CVE-2023-34990 is credited to @hacks_zach of Horizon3.ai. This gave me a starting point for figuring out where to look for information. It's contained in Fortinet FortiWLM Deep-Dive, IOCs, and the Almost Story of the “Forti Forty” posted on 14 March 2024.

It is described as an unpatched vulnerability: "Unauthenticated Limited Log File Read – Allows retrieval of arbitrary log files which contain administrator session ID tokens" Check out the Path to Remote Code Execution #2 section for vulnerability details:

This vulnerability allows remote, unauthenticated attackers to access and abuse builtin functionality meant to read specific log files on the system via a crafted request to the /ems/cgi-bin/ezrf_lighttpd.cgi endpoint. This issue results from the lack of input validation on request parameters allowing an attacker to traverse directories and read any log file on the system.

Based on the details of the blog, I can confidently say that the new CVE and the blog's vulnerability are almost certainly one and the same.

cc: @GossiTheDog @jerry

#CVE_2023_34990 #fortinet #fortiwlm #vulnerability #CVE #infosec #cybersecurity

Fortinet 18 December 2024 security advisory FG-IR-23-144 (error loading post)
CVE-2023-34990 (9.8 critical) relative path traversal in Fortinet FortiWLM leads to code and command execution: released today, 557 days after it was reserved by Fortinet on 09 June 2023. Unable to view the advisory in order to determine exploitation. Shame on them for waiting a year to patch/announce the vulnerability.

h/t: @cR0w

#fortinet #fortwlm #vulnerability #CVE #infosec #cybersecurity

@chillybot I would then pull a bait and switch by returning to my roots as an Etch a Sketcher @GossiTheDog

Microsoft: Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage
Microsoft assesses that the Russian nation-state actor they track as "Secret Blizzard" (aka Turla publicly attributed to FSB Center 16 by the U.S. Government) has used the tools and infrastructure of at least six other threat actors during the past seven years. They also have actively targeted infrastructure where other threat actors have staged exfiltrated data from victims with the intention of collecting this data for their own espionage program. Microsoft assesses that Secret Blizzard's use of other actors' infrastructure and tools, both state-sponsored and cybercriminal, is exclusively for facilitating espionage operations.

This is the first of a two-part blog series, and Microsoft spends this one discussing how Secret Blizzard used the infrastructure of the Pakistan-based threat activity cluster Storm-0156 (aka SideCopy, Transparent Tribe and APT36) to install backdoors and collect intelligence on targets of interest in South Asia. Together with Black Lotus Labs, they confirmed that Secret Blizzard C2 infrastructure emanated from Storm-0156 infrastructure, including infrastructure used by Storm-0156 to collate exfiltrated data from campaigns in Afghanistan and India. Microsoft describes compromise and post-compromise activities, other attackers' backdoors used, and victimology. Indicators of compromise and hunting queries shared.

#russia #turla #snake #waterbug #venomousbear #cyberespionage #fsb #IOC #threatintel #infosec #cybersecurity #cyberthreatintelligence #CTI

@tom @briankrebs
Reason # 154 why I'm not using Bluesky: "reskeet"

*dies of cringe*

WIRED: Emergency Vehicle Lights Can Screw Up a Car's Automated Driving System
A joint research paper demonstrates that when some camera-based automated driving systems are exposed to the flashing lights of emergency vehicles, they can no longer confidently identify objects on the road. The researchers call the phenomenon a "digital epileptic seizure" (epilepticar for short) where the systems, trained by artificial intelligence to distinguish between images of different road objects, fluctuate in effectiveness in time with the emergency lights' flashes. The flaw could potentially cause vehicles with automated driving systems enabled to "crash near emergency vehicles" and "be exploited by adversaries to cause such accidents."

#vulnerability #AutomatedDriving #AutonomousVehicles #infosec #cybersecurity

Microsoft updated CVE-2024-49035 (8.7 high) Partner.Microsoft.Com Elevation of Privilege Vulnerability to an EXPLOITED ZERO-DAY! 🥳 Happy Thanksgiving @cR0w! @t0db @ntkramer @dreadpir8robots @briankrebs @campuscodi

Microsoft messed up again and had to correct their advisory. They had an "Exploitation Detected" flag but not an "Exploited" flag when this CVE was first announced.

Now I know that Eduard Kovacs reads my toots . See Security Week article Microsoft Patches Exploited Vulnerability in Partner Network Website

#microsoft #vulnerability #CVE #infosec #cybersecurity #copilot #dynamics365 #azure #zeroday #eitw #activeexploitation #CVE_2024_49035

Microsoft: "we had one #PatchTuesday yes, but what about second Patch Tuesday?"

• CVE-2024-49053 (7.6 high) Microsoft Dynamics 365 Sales Spoofing Vulnerability
• CVE-2024-49035 (8.7 high) Partner.Microsoft.Com Elevation of Privilege Vulnerability (EXPLOITATION DETECTED )
• CVE-2024-49038 (9.3 critical) Microsoft Copilot Studio Elevation Of Privilege Vulnerability
• CVE-2024-49052 (8.2 high) Microsoft Azure PolicyWatch Elevation of Privilege Vulnerability

Only CVE-2024-49053 has any substantial information in their FAQ section. CVE-2024-49035 is "not exploited" but "exploitation detected" (analyst comment: likely a gaffe). The rest are Not Exploited, Not Publicly Disclosed, and Exploitation Less Likely.

#microsoft #vulnerability #CVE #infosec #cybersecurity #copilot #dynamics365 #azure