If you are part of a government agency responsible for the alphabet, especially if you manage an information-sharing program to combat cybercrime, be sure to properly verify the identity of new members before admission. Oh, and make sure the API is rate-limited so a malicious member can’t grab the entire user database and sell it on a dark web forum.

Snark aside, that’s exactly what happened to the FBI’s InfraGuard program. A smart user applied to the program using a CEO’s name and phone number, along with a compelling email address. The program administrators did not do much due diligence and approved the application. Annoying.

PingBSD

First of all, the good folks at FreeBSD released some errata on the ping problem which we talked about last week. First, note that although ping elevates root privileges via setuid, these privileges are removed before any data manipulation. And the ping to FreeBSD runs in a Capsicum sandbox, a huge barrier to system compromise from ping. And finally, a closer look at the bug in a real-world context casts doubt on the idea that Remote Code Execution (RCE) is actually possible due to the stack layout.

If someone is wrong somewhere, see if you have been wrong in the same or similar way elsewhere.

Wise advice from [Florian Obser], OpenBSD developer. So, seeing the ping problem in FreeBSD, he proceeded to check OpenBSD ping implementation for same or similar issues. The vulnerable code is not shared between versions, so it opted for afl++, a fuzzing tool with an impressive list of finds. Connect afl++ to the function in ping that handles incoming data and see what happens. The conclusion? No crashes found in this particular effort, but several deadlocks were identified and fixed. And it is a victory.

Citrix in the wild

A vulnerability in Citrix ADC (Application Delivery Controller), a load balancer for complex web applications, is actively exploited. This prompted the NSA to issue a PDF reviewrejecting the responsibility for the attacks on the feet of APT5, considered an Iranian actor.

The actual vulnerability is old, apparently quietly patched a few years ago. This has just been discovered to be a serious issue, allowing a vulnerable device configured to perform SAML authentication to be remotely compromised. Patches are now available for several vulnerable versions and Indicators of Compromise (IoC) have been released.

SPNEGO NEGOEX

This section header has strong Sneakers vibes, and my eyes keep trying to rearrange these letters to “Too Many Secrets”, but it just doesn’t fit. “NEGOEX” refers to Extended NEGOtation. “SPNEGO” is an acronym for “Simple and Protected GSSAPI Trading Mechanism”. And of course, GSSAPI is “Generic Security Service Application Program Interface”. All of this alphabet soup ultimately comes down to a method for negotiating authentication protocols. The important thing is that, by design, this protocol runs before any authentication, and it’s accessible in a bunch of different services. SMB, RDP, SMTP, and even HTTP can expose SPNEGO negotiation. And of course, there was a critical security flaw in Microsoft’s implementation.

The vulnerability, CVE-2022-37958, was patched in September and classified as high severity. Just a few days ago, [Valentina Palmiotti] demonstrated that the vulnerability could be used for remote execution, and it was raised to critical severity. Full details will be released in 2023, giving everyone plenty of time to get this one corrected. From what’s been released so far, that’s going to be pretty big. The race is now on, to see if malicious groups discover the details before then.

Demonstration of CVE-2022-37958 RCE Vuln. Accessible through any Windows application protocol that authenticates. Yes, that means RDP, SMB and many more. Thanks for patching this one, it’s serious! https://t.co/ikOrTvQIJs pic.twitter.com/bOTmL5Fh2H

— Chompie (@chompie1337) December 13, 2022

FortiOS RCE

And to complete the burning hair section of the news, a pre-authentication RCE in FortiOS is actively exploited to compromise Fortinet devices. The update has been out for a month, but wasn’t marked as a security patch, so the rollout was a bit slow. This is a buffer overflow in the SSL-VPN service and appears to have existed since the 5.x release series. As older 5.x and 6.0.x firmwares are no longer supported, they may not receive updates that fix this one. Disabling the Internet-facing VPN seems like a valid workaround to the problem.

AI “improves” security

The new machine learning star is OpenAI’s chat bot, which has been full of surprises. [Rick Osgood] conducts Red Team penetration testing, and just had to try to use the tool for the wrong simulated. He asked her to generate a phishing email, promising a gift card to complete a survey. And the results were terribly good. So good in fact [Osgood] had to tell the AI ​​to make the email a little dodgy, with hilarious results.

Smuggling SVG

Scalable Vector Graphics (SVG) is a bit odd. It is an image format, particularly useful because the resulting images are infinitely scalable. It’s also an XML-based markup language, and all sorts of interesting data can be included. This apparently includes HTML and JavaScript code, and this code can be Base64 encoded. And it’s a useful way to sneak malicious code past a security solution. For even more creative chaos, once the JavaScript code starts executing, it can even be used to create an executable file in memory and download it to the local machine. Sly.