computer. It increases the efficiency of your computer system. You can use more applications with fewer physical computers. Enterprises often use VMware in conjunction with Cloud Computing. VMware Tools is a set of services and modules that enable several features in VMware products for better management of guests operating systems and seamless user interactions with them. VMware Tools has the ability to: Pass messages from the host operating system to the guest operating system.

VMware vCenter is advanced server management software that provides a centralized platform for controlling your VMware vSphere environments, allowing you to automate and deliver a virtual infrastructure across the hybrid cloud with confidence. vCenter plays a critical role by centralizing control and management of virtualized environments.

Vulnerability:

There are two vulnerabilities associated with VMware vCenter and they are listed below

1.    Protocol implementation allowing unauthenticated attackers to potentially trigger remote code execution.

2.    The vCenter Server contains a privilege escalation vulnerability. A malicious actor may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

 

Affected Products:

• vCenter Server versions 7.0 and 8.0

• VMware Cloud Foundation versions 4.x and 5.x

Resolution:

It is recommended to the DevOps and System administrators to upgrade to a new version or to apply the patch provided by the Broadcom to circumvent the vulnerabilities. 

 

 

FAILURE ON THE PART OF CHATGPT TO GIVE VALID RESULTS

 

ChatGPT which is built on Artificial Intelligence and Machine Learning is failing in assisting decision making, as it is not providing information to input/label.

 

Artificial Intelligence is a broad area that focuses on creating systems capable of performing tasks that typically require human intelligence. This includes problem-solving, understanding natural language, recognizing patterns, and making decisions.

 

Machine Learning, on the other hand, is a subset of AI that involves the use of algorithms and statistical models to enable systems to improve their performance on a task through experience.

Essentially, ML allows computers to learn from data, identifying patterns and making predictions without being explicitly programmed for every task.

 

ChatGPT is built on advanced natural language processing technology developed by OpenAI. It uses deep learning techniques, particularly transformer models, to understand and generate human-like text. This technology allows it to engage in conversations, answer questions, and assist with a wide range of topics by predicting and generating text based on the input it receives.

 

Use Case:

The below input or label is keyed in to ChatGPT under the “Get Advice” section.

A series of queries were given as input/label to ChatGPT and in response no useful information was provided and the conversation was prolonged. As there were no information provided by ChatGPT, the Artificial Intelligence or Machine Leaning did not aid decision making.

Input or Label: “Canada and India ties and current situation with relation to IT market”.

Response Provide by ChatGPT: No relevant information was provided and conversation was prolonged.

The below is the screen print of input/label and responses provided by ChatGPT.

From this Use Case, we can safely conclude that ChatGPT which utilizes the Artificial Intelligence and Machine learning is not providing any relevant or no information, and by using these, the decision making cannot be made.

Veeam Security Vulnerability which allows an unauthenticated remote code execution.

 

·      Veeam Backup & Replication is a proven data protection solution that offers efficient and reliable backup and recovery for virtual, physical, NAS, and cloud-native environments.

·      Veeam was co-founded in 2006 by Ratmir Timashev and Andrei Baronov, two entrepreneurs from Russia. 

·      Veeam creates backups by instructing the virtualization software to take snapshots of VMs. 

·      VM backups are intended to store your data for as long as deemed necessary, so you can go back in time and restore what was lost, while VM replicas are intended to restore the VMs as soon as possible.

·      Veeam is for virtual environments built on VMware vSphere, Nutanix AHV, and Microsoft Hyper-V hypervisors. 

 

v Most of the system administrators are familiar with Veeam’s enterprise-oriented backup solution, ‘Veeam Backup & Replication’.

v Tactlessly, so is every ransomware operator, given it's somewhat 'privileged position' in the storage world of most enterprise's networks.

v Note, recently there are many notable ransomware attacks reported across the globe, probably due to this vulnerability

VENERABILITY DETAILS:

Veeam allows the connection to the .NET Remoting object, which is the root cause of the vulnerability.

Version	Status
12.2.0.334	Fully patched.
12.1.2.172	Low privilege users are able to execute arbitrary code. Needs Authentication.
12.1.1.56 and earlier	Vulnerable to unauthenticated Remote Code Execution.

 

PRODUCTS AFFECTED:

ü Veeam ONE

ü Veeam Service Provider Console

ü Veeam Agent for Linux

ü Veeam Backup for Nutanix AHV

ü Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization

Recommendation:

As there are multiple vulnerability fixes provided by Veeam in its latest patch, it is recommended for all DevOps and System Administrators to upgrade to the latest version of Veeam software.

 

 

Incorrect or misleading labels/outputs are provided by the AI and Machine Learning Models

 

AI and ML products have proliferated as businesses use them to process and analyze immense volumes of data, drive better decision-making, generate recommendations and insights in real time, and create accurate forecasts and predictions.

 

Gemini is a large language model (LLM) developed by Google Artificial Intelligence. Gemini is built on a foundation of advanced machine learning techniques, including transformer architectures and deep learning. It has been trained on a massive dataset of text and code, allowing it to acquire a deep understanding of language.  

 

It is designed to be a versatile AI assistant capable of a wide range of tasks, including:  

§  Gemini can generate human-quality text, such as articles, essays, code, scripts, musical pieces, email, letters, etc.

§  It can translate text from one language to another accurately and naturally.

§  Gemini can write code in various programming languages, including Java, Python, JavaScript, and CSharp.

§  It can provide informative and comprehensive answers to a wide range of questions.

§  Gemini can summarize long texts into shorter, more concise versions.

§  It can generate creative content, such as poems, stories, and scripts.  

 

Overall, Gemini is a powerful and versatile AI assistant with the potential to revolutionize a wide range of industries.

Note: Google Gemini’s AI and Machine Learning Models are utilized for the below use cases.

 

Use Case 1:

The below two features are used as input to Google Gemini.

Ø  Flights list from New York to Mumbai

Ø  Air India Flights from New York to Mumbai cheap rates

 

v  For the first feature i.e., “Flights list from New York to Mumbai”, the below label is present by Gemini.

 

 

When searched the flights using the Google Flights link, two Air India Flights were displayed  and both were direct flights.

 

 

 

But when searched the Air India website, there were no direct flights from EWR – BOM and its details.

 

 

 

Google Gemini has provided incorrect or misleading information, as the content displayed by Gemini, that there were direct flights, which was partially correct, but it recommended to Google Flights Link, where there were direct flights from EWR – BOM, but the information in the Air India is completely different, and there were no direct flights.

 

v  The second feature i.e., “Air India Flights from New York to Mumbai cheap rates”, the below label is presented by Google Gemini.

 

 

Google Gemini content gave the information that direct flights may be more expensive than flights with layovers, but when queried the Air India flights, the opposite was true, such as the direct flight was the cheapest option, and the details goes here. The Google Gemini content was thus misleading.

 

Summary: The randomness, generalization, and pattern identifications techniques are still evolving, as it continues to develop, we can expect to see even more innovative and exciting applications of this technology.

 

 

 

Use Case 2:

 

The below feature is used as input to Google Gemini, as a fresh query.

Ø  Direct Air India Fligths list from John F Kennedy to Mumbai on 13 Oct

 

Google Gemini, gave the above label for the feature (Direct Flights), such as there are multiple flights from JFK to BOM and the number may vary. It is recommended to visit Air India Link for details. In the Air India Link provided by Google Gemini, there was only one direct flight from JFK to BOM, the details are as follows.

 

 

 

Here the content provided by the Google Gemini and the Air India link data are not matching, the information is misleading.

Hence, we can safely conclude that incorrect or misleading labels/outputs are provided by the AI and Machine Learning Models which we have to double check before arriving any conclusion by using AI for outcomes.

 

IVANTI ENDPOINT MANAGER SECURITY VULNERABILITY INSIGHT

Ivanti Endpoint Manager (EPM) is an enterprise endpoint management solution that allows for centralized management of devices within an organization.

EPM aids in media protection, isolated device remote control, security diagnostics, flexible dashboards and reporting. It also detect and prevent threats before they impact you, and respond swiftly to infections.

EPM, produces software for IT Security, IT Service Management, IT Asset Management, Unified Endpoint Management, Identity Management and supply chain management. Endpoint management is the process of controlling endpoint devices connected to a network.

VULNERABILITY DETAILS

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Using this vulnerability, the IIS Manager “EventHandler.cs” can be hosted on the “/WSStatusEvents” endpoint and the SQL Server log and access can be gained.

After successful exploitation, entire network assets, file listing would be compromised.

Products Affected:

§  Ivanti Avalanche 

§  Ivanti Neurons for ITSM 

§  Ivanti Connect Secure

§  Ivanti Secure Access 

§  Ivanti Endpoint Manager (EPM) 

 

Hence, it is recommended, to apply the patch which Ivanti has released, for all the DevOps and Network Teams. It is also recommended to apply Life Cycle Management on all the installed software’s of the respective project teams to review on regular basis.

 

All WhatUp Gold old versions are compromised and user credentials are exploited

All WhatUp Gold old versions are compromised and user credentials are exploited.

WhatsUp Gold streamlines network monitoring workflows by letting you initiate management tools directly from the interactive map. It manages networks, traffic, physical servers, VMs and applications with easy-to-use and customizable maps, dashboards and alerts. 

Using this we can switch between physical, virtual, wireless, and dependency views to resolve DevOps monitoring issues or activities quickly.

It is used by the DevOps or networking team in the major organizations across the globe.

SQL Injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.

This can allow an attacker to view data that they are not normally able to retrieve.

This might include data that belongs to other users, or any other data that the application can access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behaviour.

All old version of the WhatsUp Gold have a SQL Injection vulnerability which allows an unauthenticated attacker to retrieve the user’s encrypted password.  WhatsUp Gold authentication to exploit the Active Monitor PowerShell Script and ultimately download various remote access tools for gaining persistence on the Windows host.

Hence it is recommended for all the organization customer of WhatUp Gold utilizing in their network, and DevOps Teams to upgrade their WhatsUp Gold versions to 2024.0.0

#Network, #SQL Injection, #WhatUp Gold, #Microsoft Windows Server 2016,  #Microsoft Windows Server 2019, #Microsoft Windows Server 2022, 

 

Microsoft Auto-Update feature grants the administrative privileges to windows machines and servers

Microsoft Auto-Update feature grants the administrative privileges to windows machines and servers

 

Microsoft Auto-Update has the Elevation of Privilege Vulnerability, and with the help of this, any attacker is possible exploit and login as windows administrator through a malicious request.  

Microsoft Auto-Update privilege elevation vulnerability gives admin privileges in Windows 10, Windows 11, Windows Server, and in the cloud servers.

Utilizing this venerability, it is possible to configure group policies to prevent 'Standard' users from performing MSI installer operations, elevate their privileges to help spread laterally within the network and download arbitrary or any data from the network.

It is recommended to temporarily disable the Microsoft Auto-Update feature until a patch for this vulnerability is released or be cautious with the malicious requests, if the vulnerability already exists in the machines or servers.

 

A security feature in the Chrome web browser which has been designed to mitigate JavaScript memory corruption issues has security vulnerabilities

 

The earlier version of Chrome i.e., beforehand 128.0.6613.84, allows a remote attacker to potentially exploit memory corruption or access all the system or server resources via a constructed HTML page.

INSIGHTS ABOUT THE THREAD:

Chrome V8 Engine, has been designed in JavaScript engine which executes the JavaScript code.  V8 is written in C++ and it can execute the C++ programs which knobs the file system, database and network connections and  this permits to construct C++ in JavaScript, and this will be executed via V8.

It can execute JavaScript code either within or outside of a browser.

V8 is used in the Chromium-based web browsers - Google Chrome, Brave, Opera, Vivaldi, Microsoft Edge, and in the Couchbase database server.

Hence forth using this exploitation, if the organization/individuals have old browsers in machines or in server entire organization/individuals’ data in filesystem & databases, and network can be controlled/accessed.

Hence as part of DevOps Security Practices, it is encouraged to update the browser to the latest version to come over these security vulnerabilities.